Google Chrome Prior to 151.0.7922.72 Security Flaws

Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, chaining into the higher-privileged browser process. The flaw stems from insufficient validation of untrusted input in the Passwords component (CWE-20) and is rated Medium by Chromium despite an NVD CVSS of 9.6. There is no public exploit identified at time of analysis, and EPSS is low at 0.17% (7th percentile).

Sandbox escape in Google Chrome's DevTools (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the sandbox and gain broader host access via a crafted HTML page. It stems from insufficient validation of untrusted input (CWE-20) and requires user interaction plus a pre-existing renderer foothold, so it functions as a second-stage exploit rather than a standalone entry point. There is no public exploit identified at time of analysis, and EPSS is low (0.17%), consistent with Chromium's internal 'Medium' severity rating despite the high NVD CVSS score.

Sandbox escape in Google Chrome for macOS (versions before 151.0.7922.72) can be achieved by an attacker who has already compromised the renderer process, chaining a DevTools race condition via a crafted HTML page to break out of the renderer sandbox. Reported internally by the Chrome team and rated Medium by Chromium, it carries an NVD CVSS of 9.6 due to the scope change, though EPSS is very low (0.14%, 4th percentile). No public exploit identified at time of analysis and it is not on CISA KEV, indicating no confirmed active exploitation.

Sandbox escape in Google Chrome's media codec handling affects all Chrome desktop builds prior to 151.0.7922.72, where an integer overflow while parsing a maliciously crafted video file can let a remote attacker break out of the renderer sandbox. Exploitation requires the victim to load attacker-controlled media (UI:R), and there is no public exploit identified at time of analysis; EPSS is low (0.17%, 6th percentile) and the flaw is not on CISA KEV. Notably, Chromium's own triage rated this 'Medium' severity, which conflicts with the NVD-style 9.6 Critical score.

Sandbox escape in Google Chrome on ChromeOS (versions prior to 151.0.7922.72) stems from a heap buffer overflow in the Color component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Chromium rates the severity High and the CVSS score is 9.6 owing to the scope change into the host OS. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.31% (24th percentile), consistent with a second-stage bug that requires a prior renderer compromise.

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the browser's Input handling, which an attacker who has already compromised the renderer process can leverage via a crafted HTML page to break out of the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to scope change, it requires user interaction (visiting a malicious page) and a prior renderer foothold. There is no public exploit identified at time of analysis and EPSS is low (0.29%), reflecting a chained, non-trivial exploitation path rather than trivial mass exploitation.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker to break out of the renderer sandbox via a crafted HTML page, leveraging a use-after-free memory-corruption bug. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change from sandboxed renderer to host. There is no public exploit identified at time of analysis and the EPSS exploitation probability is low (0.21%, 11th percentile), consistent with CISA SSVC recording no known exploitation.

Sandbox escape in Google Chrome's WebGL implementation on Android (versions before 151.0.7922.72) lets a remote attacker corrupt memory via an out-of-bounds write triggered by a crafted HTML page, potentially breaking out of the renderer sandbox. Rated Chromium 'High' and CVSS 9.6 due to scope change and full confidentiality/integrity/availability impact, it requires the victim to visit a malicious page (UI:R). No public exploit is identified at time of analysis, EPSS is low (0.21%), and CISA SSVC records exploitation as 'none'.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox, undermining the browser's core containment boundary. The flaw stems from insufficient validation of untrusted input (CWE-20) in ANGLE, Chrome's WebGL/OpenGL-to-native translation layer. It was reported internally by the Chrome team; there is no public exploit identified at time of analysis, and the EPSS score is low at 0.18% (8th percentile).

Sandbox escape in Google Chrome on macOS before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a contained renderer exploit into broader access on the host. The flaw stems from an inappropriate implementation in Chrome's Network component and is fixed in the stable channel update. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and Chromium rated the underlying severity Medium despite the NVD-style CVSS 9.6.

Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from insufficient input validation in Dawn, Chromium's WebGPU implementation, and allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer/GPU-process sandbox (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis and the flaw is not in CISA KEV; EPSS is low at 0.31% (23rd percentile), consistent with SSVC rating exploitation as 'none' despite a 'total' technical impact. Chrome rates the underlying Chromium bug as Critical.

Sandbox escape in Google Chrome versions prior to 151.0.7922.72 stems from an integer overflow in the QUIC networking stack, allowing an attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Rated High severity by Chromium (CVSS 9.6, scope-changed), the flaw requires a prior renderer compromise and user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and the EPSS probability is low at 0.29%.

Sandbox escape in Google Chrome's ANGLE graphics layer before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, achieving code execution at higher privilege on Windows, macOS, and Linux desktops. Rated High severity by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though the EPSS probability is only 0.21% (11th percentile). There is no public exploit identified at time of analysis and the CVE is not on CISA KEV, but the bug was reported internally by the Chrome team and a fixed build is already shipping.

Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted untrusted input to the Web Authentication (WebAuthn) component. Rated High severity by Chromium and scored CVSS 9.6, it is a second-stage bug chained after an initial renderer exploit rather than a standalone remote compromise. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.34% (27th percentile).

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, gaining high confidentiality, integrity, and availability impact on the host. Rated High by Chromium and CVSS 9.6 due to scope change, it is a second-stage exploitation primitive rather than a standalone initial-access flaw. No public exploit is identified at time of analysis, and EPSS exploitation probability is low at 0.29% (21st percentile).

Sandbox escape in Google Chrome for iOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating a contained renderer foothold into broader control (CVSS 9.6, scope-changed). Reported internally by the Chrome team under CWE-20 insufficient input validation; no public exploit identified at time of analysis, and EPSS is low at 0.29% (21st percentile), consistent with a chained bug that is not yet weaponized. Vendor-released patch is available in stable channel 151.0.7922.72.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page. Rated High by Chromium and CVSS 9.6, the flaw is a CWE-843 type confusion; Google has shipped a fixed Stable channel build. There is no public exploit identified and no CISA KEV listing, and EPSS is low at 0.31% (24th percentile), indicating no evidence of active exploitation at time of analysis.

Sandbox escape in Google Chrome on Windows before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process leverage a use-after-free in the DataTransfer component (clipboard/drag-and-drop data) to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 driven by scope change and full CIA impact, though EPSS is low (0.29%) and there is no public exploit identified at time of analysis. It is not on CISA KEV and requires an existing renderer compromise plus user interaction, making it a second-stage bug in an exploit chain rather than a standalone entry point.

Sandbox escape in Google Chrome on macOS (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox via a crafted HTML page after the victim loads it. Rated High by Chromium and carrying a CVSS 9.6 (scope-changed), it enables an attacker to escalate from web content into higher-privilege execution on the host. No public exploit identified at time of analysis, and EPSS exploitation probability is low (0.29%, 21st percentile).

