Google Chrome Multiple Security Flaws

Sandbox escape in Google Chrome's Payments component before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox by serving a crafted HTML page, driven by insufficient validation of untrusted input (CWE-20). Google rates the Chromium security severity as Medium, but the assigned CVSS is 9.6 due to the scope-changing sandbox escape. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21%.

Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 allows an attacker who tricks a user into installing a malicious extension to break out of the renderer/extension sandbox via a crafted extension exploiting insufficient input validation. The flaw was reported internally by the Chrome team and carries an NVD CVSS of 9.6, though Chromium rates the security severity only Medium and SSVC shows no known exploitation; no public exploit identified at time of analysis. A vendor patch is available, and exploitation hinges on the significant precondition of the victim installing an attacker-controlled extension.

Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox via insufficient input validation in the WebSockets implementation, triggered by a crafted HTML page. This is a second-stage exploitation primitive rather than an initial-access bug: it requires a pre-existing renderer compromise plus user navigation to attacker content. No public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and it is not on CISA KEV, though Google has shipped a fixed Stable channel build.

Sandbox escape in Google Chrome's ANGLE graphics layer allows a remote attacker to corrupt memory via a crafted HTML page in versions prior to 151.0.7922.72. The flaw is an out-of-bounds read and write (CWE-125) that a victim triggers simply by visiting a malicious page, potentially letting attacker-controlled code break out of the renderer sandbox. Google has released a fixed stable channel build; there is no public exploit identified at time of analysis and EPSS risk is currently low (0.21%).

Sandbox escape in Google Chrome's "Save to Drive" feature (prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by supplying a crafted PDF file. The flaw stems from insufficient validation of untrusted input (CWE-20) and, while scored CVSS 9.6, is rated only Medium by Chromium because it is a second-stage bug requiring a prior renderer compromise. There is no public exploit identified at time of analysis and EPSS is low (0.19%, 9th percentile), consistent with a chained, non-trivial exploitation path rather than mass exploitation.

Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 stems from a use-after-free in the Media component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the underlying bug Medium severity, but the reported CVSS is 9.6 due to the scope-changing sandbox-escape impact; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.21% (11th percentile). A vendor patch is available.

Use-after-free in the V8 JavaScript engine within Google Chrome versions prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to perform out-of-bounds memory access via a crafted HTML page. Despite a CVSS score of 8.8, this is not a standalone remote code execution path - it requires a pre-existing renderer compromise as an explicit precondition, placing it firmly in the category of a second-stage chained exploit. No public exploit code has been identified, CISA has not added this to the KEV catalog, and EPSS sits at 0.22% (13th percentile), consistent with targeted rather than mass exploitation risk. A vendor-released patch is available in Chrome 151.0.7922.72.

Sandboxed arbitrary code execution in Google Chrome's AdFilter component (versions prior to 151.0.7922.72 on desktop) allows a remote attacker to run code inside the renderer sandbox by luring a victim to a crafted HTML page. Rated Medium by Chromium and CVSS 8.8 by NVD, the flaw requires user interaction (visiting a malicious site) but no authentication; execution is confined to the sandbox rather than achieving full host compromise. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).

Heap corruption in Google Chrome for Mac (Views UI component) prior to 151.0.7922.72 allows a remote attacker to potentially exploit a use-after-free by luring a victim to a crafted HTML page. The flaw is a memory-corruption bug that, if successfully leveraged, could lead to arbitrary code execution within the renderer/browser process; no public exploit has been identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Google rates the Chromium security severity as Medium, though the assigned CVSS of 8.8 reflects the full-impact potential typical of browser memory-corruption bugs.

Sandbox-confined remote code execution in Google Chrome's Extensions component (versions prior to 151.0.7922.72) lets a remote attacker run arbitrary code inside the browser sandbox by getting a victim to load a crafted Chrome Extension, exploiting a use-after-free (CWE-416). Chromium rated the severity Medium because execution is contained within the sandbox rather than achieving full host compromise, though the NVD-style CVSS is 8.8. There is no public exploit identified at time of analysis, and EPSS is low at 0.24% (15th percentile).