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 151.0.7922.72 lets a remote attacker who lures a victim to a crafted HTML page trigger a type confusion (CWE-843) and potentially break out of the renderer sandbox. Google rates the Chromium severity High, and the CVSS 9.6 reflects a scope-changing bug requiring only that the victim open a page. There is no public exploit identified at time of analysis, EPSS is low at 0.31% (24th percentile), and CISA's SSVC marks exploitation as none.

Sandbox escape in Google Chrome's ANGLE graphics layer on macOS (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope change from renderer to host, it enables full compromise of the browser process. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.29% (21st percentile).

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Chromium severity High with a CVSS 9.6, the flaw is a use-after-free (CWE-416) reported by Google's own Chrome team; a vendor patch is available. There is no public exploit identified at time of analysis and EPSS is low (0.29%), consistent with SSVC showing no known exploitation.

Sandbox escape in Google Chrome desktop prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process leverage a use-after-free in the Audio component to break out of the sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to scope change, this is a second-stage exploit primitive rather than an initial-access bug; no public exploit has been identified at time of analysis and EPSS is low at 0.29%. A vendor patch is available in Chrome 151.0.7922.72.

Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a race condition in the Downloads component. Chromium rates it High severity and the CVSS is 9.6 (scope-changed). This is no public exploit identified at time of analysis; EPSS is low at 0.23% (14th percentile) and CISA SSVC records exploitation status as none.

Sandbox escape in Google Chrome for macOS prior to 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the sandbox and reach the more-privileged browser process by loading a crafted HTML page that abuses Chrome's MHTML handling. It is rated High by Chromium and carries a CVSS 9.6 (scope-changed) score, but exploitation is a second-stage step that presupposes prior renderer compromise. There is no public exploit identified at time of analysis, and EPSS is low at 0.29% (21st percentile).

Sandbox escape in Google Chrome on macOS prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a race condition in the Downloads component through a crafted HTML page. Rated High by Chromium and carrying a CVSS 9.6 due to the scope-changing total impact, it is patched in the July 2026 Stable channel update. There is no public exploit identified at time of analysis, EPSS is low at 0.23%, and CISA SSVC records exploitation as 'none'.

Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who already controls a compromised renderer process break out of the sandbox through crafted input handled by the browser's Accessibility component. Rated High by Chromium and CVSS 9.6, it is a second-stage bug typically chained after an initial renderer exploit, giving an attacker a path to full compromise of the browser/host context. There is no public exploit identified at time of analysis, EPSS risk is low (0.29%, 21st percentile), and it is not on CISA KEV.

Sandbox escape in Google Chrome's ANGLE graphics component affects all Desktop builds prior to 151.0.7922.72, where an out-of-bounds write (CWE-787) can be triggered by a crafted HTML page to corrupt memory in the GPU process and cross the sandbox boundary. Chromium rates the flaw High and the CVSS 3.1 score is 9.6 owing to the scope change (S:C) and full CIA impact, though it requires the victim to load attacker-controlled content (UI:R). There is no public exploit identified at time of analysis, and the low EPSS score (0.21%, 11th percentile) suggests no observed weaponization yet.

Sandbox escape in Google Chrome's Dawn WebGPU implementation (versions prior to 151.0.7922.72) lets a remote attacker corrupt heap memory in the GPU process via a crafted HTML page, potentially breaking out of the renderer sandbox to compromise the host. The CVSS 3.1 vector (AV:N/UI:R/S:C, base 9.6) reflects that exploitation only needs a victim to visit a malicious site but crosses a security boundary; Google rates the Chromium severity as Medium. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 13th percentile), and it is not listed in CISA KEV.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory corruption. Google rated the underlying Chromium severity as Medium, and while the NVD CVSS is 9.6, exploitation is gated behind a pre-existing renderer compromise. There is no public exploit identified at time of analysis and EPSS probability is low (0.17%, 7th percentile), indicating this is a second-stage bug rather than a directly weaponizable entry point.

Sandbox escape in Google Chrome for macOS before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox using a crafted HTML page, escalating a contained renderer foothold toward the host. The flaw sits in Chrome's Crypto component and is a second-stage bug that must be chained with an initial renderer compromise. There is no public exploit identified at time of analysis, EPSS is low (0.18%, 8th percentile), and Google rates the Chromium security severity as Medium despite the high CVSS.

Sandbox escape in Google Chrome's ANGLE graphics layer on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the renderer sandbox and gain broader access on the device via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 largely because of the scope change from a successful escape. There is no public exploit identified at time of analysis, and EPSS is low (0.29%, 21st percentile), consistent with a bug that only becomes useful after a prior renderer compromise.

Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and full CIA impact, though it requires a pre-existing renderer compromise as a chained prerequisite. There is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%).

Sandbox escape in Google Chrome for iOS before version 151.0.7922.72 allows a remote attacker to break out of the browser's security boundary when a victim opens a crafted HTML page. Rated High by Chromium and carrying a 9.6 CVSS due to a scope-changing, high-impact outcome requiring only user interaction, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). A vendor-released patch is available and CISA SSVC currently records exploitation status as none.

Sandbox escape in Google Chrome desktop versions prior to 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 9.6 due to scope change and total confidentiality/integrity/availability impact, though there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.29%, 21st percentile), consistent with a second-stage bug that requires prior renderer compromise rather than a directly weaponizable entry point.

Sandbox escape in Google Chrome's Chromecast component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. Rated High by Chromium and scored CVSS 9.6 due to scope change, it is a classic second-stage browser exploit chained after an initial renderer bug. No public exploit is identified at time of analysis and EPSS is low (0.29%), consistent with a bug requiring a prior renderer foothold rather than a single-shot drive-by.

Sandbox escape in Google Chrome on Windows (versions prior to 151.0.7922.72) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Google rates the Chromium severity High and a fix is available in the Stable channel, but there is no public exploit identified at time of analysis and the EPSS probability is low (0.29%, 21st percentile). Exploitation requires user interaction (visiting a page) and, per the CVSS scope-change vector, success would elevate impact beyond the initially compromised component.

Sandbox escape in Google Chrome's Views UI framework (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. Google rates the Chromium severity Critical (CVSS 9.6), and while a patch is available on the Stable channel, there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.31%. Exploitation depends on chaining a prior renderer compromise, so this is one link in a full exploit chain rather than a standalone remote-code-execution bug.

Sandbox escape in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 151.0.7922.72, where an integer overflow can be triggered by a crafted HTML page to potentially break out of the renderer sandbox. Reported internally by the Chrome team and rated High by Chromium, with a vendor patch already shipped in the stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.29%, 21st percentile). Because sandbox escapes in ANGLE are typically chained with a renderer bug, this is a high-value component of a full-chain browser exploit rather than a standalone remote code execution.

Sandbox escape in Google Chrome's ANGLE graphics layer, fixed in stable release 151.0.7922.72, lets a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader access on the host. Rated Critical by Chromium and scored CVSS 9.6, the flaw stems from insufficient validation of untrusted input (CWE-20) processed by ANGLE and carries a scope-changing impact. There is no public exploit identified at time of analysis and EPSS is low at 0.31% (23rd percentile), but the Critical rating and sandbox-escape primitive make prompt patching important.

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Ozone platform abstraction layer, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and gain broader host access. Rated Critical by Chromium with CVSS 9.6 and a scope-changed vector, though exploitation currently shows as none in CISA SSVC and EPSS is low (0.31%). Vendor patch is available; no public exploit or KEV listing has been identified at time of analysis.

Sandbox escape in Google Chrome for Android before 151.0.7922.72 stems from an integer overflow in the WebGL component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox and gain broader access on the device. Google rates the Chromium severity as High and the CVSS is 9.6 due to the scope change and full CIA impact, though EPSS is low (0.21%, 11th percentile) and no public exploit is identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and is currently assessed by CISA SSVC as not actively exploited.

Discretionary access control bypass in Google Chrome desktop before 151.0.7922.72 lets an adversary in a privileged network position defeat a cryptographic protection and manipulate protected traffic. The flaw stems from a cryptographic weakness (CWE-325) rather than a memory-safety bug, and Google rates the Chromium severity High. No public exploit has been identified, EPSS is low (0.19%), and it is not on CISA KEV, but SSVC scores Technical Impact as total and Automatable as yes.

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium with a CVSS of 8.8, but there is no public exploit identified at time of analysis, EPSS is low (0.35%, 28th percentile), and CISA SSVC marks exploitation as none. Because code execution is confined to the sandbox, full host compromise would require chaining with a separate sandbox-escape.

Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 arises from a use-after-free in the DOM implementation, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. The flaw was reported internally by the Chrome team, rated High by Chromium, and carries CVSS 8.8; there is no public exploit identified at time of analysis and EPSS is low at 0.35% (28th percentile). Because execution is confined to the sandbox (Scope: Unchanged), full host compromise would additionally require a separate sandbox-escape chain.

Remote code execution in Google Chrome desktop versions prior to 151.0.7922.72 lets a remote attacker run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page that triggers an integer overflow in the bundled libxml component. Google rated the flaw High severity and a vendor patch is available; there is no public exploit identified at time of analysis, and the low EPSS score (0.35%) alongside CISA SSVC 'Exploitation: none' indicates no observed exploitation yet. Because the bug is contained to the sandboxed renderer, a successful attacker would still need a separate sandbox-escape to reach the host.

Sandboxed remote code execution in Google Chrome for macOS before 151.0.7922.72 stems from a race condition in the Skia graphics library that a crafted HTML page can trigger to run arbitrary code within the renderer sandbox. Google (Chrome team) reported the flaw and rated it High severity; a stable-channel patch is available. There is no public exploit identified and EPSS is low (0.28%, 21st percentile), and CISA SSVC currently marks exploitation status as none.

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw requires only that the user visit a malicious site; no authentication is needed but user interaction is. There is no public exploit identified at time of analysis, and the low EPSS score (0.28%, 20th percentile) suggests exploitation is not yet widespread.

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free memory corruption issue; Google has released a fixed stable-channel build, and there is no public exploit identified at time of analysis. Despite a CVSS of 8.8, Chromium rated the security severity Medium and EPSS is low (0.21%, 12th percentile), and the impact is constrained to code execution within the sandbox rather than full host compromise.

Privilege escalation in Google Chrome's USB subsystem prior to 151.0.7922.72 allows a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser through insufficient policy enforcement. Google rates the Chromium security severity as Medium, though the associated CVSS 3.1 score of 8.8 reflects high confidentiality, integrity, and availability impact contingent on user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Google confirms a fixed build is available.

Remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 151.0.7922.72) allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox via a crafted PDF file. The flaw is a CWE-416 use-after-free rated CVSS 8.8 (Chromium-assessed severity: Medium) and requires the victim to open or render a malicious PDF (UI:R). No public exploit has been identified at time of analysis and the EPSS score is low (0.21%, 11th percentile), and code execution is confined to the sandbox, meaning a separate sandbox-escape chain would be needed for full host compromise.

Sandboxed remote code execution in Google Chrome's WebXR implementation (all channels prior to 151.0.7922.72) lets a remote attacker run arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Google rates the Chromium security severity as Medium, though the CVSS 8.8 reflects high impact contingent on user interaction; no public exploit identified at time of analysis and EPSS is low (0.22%, 13th percentile). Note a source conflict: the description cites an integer overflow while the CWE and tags indicate use-after-free/memory corruption.

Heap corruption via use-after-free in Google Chrome's Enterprise component allows a remote attacker to potentially execute arbitrary code when a victim visits a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Google rates the Chromium severity as Medium, but the CVSS 8.8 reflects full compromise of the browser process on successful exploitation; there is no public exploit identified at time of analysis and EPSS probability is low (0.18%). A vendor patch is available in the 151.0.7922.72 stable channel.

Remote code execution in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Autofill component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code within the renderer sandbox. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis, and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched browser bug not yet weaponized.

Remote code execution in Google Chrome desktop before version 151.0.7922.72 stems from a use-after-free in the browser's Input component (Chromium severity High, CVSS 8.8), permitting a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) but no authentication or prior privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.26% (17th percentile), consistent with a freshly patched browser bug not yet weaponized publicly.

Heap corruption in Google Chrome's WebRTC component (versions prior to 151.0.7922.72) allows a remote attacker to exploit a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer process. The flaw is a CWE-416 object-lifecycle error rated CVSS 8.8 with user interaction required. There is no public exploit identified at time of analysis, and EPSS is low at 0.18% (8th percentile), indicating no observed weaponization despite the high CVSS.

Sandbox escape in Google Chrome for Android (versions prior to 151.0.7922.72) stems from an inappropriate implementation in ANGLE, Chrome's graphics abstraction layer, allowing a remote attacker to break out of the renderer sandbox using a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8, the flaw requires the victim to visit a malicious page (user interaction) but no authentication. There is no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a recently disclosed browser bug fixed before weaponization.

Out-of-bounds read in Chrome's ANGLE graphics abstraction layer (versions prior to 151.0.7922.72) can be leveraged by an attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; no public exploit identified at time of analysis, and the EPSS score is low (0.29%, 21st percentile), consistent with a second-stage bug rather than a standalone drive-by. Because it requires a pre-compromised renderer, it is typically one link in an exploit chain rather than a single-shot RCE.

Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 151.0.7922.72) allows a remote attacker to run arbitrary code within the browser's renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and CVSS 8.8, requiring user interaction (visiting a page) but no authentication. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), consistent with a freshly patched, vendor-reported bug rather than one under active exploitation.

Remote code execution in Google Chrome's Loader component before 151.0.7922.72 allows a remote attacker to execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page (CWE-416 use-after-free). The flaw carries a High Chromium severity and CVSS 8.8, but code execution is confined to the sandbox and requires user interaction (visiting the page); a full-system compromise would need an additional sandbox-escape bug. No public exploit identified at time of analysis, and EPSS is low at 0.35% (28th percentile).