Use-after-free in the Audio component of Google Chrome for macOS enables a potential sandbox escape in versions prior to 151.0.7922.72. Exploitation is a two-stage attack: an attacker must first compromise the renderer process (via a separate vulnerability), then leverage this Audio UAF through a crafted HTML page to break out of the Chrome sandbox. No public exploit has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) signals low observed exploitation probability despite the high CVSS score of 8.8; vendor-released patch 151.0.7922.72 is available.

Privilege escalation in Google Chrome's DevTools component (versions prior to 151.0.7922.72) lets an attacker who convinces a user to install a malicious extension escape the normal extension privilege boundary via a crafted Chrome Extension. Rooted in insufficient validation of untrusted input (CWE-20), the flaw carries a CVSS 8.8 rating reflecting high confidentiality, integrity, and availability impact once the extension is installed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though Chrome's ubiquity makes patch urgency high.

Sandboxed arbitrary code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) lets a remote attacker run code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated CVSS 8.8 with a Chromium severity of Medium; a vendor patch is available. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.21%.

BFCache in Google Chrome prior to 151.0.7922.72 contains insufficient input validation that enables a renderer-compromised attacker to escape Chrome's sandbox and execute code in the higher-privileged browser process via a crafted HTML page. The Scope:Changed metric in the CVSS vector (8.7) confirms the escape crosses the renderer-to-browser process boundary, yielding high confidentiality and integrity impact. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile) and SSVC rates exploitation as none and not automatable, consistent with the chained, technically demanding nature of this attack.

Heap corruption in Google Chrome's Variations component before 151.0.7922.72 lets an attacker holding a privileged network position (an on-path / man-in-the-middle attacker) corrupt memory by delivering malicious network traffic, stemming from CWE-20 insufficient input validation. Google rates the Chromium severity as Medium and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and the flaw is not in CISA KEV. Because Variations (Chrome's server-driven feature-flag/experiment system) is fetched at startup in the browser process, a successful attacker could turn intercepted config traffic into a memory-safety primitive.

Sandbox escape in Google Chrome on Linux before 151.0.7922.72 lets a remote attacker break out of the renderer sandbox when a victim opens a crafted HTML page, abusing an inappropriate implementation in the File Input component (CWE-269, improper privilege management). Rated Medium by Chromium and scored CVSS 7.1 with a scope change, it requires user interaction (visiting a malicious page) but no authentication; there is no public exploit identified and EPSS exploitation probability is low at 0.21% (11th percentile).

Sandbox escape in Google Chrome's ANGLE graphics component affects all desktop builds prior to 151.0.7922.72, where a remote attacker can serve a crafted HTML page to trigger a use-after-free and potentially break out of the renderer sandbox. Google rates the Chromium security severity as Medium; there is no public exploit identified at time of analysis and it is not in CISA KEV, with a low EPSS of 0.21% (11th percentile). Exploitation requires the victim to visit an attacker-controlled page (UI:R), and a vendor patch is already available.

Sandbox escape in Google Chrome's Android WebView (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox when a victim views a crafted HTML page. Rated Medium by Chromium and CVSS 7.1, it carries a scope-changing impact but requires user interaction; there is no public exploit identified at time of analysis and EPSS is low (0.21%, 11th percentile), indicating limited near-term mass exploitation likelihood.

Same-origin policy bypass in Google Chrome's ControlledFrame component prior to version 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by delivering a crafted HTML page to an unsuspecting user. The root cause is insufficient policy enforcement (CWE-346) within the ControlledFrame API, allowing an attacker to subvert origin boundaries and achieve high-integrity cross-origin impact. No active exploitation is confirmed - CISA KEV is not triggered, SSVC reports exploitation as none, and EPSS sits at a low 0.22% (13th percentile) - indicating this is a meaningful but currently theoretical browser integrity risk.