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from a use-after-free in the Views UI framework, letting a local attacker who lures a user into opening a malicious file break out of the renderer sandbox with high-severity impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; SSVC records exploitation as none, and the EPSS score is very low (0.18%, 7th percentile). Google has released a fixed stable-channel build.

Local OS-level privilege escalation in Google Chrome on Linux before 151.0.7922.72 stems from an inappropriate implementation in the Chromoting (Chrome Remote Desktop) component, letting a local attacker leverage malicious network traffic to gain elevated OS privileges. Rated CVSS 8.4 (Chromium severity Medium), the flaw carries total technical impact but no public exploit identified at time of analysis and a low EPSS of 0.11% (2nd percentile), indicating minimal current exploitation pressure. A vendor patch is available and no active exploitation has been reported.

Privilege escalation in Google Chrome's Updater component on macOS (versions before 151.0.7922.72) stems from a use-after-free (CWE-416) that a local attacker can trigger via malicious network traffic, letting them execute code in the context of the privileged updater process. Google rated the Chromium severity as High and has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.18%, 7th percentile). CISA's SSVC framework records no observed exploitation and marks the flaw as not automatable but with total technical impact.

Sandbox escape in Google Chrome's Compositing component (versions prior to 151.0.7922.72) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox and gain broader code execution via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3 (scope-changing use-after-free, CWE-416), it is a second-stage bug that presumes an existing renderer compromise rather than a standalone entry point. There is no public exploit identified at time of analysis and EPSS is low (0.31%, 23rd percentile), consistent with CISA SSVC marking exploitation as none.

Sandbox escape in Google Chrome for Android before 151.0.7922.72 lets an attacker who has already compromised the renderer process break out of the browser sandbox through crafted input to the GPU component. This is a second-stage vulnerability (CWE-20, improper input validation) that Google rates High severity and CVSS 8.3 with a scope change; it is chained after an initial renderer bug rather than exploited alone. No public exploit has been identified at time of analysis, EPSS is low (0.29%, 21st percentile), and CISA SSVC records exploitation as none, though technical impact is rated total.

Sandbox escape in Google Chrome's Media component on Windows (versions before 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page, exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it enables a scope-changing escalation from constrained renderer code to broader host access. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.21% (11th percentile).

Sandbox escape in Google Chrome's Navigation component (versions prior to 151.0.7922.72) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating a renderer-level foothold toward host-level code execution. Chromium rates the security severity High and the CVSS is 8.3; no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile). This is the second-stage bug in a typical Chrome exploit chain rather than a standalone remote-code-execution primitive.

Sandbox escape in Google Chrome's Android WebView allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page in versions prior to 151.0.7922.72. Rooted in a use-after-free (object lifecycle) flaw rated High by Chromium, this is a second-stage privilege-boundary bypass rather than a standalone entry point. No public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a bug reported internally by the Chrome team and patched before evidence of exploitation.

Sandbox escape in Google Chrome's Skia graphics library (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Google rates the Chromium severity as Critical, and CVSS is 8.3 due to the scope change (S:C) reflecting the sandbox boundary crossing. No public exploit identified at time of analysis, and EPSS probability is low (0.31%), consistent with an exploit that requires chaining from a prior renderer compromise.

Sandbox escape in Google Chrome's Network component before 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader access on the host via a crafted HTML page. Rated High by Chromium and scored CVSS 8.3, it is a second-stage bug that must be chained with an initial renderer exploit rather than exploited in isolation. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.29% (21st percentile).

Out-of-bounds memory read in Chrome's WebXR component allows remote attackers to disclose sensitive renderer process memory or crash the browser tab by luring a victim to a crafted HTML page. All Google Chrome releases prior to 151.0.7922.72 are affected across all platforms, with the vendor confirming a patch in the stable channel update. No public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile) indicates low near-term exploitation probability despite the high CVSS base score of 8.1.

Site isolation bypass in Google Chrome prior to 151.0.7922.72 lets a remote attacker who has already compromised the renderer process read or tamper with data belonging to other origins by serving a crafted HTML page, defeating one of Chrome's core sandbox boundaries. Chromium rates the severity High and a fixed Stable-channel build has shipped; there is no public exploit identified at time of analysis and EPSS is low at 0.30% (23rd percentile). The flaw is an input-validation weakness (CWE-20) in the Passwords component that undermines the per-site process separation guarantee.

Local privilege escalation in Google Chrome's Updater component allows a local attacker who can plant a malicious file to gain OS-level privileges once the update process acts on it. The flaw stems from insufficient validation of untrusted input (CWE-20) and affects all Chrome desktop builds prior to 151.0.7922.72; Google rates the Chromium security severity as Medium while the CVSS base score is 7.8 (High). There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Local OS-level privilege escalation in Google Chrome's Updater on macOS (versions prior to 151.0.7922.72) allows a local attacker who can plant a malicious file to exploit a race condition and elevate privileges on the host. Google rated the underlying Chromium bug Critical, though the CVSS base score is 7.8 (High) reflecting the local attack vector and required user interaction. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the Critical Chromium rating signals a high-quality, security-relevant defect.

Local privilege escalation in Google Chrome for Windows before 151.0.7922.72 stems from a use-after-free in the Tracing component (CWE-416), letting a local attacker who lures a user into opening a malicious file execute code that escalates to OS-level privileges. Chromium rates the security severity as Medium, but the assigned CVSS 3.1 score is 7.8 (High) reflecting full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though a vendor patch is available.

Local privilege escalation in Google Chrome on Windows prior to 151.0.7922.72 lets a local attacker gain elevated privileges through a malicious file that the victim opens or that Chrome processes, stemming from an inappropriate implementation in the Browser process. Google rates the Chromium security severity as Medium, while the NVD-style CVSS of 7.8 reflects high confidentiality, integrity, and availability impact once triggered. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor has shipped a fix.

Local OS-level privilege escalation in Google Chrome's Updater component on macOS versions prior to 151.0.7922.72 allows a local attacker to elevate privileges by planting a malicious file that the Updater processes with higher rights. The flaw stems from improper privilege management (CWE-269) in the auto-update workflow, requires local access plus user interaction, and carries a CVSS 7.8 (High) rating; no public exploit has been identified at time of analysis. Rated Medium severity by Chromium's own security team despite the High CVSS.

Cross-origin data disclosure in Google Chrome for Android before 151.0.7922.72 lets a remote attacker leak data from other origins by luring a victim to a crafted HTML page that abuses insufficient input validation in the browser UI. Rated High by Chromium and CVSS 7.5 (confidentiality-only). There is no public exploit identified at time of analysis, and EPSS is low at 0.18%, though SSVC flags the attack as automatable with partial technical impact.

Privilege escalation in Google Chrome on Android before 151.0.7922.72 lets a remote attacker who has already compromised the renderer process escape further via insufficient policy enforcement in the Speech component and a crafted HTML page. Rated Medium by Chromium but scored CVSS 7.5, it enables a second-stage sandbox/privilege boundary bypass rather than initial access. No public exploit identified at time of analysis, and it is not listed in CISA KEV.

Heap corruption in the TabStrip component of Google Chrome desktop before 151.0.7922.72 allows a remote attacker to trigger a use-after-free (CWE-416) when a user is lured to a crafted HTML page and performs specific UI gestures. Successful exploitation could lead to arbitrary code execution within the renderer process, though Chromium rates the severity as Medium and there is no public exploit identified at time of analysis. EPSS is low at 0.22% (12th percentile) and CISA SSVC records exploitation status as none.

Sandbox escape in Google Chrome's ANGLE graphics layer on Windows (versions prior to 151.0.7922.72) lets a remote attacker who lures a victim to a crafted HTML page trigger a use-after-free that can potentially break out of the renderer/GPU sandbox. Google rated the Chromium security severity Medium and has shipped a fix; there is no public exploit identified at time of analysis and the EPSS score is low (0.17%, 7th percentile), indicating limited near-term exploitation likelihood despite the serious impact class.

Sandbox escape in Google Chrome desktop before 151.0.7922.72 stems from insufficient validation of untrusted input in a WebUI component, letting a remote attacker on the same network segment potentially break out of the renderer sandbox via malicious network traffic. Google rates the Chromium severity as Medium and vendor-tagged intelligence flags it as 'Potential RCE'; a vendor patch is available, but no public exploit identified at time of analysis and EPSS is low (0.17%, 6th percentile). CISA SSVC records no observed exploitation and only partial technical impact.

Sandbox escape in Google Chrome's Dawn (WebGPU) component affects all desktop Chrome builds prior to 151.0.7922.72, where insufficient validation of untrusted input lets a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Chromium rates the severity Medium and the issue carries a CVSS 7.1 with scope change, but there is no public exploit identified at time of analysis and EPSS is very low at 0.18% (8th percentile). Google has shipped a patched Stable channel release addressing it.

Navigation restriction bypass in Google Chrome for iOS (versions prior to 151.0.7922.72) enables unauthenticated remote attackers to circumvent browser navigation controls by inducing a user to load a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-accessible, low-complexity exploitation with no privilege requirements but mandatory user interaction, yielding high integrity impact with no confidentiality or availability consequences. No public exploit identified at time of analysis, and EPSS at 0.22% (13th percentile) indicates limited near-term exploitation likelihood despite the medium severity rating.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to misrepresent browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site or legitimate browser chrome. The vulnerability maps to CWE-451 (UI Misrepresentation of Critical Information) and carries a High integrity impact despite no direct confidentiality or availability loss, because successful spoofing can facilitate credential theft or social engineering at scale. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) reflects low current opportunistic exploitation probability.

UI spoofing in Google Chrome's Passwords component prior to version 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to manipulate the browser's password-related interface via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Passwords subsystem, allowing integrity-impacting spoofing of security-sensitive UI elements such as password prompts or save/fill dialogs. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with the elevated prerequisite of a prior renderer compromise.

Cross-origin data leakage in Google Chrome's PDF component on Android (prior to 151.0.7922.72) exposes sensitive data from one web origin to an attacker-controlled page due to insufficient input validation in PDF processing. A local attacker who can direct a victim to a crafted HTML page triggers the flaw, allowing confidentiality impact with no integrity or availability consequence. No public exploit code exists and EPSS sits at 0.18% (8th percentile), indicating low real-world exploitation probability at time of analysis despite a High Chromium severity rating.

Cross-origin data leakage in Google Chrome's ANGLE graphics engine (versions prior to 151.0.7922.72) allows a remote attacker to read memory from other origins by enticing a victim to visit a specially crafted HTML page. The root cause is use of an uninitialized variable in ANGLE, Chrome's OpenGL ES translation layer, which can expose residual memory contents tied to cross-origin rendering contexts. No public exploit code has been identified and CISA SSVC rates exploitation as 'none' at time of analysis, but the CVSS confidentiality impact is rated High due to the cross-origin data boundary violation.

Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.

UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.

Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The root cause is an inappropriate implementation (CWE-284) in Chrome's iOS-specific navigation stack, meaning the flaw is isolated to the iOS platform and does not affect Chrome on Android or desktop. No public exploit code exists and EPSS probability stands at just 0.22% (13th percentile), indicating low real-world exploitation pressure at time of analysis; this vulnerability is not listed in the CISA KEV catalog.

Domain spoofing via incorrect security UI in Google Chrome's built-in Passwords feature affects all Chrome versions prior to 151.0.7922.72. Remote unauthenticated attackers can serve a crafted HTML page that causes Chrome to misrepresent the origin domain within the password management UI, enabling deception of users into associating saved credentials with an attacker-controlled domain. No public exploit code has been identified at time of analysis, and EPSS at 0.18% (8th percentile) signals very low automated exploitation probability, though Chrome's ubiquitous deployment makes even low-probability credential phishing scenarios broadly impactful.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.

Same-origin policy bypass in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to violate cross-origin isolation by luring a user into performing specific UI gestures on a crafted HTML page. The flaw stems from CWE-346 (Origin Validation Error) in an iOS-specific Chrome implementation, granting unauthorized write-level access to cross-origin content. No public exploit code has been identified and no active exploitation is confirmed; with an EPSS of 0.19% (9th percentile), real-world exploitation probability remains low but the integrity impact is high if successfully triggered.

Policy bypass in the Extensions subsystem of Google Chrome (all versions prior to 151.0.7922.72) allows site isolation circumvention when a user is convinced to install a crafted malicious extension. The CVSS vector (I:H, S:U) and CWE-693 indicate this is a protection mechanism failure that undermines Chrome's cross-origin boundary enforcement, potentially enabling manipulation of content across isolated sites. No public exploit has been identified at time of analysis; EPSS at 0.12% (3rd percentile) reflects low current exploitation probability, and CISA KEV listing is absent.

Cross-origin data leak in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables an attacker who has already compromised the renderer process to exfiltrate sensitive data from other origins via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) in how Loader processes requests originating from a compromised renderer, bypassing same-origin protections. No public exploit code has been identified and EPSS sits at 0.29% (21st percentile), consistent with this vulnerability's role as a second-stage capability in a chained browser exploit rather than a standalone attack.

Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to exfiltrate sensitive data across site isolation boundaries by directing a victim to a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) in ANGLE, Chrome's OpenGL ES translation layer, which may expose residual memory contents from other browser origins to attacker-controlled JavaScript. No public exploit code and no active exploitation have been identified; EPSS places exploitation probability at 0.31% (24th percentile) and SSVC confirms no current exploitation activity, making this a patch-cycle priority rather than an emergency response.

Cross-origin data leakage in Google Chrome's Print Preview component (prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin content via a crafted HTML page. The attack is two-stage - requiring a prior renderer process compromise - substantially constraining real-world exploitability beyond what the base CVSS score suggests. No public exploit code exists and the vulnerability is absent from CISA KEV, with EPSS at a low 0.29% (21st percentile), consistent with SSVC's 'none' exploitation and 'partial' technical impact ratings.