Site isolation bypass in Google Chrome's Extensions subsystem before version 151.0.7922.72 allows an attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page, enabling access to or modification of data from other loaded origins. This is a chained exploit primitive - it depends on prior renderer compromise - making it a significant escalation step rather than a standalone entry point. No public exploit code has been identified and CISA SSVC rates exploitation status as none, consistent with the low EPSS score of 0.22% (13th percentile).

Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to violate cross-origin isolation boundaries by luring a user to visit a specially crafted HTML page. The CVSS vector assigns High integrity impact with no privilege requirement, meaning successful exploitation could enable an attacker to inject or manipulate cross-origin content within the victim's browser session. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), with SSVC confirming no observed exploitation - placing this in the patch-on-schedule rather than emergency-response tier.

Navigation restriction bypass in Google Chrome's Presentation component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent enforced browser navigation policies via a specially crafted HTML page. The flaw carries a high integrity impact (I:H) with no privilege requirement on the attacker's side, though victim interaction is mandatory. EPSS sits at 0.22% (13th percentile) and SSVC classifies exploitation as 'none' with a non-automatable profile, placing this in the patch-but-not-emergency tier for most organizations. No public exploit code identified at time of analysis.

Uninitialized memory use in Google Chrome's codec subsystem allows remote attackers to read potentially sensitive data from process memory by enticing a user to visit a crafted HTML page. Affected are all Chrome desktop builds prior to version 151.0.7922.72 on all supported platforms. No public exploit code has been identified and EPSS sits at a low 0.23%, indicating limited exploitation activity at time of analysis, though the high confidentiality impact (CVSS C:H) means successful exploitation could expose sensitive browser process memory including cached credentials or session tokens.

Same Origin Policy bypass in Google Chrome's FedCM (Federated Credential Management) subsystem prior to version 151.0.7922.72 enables remote attackers to achieve high-integrity cross-origin impact by luring victims to a crafted HTML page. The flaw stems from an inappropriate implementation in the FedCM API, which fails to enforce origin boundaries correctly (CWE-693). No active exploitation or public proof-of-concept has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability despite the network-accessible attack vector.

Same-origin policy bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows an unauthenticated remote attacker to perform unauthorized cross-origin write operations against a victim's browser context. Exploitation requires the victim to visit a specially crafted HTML page (UI:R), making it a socially-engineered threat rather than a purely opportunistic one. EPSS is low at 0.22% (13th percentile) and no CISA KEV listing or public exploit code has been identified, consistent with the Chromium team's own 'Medium' severity rating; however, Chrome's ubiquitous deployment makes even medium-severity findings broadly relevant.

Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows remote attackers to circumvent browser navigation controls by delivering maliciously crafted network traffic to a victim device. The flaw stems from insufficient input validation (CWE-20) in the iOS-specific implementation of Chrome, resulting in an Integrity:High impact - enabling unauthorized navigation, redirect manipulation, or security-boundary evasion - with no confidentiality or availability consequences. No public exploit has been identified and EPSS places exploitation probability at just 0.17% (7th percentile), indicating low active exploitation risk at time of analysis.

UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) can be achieved by a remote attacker who has already compromised the renderer process, enabling deceptive payment interfaces via a crafted HTML page. The CVSS vector scores integrity impact as High (I:H) with no confidentiality or availability impact, reflecting the ability to mislead users through falsified UI elements in a sensitive financial context. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), indicating this vulnerability is not yet being actively targeted at scale.

UI spoofing via Chrome's Credential Management component (versions prior to 151.0.7922.72) enables a remote attacker to misrepresent credential-related browser UI to a user who visits a crafted HTML page. The flaw stems from an inappropriate implementation of the Credential Management API (CWE-451), which can cause the browser to render misleading prompts that mimic legitimate credential dialogs. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS probability is very low at 0.21%, consistent with SSVC's 'Exploitation: none' classification.