Process memory disclosure in Google Chrome's ANGLE graphics subsystem exposes potentially sensitive in-process data to remote attackers via a crafted HTML page. All Chrome releases prior to 151.0.7922.72 are affected across desktop platforms. No public exploit code and no active exploitation have been identified at time of analysis; an EPSS score of 0.29% (21st percentile) reflects low current exploitation probability despite a high confidentiality impact rating.

Uninitialized memory use in Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) allows a remote attacker to read potentially sensitive data from the browser's process memory by delivering a crafted HTML page. The CVSS C:H rating reflects the theoretical confidentiality impact, but SSVC rates technical impact as only partial and exploitation as none, and EPSS sits at 0.31% (24th percentile), indicating low observed real-world exploitation probability. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.

Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 enables remote attackers to circumvent browser-enforced navigation policies by delivering a crafted HTML page to a victim. The flaw originates from insufficient client-side policy enforcement (CWE-602), where the iOS-specific Chrome policy engine fails to prevent unauthorized navigation actions triggered by attacker-controlled content. No public exploit has been identified at time of analysis, and an EPSS score of 0.18% (8th percentile) indicates minimal current exploitation activity; vendor-released patch 151.0.7922.72 is available.

UI spoofing in Google Chrome's WebAppInstalls component (all versions prior to 151.0.7922.72) allows a remote attacker to misrepresent critical interface elements through a crafted HTML page, deceiving users into interacting with fraudulent Chrome UI. The flaw stems from inappropriate implementation in the Progressive Web App installation flow, rated CVSS 6.5 with high integrity impact reflecting the attacker's ability to manipulate perceived interface state. No public exploit identified at time of analysis, and an EPSS of 0.17% (7th percentile) confirms negligible observed exploitation activity.

Navigation restriction bypass in Google Chrome's Extensions subsystem affects all desktop versions prior to 151.0.7922.72, enabling an attacker who convinces a user to install a crafted malicious extension to circumvent Chrome's navigation enforcement policies. The CWE-602 root cause indicates client-side policy logic can be subverted by a malicious extension actor, resulting in a high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis, and the EPSS score of 0.12% (2nd percentile) indicates very low exploitation probability, despite the CVSS 6.5 medium-severity rating.

Same-origin policy bypass in Google Chrome's WebXR subsystem prior to 151.0.7922.72 allows a remote attacker to violate cross-origin integrity boundaries by luring a victim to a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346: Origin Validation Error) in the WebXR API, enabling cross-origin write or manipulation operations that Chrome's SOP should prevent. No active exploitation is confirmed and EPSS is low at 0.18% (8th percentile), but a vendor patch is available and deployment is recommended given Chrome's ubiquitous footprint.

Insufficient policy enforcement in the Passwords component of Google Chrome on Android prior to version 151.0.7922.72 allows a remote attacker to bypass discretionary access control by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H), indicating an attacker can manipulate or circumvent password-related access controls without needing any prior privileges. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), suggesting exploitation remains theoretical at time of analysis, though the low attack complexity and no-privilege requirement make it attractive if a reliable technique is developed.

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to the victim (CWE-451). The CVSS vector assigns high integrity impact (I:H) with no privileges required from the attacker, but mandates user interaction (UI:R), meaning the victim must visit the malicious page. No public exploit identified at time of analysis, and an EPSS score of 0.17% at the 7th percentile indicates very low observed exploitation interest; Chromium's own severity rating of Medium aligns with this assessment.

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. No public exploit code or active exploitation has been identified; EPSS sits at 0.17% (7th percentile), indicating low current exploitation interest despite the vendor-confirmed patch.

Domain spoofing in Google Chrome on iOS prior to 151.0.7922.72 allows a remote unauthenticated attacker to misrepresent the displayed origin in the browser's security UI by delivering a crafted HTML page to a victim. The flaw (CWE-451) enables phishing-class attacks where the address bar or site identity indicator shows a trusted domain while content is served from a different origin. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low automated exploitation likelihood, but the integrity impact is high for targeted phishing campaigns against iOS Chrome users.

Same-origin policy bypass in Google Chrome for Windows (prior to 151.0.7922.72) allows a remote attacker who has already compromised the Chrome renderer process to circumvent cross-origin isolation controls via a crafted HTML page exploiting an origin validation flaw (CWE-346) in the Media component. This is a second-stage, chained exploitation capability - not a standalone entry point - requiring a prior renderer compromise to weaponize, which substantially constrains its independent risk. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile); the vendor patch is available in Chrome 151.0.7922.72.

Same-origin policy bypass in Google Chrome's Permissions subsystem (prior to 151.0.7922.72) allows an unauthenticated remote attacker to violate cross-origin integrity constraints by inducing a user to visit a crafted HTML page. The root cause is an origin validation error (CWE-346) in Chrome's permissions implementation, where the browser incorrectly evaluates the requesting origin, enabling cross-origin integrity manipulation. No public exploit has been identified at time of analysis, and EPSS at 0.23% (14th percentile) signals low observed exploitation activity.

Same-origin policy bypass in Google Chrome's Media Router component allows a remote attacker to violate cross-origin integrity guarantees by luring a user to a crafted HTML page. Affected are all Chrome versions prior to 151.0.7922.72 across desktop platforms. No public exploit or active exploitation has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low observed exploitation activity; however, the high integrity impact (I:H) and no-privilege-required attack path make patching a meaningful priority for browser-fleet administrators.

Same-origin policy bypass in Google Chrome's WebMCP component (prior to 151.0.7922.72) enables a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page, requiring only that a victim visit the malicious page. The root cause is insufficient policy enforcement in the WebMCP subsystem, classified by Chromium's security team as Medium severity (CWE-346: Origin Validation Error). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.19% (9th percentile) corroborates low current threat activity.

Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.

Same-Origin Policy bypass in Google Chrome's Headless component prior to version 151.0.7922.72 allows remote attackers to perform unauthorized cross-origin integrity violations via a specially crafted HTML page. The flaw (CWE-346, Origin Validation Error) is specific to Chrome's Headless rendering mode and requires the victim to interact with attacker-controlled HTML (UI:R per CVSS). No public exploit code or CISA KEV listing has been identified; EPSS at 0.19% (9th percentile) reflects low near-term exploitation probability, though the zero-authentication requirement and low attack complexity elevate the concern for environments where Headless Chrome processes untrusted input.

Content Security Policy bypass in Google Chrome prior to 151.0.7922.72 enables remote attackers to circumvent site-level script execution restrictions via a specially crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's HTML handling (CWE-693, Protection Mechanism Failure), allowing injected or unauthorized scripts to execute despite CSP directives that should block them. No public exploit code has been identified and EPSS sits at 0.30% (23rd percentile), indicating low observed exploitation probability despite Chrome's ubiquitous deployment footprint.