UI spoofing in Google Chrome's Messages component on Android allows remote unauthenticated attackers to misrepresent critical interface information to victims via crafted HTML pages. Affects all Chrome for Android versions prior to 151.0.7922.72; desktop Chrome is not listed as affected. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) signals low current exploitation probability consistent with the mandatory user-interaction requirement.

Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.

Memory disclosure in Google Chrome's MediaRecording subsystem allows remote attackers to read sensitive data from the browser process by enticing a user to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across supported platforms. No public exploit exists and EPSS probability stands at only 0.21% (11th percentile); SSVC also assesses exploitation as none and the attack as non-automatable, making this a patch-track rather than emergency-response priority despite the CVSS 6.5 base score.

Navigation restriction bypass in the Glic component of Google Chrome for Android (versions prior to 151.0.7922.72) allows unauthenticated remote attackers to circumvent browser policy enforcement by directing victims to a crafted HTML page. The integrity-only impact (I:H) reflects the ability to navigate users past enforced restrictions, though confidentiality and availability are unaffected. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and the vulnerability is not listed in CISA KEV - vendor-released patch is available in Chrome 151.0.7922.72.

Navigation restriction bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to circumvent sandboxing controls by luring a user to a crafted HTML page. Versions prior to 151.0.7922.72 are affected. No public exploit exists and SSVC confirms no active exploitation; with an EPSS of 0.22% at the 13th percentile, this is a medium-priority defect addressed by Chrome's stable-channel update released in July 2026.

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation enables a remote attacker to inject arbitrary scripts or HTML across origin boundaries by directing a victim to a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected. No public exploit has been identified at time of analysis and CISA SSVC rates exploitation as none, but the cross-origin scope change makes this meaningfully more impactful than a standard reflected XSS, warranting timely patching given Chrome's ubiquitous deployment footprint.

Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The CVSS Scope:Changed metric confirms this is a true sandbox escape, elevating impact beyond the renderer isolation boundary. No public exploit code exists and EPSS stands at 0.17% (7th percentile), reflecting the chained, high-complexity nature of the attack. Google has released a patched stable channel build (151.0.7922.72).

Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.

Use-after-free in the GPU process on macOS enables sandbox escape in Google Chrome versions prior to 151.0.7922.72, but only when an attacker has already achieved renderer process compromise. This is a second-stage exploit primitive - it extends an existing renderer compromise across the sandbox boundary into the GPU process, potentially allowing arbitrary code execution outside Chrome's sandbox on macOS. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; however, sandbox escapes are a critical capability for attackers chaining browser exploit kits.

Sandbox escape in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a specially crafted HTML page. Affected versions are all Chrome releases on Android prior to 151.0.7922.72. This is a chained attack: the flaw alone is insufficient - exploitation requires a prior, separate renderer compromise, which substantially raises the real-world exploitation bar. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; EPSS sits at a low 0.21%.

Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.

Policy bypass in Chrome's Receiver component enables sandbox escape for attackers who have already compromised the renderer process, affecting all Google Chrome versions prior to 151.0.7922.72 on desktop platforms. Exploitation requires chaining a separate renderer compromise vulnerability with this Receiver policy bypass, triggered via a crafted HTML page with user interaction, allowing the attacker to escape Chrome's sandbox boundary and execute code at the OS process level. No public exploit identified at time of analysis; EPSS at 0.22% (13th percentile) and SSVC exploitation status of 'none' indicate low current exploitation probability.

Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) enables an attacker who has already achieved renderer-process compromise to break out of Chrome's sandbox via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Extensions subsystem, with a CVSS Scope:Changed rating confirming the impact extends beyond the browser process to the host OS. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with absence from CISA KEV - but the sandbox escape class carries disproportionate risk relative to its 5.8 base score because it enables full host-level code execution when chained with a renderer RCE.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 allows a remote unauthenticated attacker to inject arbitrary scripts or HTML that can escape the browser's same-origin policy by delivering a crafted HTML page to an unsuspecting victim. All Chrome installations below 151.0.7922.72 across supported platforms are affected, with partial confidentiality and integrity impact. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' confirm low current exploitation probability, though UXSS primitives carry disproportionate value for credential and session theft.

Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries via crafted malicious network traffic, requiring only passive user interaction such as visiting a compromised page. The vulnerability stems from insufficient input validation (CWE-20) in the iOS-specific Chrome codebase, which uses Apple's WebKit engine rather than Blink. No public exploit code has been identified and CISA KEV does not list this vulnerability; EPSS probability sits at 0.19%, placing it in the 9th percentile of exploitation likelihood.

Site Isolation bypass in Google Chrome prior to 151.0.7922.72 allows a remote unauthenticated attacker to circumvent the browser's cross-origin process isolation boundary by luring a user to a specially crafted HTML page. The flaw produces partial confidentiality loss - limited cross-origin data exposure - with no integrity impact and constrained scope (S:U per CVSS). No public exploit code exists, CISA SSVC confirms exploitation status as 'none,' and EPSS sits at 0.22% (13th percentile), collectively indicating low near-term exploitation probability despite the ubiquitous deployment footprint of Chrome.

Safe Browsing in Google Chrome prior to 151.0.7922.72 fails to adequately validate untrusted input from a malicious file, allowing a remote attacker to bypass discretionary access control within the browser. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N) confirms unauthenticated network delivery is viable but requires user interaction with the malicious file, limiting both automation and stealth. EPSS at 0.20% (11th percentile) and SSVC exploitation status of 'none' align with the absence of any public exploit or KEV listing, placing this firmly in a patch-and-monitor posture rather than an emergency response.

Use-after-free in the Bluetooth component of Google Chrome on Android prior to 151.0.7922.72 enables a sandbox escape for remote attackers who have already achieved renderer process compromise. Exploitation requires delivering a crafted HTML page to a victim user and successfully triggering a memory corruption condition in the Bluetooth subsystem, allowing code execution outside the renderer sandbox. No public exploit code has been identified at time of analysis, and EPSS at 0.21% (11th percentile) indicates low observed exploitation probability; no CISA KEV listing is present.

Cross-origin data leakage in Google Chrome's Presentation API prior to version 151.0.7922.72 enables remote attackers to exfiltrate sensitive same-browser data by delivering a crafted HTML page to an unsuspecting user. The flaw violates the Same-Origin Policy through an origin validation error (CWE-346) in the PresentationAPI component, potentially exposing session tokens, authentication state, or other sensitive content from co-resident origins. No public exploit has been identified and EPSS sits at the 11th percentile (0.21%), indicating low mass-exploitation risk at time of analysis.

Omnibox (URL bar) spoofing in Google Chrome for Android prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to display arbitrary URL content in the address bar via a crafted HTML page. This is explicitly a second-stage chained vulnerability - renderer compromise is a mandatory prerequisite, meaning the flaw functions as an escalation primitive rather than a standalone attack. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) reflects very low opportunistic exploitation probability, though the phishing and credential-theft potential when chained with a renderer exploit is meaningful.

Cross-origin data leakage in Google Chrome's QUIC implementation on Android, affecting all versions prior to 151.0.7922.72, allows a remote attacker to exfiltrate data across origin boundaries by directing a user to a crafted HTML page. The root cause is an inappropriate QUIC implementation that fails to properly enforce origin validation (CWE-346), breaking the browser's same-origin security model. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% at the 11th percentile corroborates low real-world risk at time of analysis.

Cross-origin data leakage in Google Chrome's Payments subsystem prior to version 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346) within the Payments component, meaning Chrome fails to properly validate origin boundaries when handling payment-related operations. No public exploit code has been identified and EPSS is very low (0.21%), but the ubiquitous deployment of Chrome elevates aggregate exposure.