ServiceWorker policy enforcement in Google Chrome prior to 151.0.7922.72 is insufficiently enforced, enabling a remote attacker to bypass the browser's same-origin policy (SOP) by delivering a crafted HTML page to a victim. Classified under CWE-284 (Improper Access Control), the flaw carries high integrity impact - cross-origin resource manipulation without data exfiltration - and is exploitable with no attacker privileges, though user interaction is mandatory. EPSS stands at 0.19% (9th percentile) with no CISA KEV listing, placing active exploitation as unconfirmed; however, the low attack complexity and ubiquitous deployment of Chrome make it a realistic target in browser-based phishing campaigns.

Navigation restriction bypass in Google Chrome on iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to circumvent the browser's built-in navigation policy controls by delivering a specially crafted HTML page. Rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), the flaw reflects an iOS-specific policy enforcement gap not present in desktop Chrome builds. The Chromium team rated this High severity internally; however, no confirmed active exploitation exists - CISA KEV is absent, EPSS stands at 0.30%, and SSVC classifies exploitation as none with partial technical impact.

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 151.0.7922.72 permits remote attackers to inject arbitrary scripts or HTML that execute across same-origin boundaries within the victim's browser session. The CVSS Scope:Changed metric confirms the cross-origin breakout characteristic of UXSS - distinguishing this from ordinary reflected XSS by targeting browser internals rather than a web application. No public exploit has been identified at time of analysis, and an EPSS score of 0.17% (7th percentile) indicates low current exploitation probability; vendor patch is confirmed available at 151.0.7922.72.

Script and HTML injection into privileged DevTools pages in Google Chrome prior to 151.0.7922.72 is enabled when an attacker has already compromised the renderer process, exploiting an inappropriate implementation in DevTools (CWE-79). The vulnerability requires chaining with a prior renderer exploit: alone it cannot be triggered by a remote unauthenticated attacker without that precondition, making it a sandbox-escape amplifier rather than a standalone remote attack. EPSS is 0.18% (8th percentile), no public exploit has been identified, and it does not appear in CISA KEV, reflecting low observed exploitation pressure despite the Medium CVSS rating.

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation allows remote attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. All Chrome versions prior to 151.0.7922.72 on all platforms are affected. An unauthenticated remote attacker can bypass the browser's same-origin policy, enabling script execution in the context of third-party origins visited by the victim. No public exploit identified at time of analysis and EPSS sits at 0.18% (8th percentile), suggesting limited active exploitation pressure despite the broad attack surface of a ubiquitous browser.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Network component allows remote attackers to inject arbitrary scripts or HTML across same-origin policy boundaries via a crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. Unlike application-level XSS, UXSS exploits a flaw in the browser engine itself, enabling cross-origin script execution that bypasses website-level security controls. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), but the confirmed scope change (S:C in CVSS) signals genuine cross-origin impact potential.

Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page that exploits an inappropriate CSS implementation. Because this is a UXSS class vulnerability - not ordinary reflected or stored XSS - exploitation bypasses the browser's same-origin policy entirely, potentially exposing authenticated sessions, cookies, and DOM content from any tab open in the browser. No public exploit has been identified at time of analysis, and EPSS at 0.18% (8th percentile) indicates low current exploitation probability, though UXSS flaws in dominant browsers remain high-value targets.

Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.

Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Extensions subsystem, affecting all versions prior to 151.0.7922.72, allows a remote unauthenticated attacker to inject arbitrary scripts or HTML into the browser context by luring a user to a crafted HTML page. The inappropriate implementation in the Extensions component bypasses Chrome's normal script isolation boundaries, potentially enabling cross-origin script execution characteristic of UXSS class flaws. Vendor-confirmed fix is available in Chrome 151.0.7922.72; EPSS of 0.20% (11th percentile) and absence of KEV listing indicate limited active exploitation at time of analysis.

UI spoofing via the DigitalCredentials API in Google Chrome prior to 151.0.7922.72 allows a remote, unauthenticated attacker to deceive users about the legitimacy or origin of credential-related dialogs through a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's handling of the DigitalCredentials web API (CWE-451), enabling misrepresentation of critical UI information. No active exploitation is confirmed (no CISA KEV listing), and with an EPSS score of 0.17% at the 7th percentile, real-world exploitation probability is currently very low.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to manipulate the displayed URL via malicious network traffic, deceiving users about the true origin of page content. The flaw is iOS-platform-specific and classified under CWE-451 (UI Misrepresentation of Critical Information), making it a phishing-enablement vulnerability rather than a code execution or data-exfiltration primitive. No public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.20% (10th percentile).

Cross-origin data leakage in Google Chrome's Actor component (all versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data via a crafted HTML page. This is a secondary-stage information disclosure primitive - it requires both user interaction and a pre-compromised renderer, making it a chained exploit component rather than a standalone entry point. No public exploit or active exploitation has been identified; EPSS sits at 0.29% (21st percentile), consistent with low real-world exploitation likelihood at this time.

Cross-origin data leakage in Google Chrome's Prefetch subsystem prior to version 151.0.7922.72 allows a remote, unauthenticated attacker to read data belonging to other origins by inducing a victim to visit a crafted HTML page. The flaw arises from insufficient policy enforcement (CWE-346) within the prefetch mechanism, which fails to properly honour cross-origin isolation boundaries and permits attacker-controlled pages to infer or extract content from resources on distinct origins. No active exploitation is confirmed - EPSS sits at 0.29% (21st percentile) and the vulnerability is absent from the CISA KEV catalogue - and real-world impact is bounded by the required user interaction and a limited confidentiality-only scope.

Cross-origin data leakage in Google Chrome's Paint subsystem (all versions prior to 151.0.7922.72) allows a remote attacker to read data belonging to other web origins by delivering a crafted HTML page to a victim. The root cause is an origin validation error (CWE-346) in the Paint rendering component, permitting cross-origin information to surface where it should be isolated. No public exploit code exists and EPSS registers 0.18% (8th percentile), confirming low exploitation probability - this is a medium-severity patch-cycle priority, not an emergency.

Uninitialized memory use in ANGLE, Chrome's graphics translation layer, exposes cross-origin data to remote attackers who can direct users to a crafted HTML page. Affected are all Google Chrome desktop releases prior to 151.0.7922.72 across supported platforms. No public exploit code or active exploitation has been identified; EPSS probability is low at 0.31% (24th percentile), and the impact is bounded to partial confidentiality loss with no integrity or availability consequences.

Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables remote attackers to exfiltrate cross-origin data by luring a victim to a crafted HTML page that exploits observable timing or state signals in media processing. This bypasses the browser's Same-Origin Policy protections, allowing an attacker's origin to infer sensitive data loaded from a different origin. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation probability; a vendor-released patch is available.

Cross-origin data leakage in Google Chrome's Dawn WebGPU component (versions prior to 151.0.7922.72) enables remote attackers to read cross-origin data via a crafted HTML page that triggers uninitialized memory use (CWE-457). Exploitation requires the victim to visit an attacker-controlled page but demands no authentication and operates against default Chrome configurations. No public exploit has been identified at time of analysis and the EPSS score of 0.23% (14th percentile) reflects a currently low exploitation likelihood, consistent with Chromium's own Medium severity rating.