UI spoofing in Google Chrome's Extensions component enables an attacker who persuades a victim to install a malicious extension to misrepresent browser security indicators, affecting all Chrome desktop versions prior to 151.0.7922.72. The flaw (CWE-451) stems from incorrect rendering of security UI elements within the Extensions subsystem, granting a crafted extension the ability to deceive users about their browser's security state or extension permissions. No public exploit identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects very low exploitation probability; this CVE is not listed in CISA KEV.

Side-channel information leakage in Google Chrome's Autofill feature (versions prior to 151.0.7922.72) enables cross-origin data exfiltration by exploiting observable behavioral differences during Autofill interactions. An unauthenticated remote attacker who delivers a crafted HTML page and persuades the victim to perform specific UI gestures can infer data belonging to other origins, bypassing Same-Origin Policy protections. EPSS is very low at 0.21% (11th percentile) and no active exploitation is confirmed via CISA KEV, making this a real but modest real-world risk - primarily meaningful where sensitive Autofill data (saved addresses, payment details) is stored in the target browser profile.

Cross-origin data leakage in Google Chrome's Autofill feature on Android prior to 151.0.7922.72 allows a remote unauthenticated attacker to read limited data belonging to another origin by luring a victim to a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning the Autofill subsystem fails to enforce same-origin boundaries when processing or exposing form data. No active exploitation is confirmed (SSVC: Exploitation none; EPSS 0.21%, 11th percentile), and a vendor patch is available in the 151.0.7922.72 stable release.

Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) exposes residual memory contents to remote attackers via a crafted HTML page. ANGLE - Chrome's graphics abstraction layer - fails to initialize memory before use (CWE-457), allowing pixel or buffer data from one origin to be read by another. No public exploit identified at time of analysis; EPSS probability is 0.23% (14th percentile), indicating low current exploitation activity despite Chrome's massive deployment footprint.

Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) enables a remote attacker to read sensitive form data across origins by serving a crafted HTML page to the victim. The root cause is an origin validation error (CWE-346) where the Autofill implementation fails to enforce proper origin boundaries, violating the browser same-origin policy for autofill-populated fields. No public exploit code has been identified and the EPSS score of 0.21% places this in the 11th percentile, indicating very low current exploitation probability; a vendor patch is available.

Cross-origin data leakage in Google Chrome's Skia graphics engine affects all Chrome versions prior to 151.0.7922.72, enabling remote attackers to read sensitive data across browser security boundaries when a victim visits a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within the Skia 2D rendering library, which may expose residual memory contents - potentially including fragments from other origins - violating the Same-Origin Policy at the memory level. No public exploit code has been identified and EPSS sits at 0.23% (14th percentile), indicating low exploitation probability at time of analysis despite the vulnerability being remotely triggerable without authentication.

Cross-origin data leakage in Google Chrome's NoStatePrefetch feature exposes confidential resources across origin boundaries when a victim visits an attacker-crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. The flaw exploits observable side-channel signals produced during background prefetch operations to infer cross-origin state, violating Same-Origin Policy protections. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the product's ubiquitous deployment footprint.

Cross-origin data leakage in Google Chrome for iOS prior to 151.0.7922.72 exposes sensitive information from other browser origins when a user visits a specially crafted HTML page. The root cause is an inappropriate implementation of origin validation (CWE-346) within Chrome's iOS-specific code path, breaking the browser's same-origin policy boundary. No public exploit code or active exploitation has been identified; EPSS probability stands at 0.21% (11th percentile), and the vulnerability is absent from the CISA KEV catalog, indicating low near-term exploitation pressure.

Cross-origin data leakage in Google Chrome's GPU implementation prior to version 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to read cross-origin rendered content via a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the GPU compositor layer, enabling sandbox-escaped renderer processes to access pixel or texture data belonging to other security origins. EPSS at 0.21% (11th percentile) and no CISA KEV listing indicate low current exploitation probability; no public exploit code has been identified at time of analysis.

Cross-origin data leakage in Google Chrome's WebProtect component (prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by loading a crafted HTML page. The flaw stems from an inappropriate implementation of origin validation (CWE-346), allowing WebProtect to fail its primary function of enforcing same-origin boundaries within Chrome's sandboxed renderer. No active exploitation has been confirmed by CISA KEV, no public POC has been identified, and EPSS at 0.21% (11th percentile) indicates low near-term exploitation probability - though this vulnerability's relevance as a component in chained browser exploit chains elevates its strategic significance beyond the raw score.

Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by delivering a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, making it a chained exploit rather than a standalone attack. No active exploitation is confirmed in CISA KEV, and EPSS is 0.21% (11th percentile), consistent with low observed exploitation activity despite Chrome's ubiquitous deployment footprint.

Cross-origin data leakage in Google Chrome's Cast component exposes sensitive information across origins to remote attackers who can induce a victim to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.21% (11th percentile) reflects low current exploitation probability, consistent with Google's own 'Medium' severity classification.

Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, exploitable by a remote unauthenticated attacker through a crafted HTML page that a victim must visit. The flaw stems from uninitialized memory use in Skia (CWE-457), allowing stale heap or stack data to be read and potentially exfiltrated across origin boundaries, undermining the browser's same-origin policy protections. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.23% (14th percentile), but the patch is confirmed available and the product's ubiquitous deployment makes broad-surface exposure a consideration.

Out-of-bounds memory read in Google Chrome's WebGL implementation (versions prior to 151.0.7922.72) allows a remote attacker to disclose limited browser process memory contents when a victim visits a crafted HTML page. Impact is confined to partial confidentiality - no write primitive exists, ruling out direct code execution. No public exploit has been identified and SSVC confirms no active exploitation, placing this in a lower-priority patch tier despite its network-accessible attack vector.

Cross-origin data leakage in Google Chrome's Cast subsystem (all versions prior to 151.0.7922.72) enables a remote unauthenticated attacker to exfiltrate sensitive cross-origin data by luring a victim to a specially crafted HTML page. The vulnerability, rated Medium by the Chromium security team with a CVSS of 4.3, is bounded to a limited confidentiality impact with no code execution risk. No active exploitation is confirmed in CISA KEV, and EPSS at 0.21% (11th percentile) indicates a very low probability of widespread in-the-wild exploitation at time of analysis.

Cross-origin data leakage in Google Chrome's Autofill component (versions prior to 151.0.7922.72) allows remote attackers to read data from a different origin than the page being visited. Exploitation requires the victim to interact with a specially crafted HTML page, placing this firmly in the social-engineering/phishing threat model. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating negligible observed exploitation activity; this is not currently listed in CISA KEV.

Cross-origin data leakage in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables a crafted extension to bypass same-origin policy protections and read data from cross-origin browser contexts. Exploitation requires convincing a target user to install a malicious Chrome Extension, placing this firmly in the social-engineering-dependent threat category. No active exploitation is confirmed (not in CISA KEV), no public POC has been identified, and an EPSS of 0.13% at the 3rd percentile reflects minimal real-world exploitation probability at time of analysis.

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about the actual origin of the page they are viewing by serving a crafted HTML page. The flaw is a CWE-451 UI misrepresentation defect, meaning the browser fails to accurately convey security-critical location information to the user, creating a reliable phishing vector. No public exploit code exists and EPSS sits at 0.21% (11th percentile); SSVC confirms exploitation as none and technical impact as partial, placing this firmly in lower-priority remediation tiers despite the phishing relevance.

Cross-origin data leakage in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables a remote attacker to read data from a different web origin by inducing a victim to visit a crafted HTML page. The flaw is rooted in an inappropriate implementation of origin validation (CWE-346) within the resource-loading subsystem, undermining the browser's Same-Origin Policy enforcement. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating low exploitation likelihood at this time; however, the impact class is meaningful for users with active authenticated sessions to sensitive web applications.

Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to read fragments of sensitive data from other origins by directing a user to a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) in ANGLE, Chrome's cross-platform OpenGL ES abstraction engine, which may expose residual graphics buffer contents from previously rendered cross-origin content. No public exploit code and no active exploitation have been identified at time of analysis; EPSS of 0.23% (14th percentile) reflects low near-term exploitation probability.

Cross-origin data leakage in Google Chrome's Blink rendering engine (all versions prior to 151.0.7922.72) enables remote attackers to read data from other origins by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-delivered, requires no authentication, and succeeds with only user interaction - a single page visit. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate low exploitation probability and no confirmed active exploitation at time of analysis.

Uninitialized memory read in ANGLE (Chrome's graphics abstraction layer) on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Affected are all Google Chrome releases on Windows prior to 151.0.7922.72. An attacker who persuades a user to visit a malicious page can trigger the ANGLE component to read and potentially leak uninitialized memory, risking disclosure of in-process data. No public exploit code has been identified and EPSS stands at 0.23% (14th percentile), indicating low observed exploitation probability despite the broad deployment footprint of Chrome.

Cross-origin data leakage via an inappropriate GetUserMedia implementation in Google Chrome prior to 151.0.7922.72 enables a renderer-level attacker to exfiltrate data across origin boundaries using a crafted HTML page. Exploitation is gated behind a prior renderer process compromise, making this a chained or post-exploitation capability rather than a standalone initial-access vector. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting low real-world exploitation probability despite the broad deployment footprint of Chrome.

Cross-origin data leakage in Google Chrome's Cast feature affects all versions prior to 151.0.7922.72, enabling a remote attacker to read data across origin boundaries by luring a user to a crafted HTML page. The flaw stems from improper origin validation (CWE-346) within the Cast subsystem, violating the Same-Origin Policy. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating limited real-world exploitation pressure at time of analysis.

Side-channel GPU information leakage in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability exploits the GPU rendering pipeline to observe timing or state artifacts that escape the Same-Origin Policy boundary, allowing partial disclosure of data from other origins loaded in the browser. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation probability; a vendor-released patch is available.

Cross-origin data leakage in Google Chrome's WebGL implementation on Android allows a remote attacker to read memory contents belonging to other origins via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. The vulnerability stems from uninitialized memory use (CWE-457) in the WebGL subsystem, exposing stale memory that may contain sensitive cross-origin data. No public exploit code exists and EPSS sits at 0.23% (14th percentile), indicating low current exploitation probability; this is not listed in CISA KEV.

Insufficient policy enforcement in Google Chrome's Extensions subsystem prior to version 151.0.7922.72 enables Universal Cross-Site Scripting (UXSS), allowing an attacker who socially engineers a user into installing a malicious extension to inject arbitrary scripts or HTML across web origins. CVSS scores this at 4.2 (Medium) with high attack complexity reflecting the required social engineering; EPSS is negligible at 0.13% (3rd percentile). No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA KEV, suggesting it has not seen widespread or automated exploitation.

UI spoofing in Google Chrome's Payments component on Android allows a remote attacker who has already achieved renderer process compromise to deceive victims through manipulated payment dialogs via a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the lower-priority tier despite its network-accessible attack vector.

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) allows a local attacker to read clipboard contents belonging to a different browsing origin by luring a victim to a crafted HTML page. The flaw arises from insufficient input validation in Chrome's Clipboard component on Android, classified under CWE-20. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.13% at the 3rd percentile reflects a minimal real-world exploitation probability at this time.

Cross-origin data leakage in Google Chrome's SVG implementation (all versions prior to 151.0.7922.72) enables remote attackers to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw, rooted in an origin validation error (CWE-346) in Chrome's SVG rendering engine, breaks same-origin policy protections. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.