Cross-origin data leak in Google Chrome's GuestView component (all desktop versions prior to 151.0.7922.72) enables remote attackers to read cross-origin content by luring a victim to a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-346, Origin Validation Error) within the GuestView subsystem, which handles embedded guest content such as <webview> elements in Chrome Apps and extensions. No public exploit code has been identified and CISA has not added this to the KEV catalog; an EPSS of 0.21% at the 11th percentile confirms low exploitation probability at time of analysis.

Cross-origin data leakage in Google Chrome's ReportingAndNEL subsystem (versions prior to 151.0.7922.72) allows a remote attacker to exfiltrate limited cross-origin information by delivering a crafted HTML page to a victim user. The flaw stems from an origin validation error (CWE-346) in the Network Error Logging and Reporting API implementation. No public exploit code has been identified and SSVC confirms exploitation status as none, but the combination of a network attack vector, no privilege requirement, and ubiquitous browser deployment makes patch application a straightforward priority.

Cross-origin data leakage in Google Chrome's Passwords component (prior to 151.0.7922.72) allows a remote attacker to read credential or password-related data across origin boundaries by enticing a user to visit a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the Passwords feature, where Chrome fails to properly enforce same-origin constraints. No public exploit code has been identified and SSVC signals no known active exploitation, placing this in the medium-priority tier despite Chrome's ubiquitous deployment footprint.

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a user to a crafted HTML page exploiting an origin validation flaw in the CSS engine. The vulnerability is classified under CWE-346 (Origin Validation Error) and is confirmed patched in the 151.0.7922.72 stable channel release. No public exploit code has been identified, SSVC rates exploitation as none, and EPSS sits at 0.18% - all consistent with low near-term exploitation likelihood.

Cross-origin data leakage in Google Chrome's Cast subsystem (versions prior to 151.0.7922.72) allows unauthenticated attackers on the same local network segment to extract sensitive cross-origin browser data via crafted network traffic. The insufficient input validation in the Cast component bypasses browser isolation boundaries, exposing data from origins the victim is actively browsing. No public exploit code or active exploitation (CISA KEV) has been identified, and an EPSS of 0.12% (2nd percentile) reflects very low near-term exploitation probability.

Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.

Cross-origin data leakage in Google Chrome's Cast component allows an unauthenticated attacker positioned on the same local network segment to read data from origins they should not have access to via maliciously crafted network traffic. All Chrome versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA has not listed this in the KEV catalog, placing real-world risk at low-to-moderate despite the unauthenticated attack vector.

Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) can be triggered remotely by luring a victim to a crafted HTML page, exposing data that should be isolated under the Same-Origin Policy. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's Autofill implementation fails to properly enforce cross-origin boundaries when processing form data. No public exploit exists and the EPSS score of 0.22% (12th percentile) reflects low near-term exploitation likelihood; the issue is patched in the stable channel release 151.0.7922.72.

Cross-origin data leakage in Google Chrome's WebXR implementation (versions prior to 151.0.7922.72) arises from an uninitialized memory use flaw exploitable by a remote attacker via a crafted HTML page that must be visited by the victim. The flaw allows partial disclosure of cross-origin data, with no integrity or availability impact. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.20% at the 10th percentile confirms this is a low-probability exploitation target in the near term.

Cross-origin data leakage in Google Chrome's Autofill subsystem (versions prior to 151.0.7922.72) enables remote attackers to extract sensitive cross-origin information by directing a user to a specially crafted HTML page. The root cause is an inappropriate implementation within Autofill that fails to enforce proper origin boundaries (CWE-346), allowing page-level interactions to surface data from contexts the page should not be able to read. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.22% (12th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.

Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.

Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.

Cross-origin data leakage in Google Chrome's FileSystem component prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346 Origin Validation Error) in Chrome's FileSystem API, which fails to enforce same-origin policy checks correctly, exposing data that should be sandboxed to its originating origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation likelihood; however, the vendor patch is available and should be applied promptly given Chrome's ubiquitous deployment footprint.

Cross-origin data leakage in Google Chrome's Payments component (all versions prior to 151.0.7922.72) enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is an inappropriate implementation in the Payments subsystem (CWE-346: Origin Validation Error), violating the browser's same-origin policy for payment-related data flows. EPSS is 0.18% (8th percentile) and no CISA KEV listing or public exploit has been identified, indicating low exploitation probability despite ubiquitous product deployment.

Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), enabling a remote attacker to exfiltrate limited cross-origin credential-related data via a crafted HTML page. Exploitation requires the target user to perform specific, undisclosed UI gestures - such as interacting with a password field or autofill prompt - on the attacker's page, limiting mass-scale automation. No public exploit code or CISA KEV listing exists; EPSS at 0.18% (8th percentile) confirms low real-world exploitation probability, consistent with the mandatory social-engineering prerequisite.

Cross-origin data leakage in Google Chrome prior to version 151.0.7922.72 allows remote attackers to read data across origin boundaries by inducing a user to visit a specially crafted HTML page. The flaw resides in Chrome's network layer and is classified as CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce origin boundaries during certain network operations. No active exploitation has been confirmed (not in CISA KEV), and EPSS places exploitation probability at 0.18% (8th percentile), indicating low current threat activity despite widespread browser deployment.

Cross-origin data leakage in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The flaw is rooted in insufficient policy enforcement (CWE-346: Origin Validation Error) within Chrome's Autofill feature, which fails to correctly gate form data access by origin. No public exploit code has been identified and CISA SSVC rates active exploitation as none, placing real-world risk well below what the network-based attack vector alone might suggest.

Side-channel information leakage in Chrome's Autofill component exposes cross-origin data to remote attackers who have already achieved renderer process compromise. All Chrome versions prior to 151.0.7922.72 are affected across all platforms. With an EPSS of 0.22% (12th percentile), no CISA KEV listing, and a mandatory renderer-compromise prerequisite, real-world exploitation risk is substantially lower than the CVSS base score implies - this is a chained second-stage disclosure, not a standalone attack. No public exploit identified at time of analysis.

Cross-origin data leakage in Google Chrome's built-in Passwords component (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to read cross-origin data by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error) within the password management subsystem, meaning the browser fails to correctly validate origin boundaries when the Passwords component processes or exposes credential-related data. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code exists, and this CVE is not listed in the CISA KEV catalog, indicating low observed real-world exploitation pressure despite the ubiquity of the affected product.

Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by exploiting a race condition triggered through a crafted HTML page. The vulnerability requires user interaction and benefits from high attack complexity due to race-condition timing, placing real-world exploitation difficulty well above typical web vulnerabilities. No public exploit code exists and no active exploitation has been identified; SSVC assessment confirms exploitation status as none at time of analysis.

Site isolation bypass in Google Chrome allows a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page, potentially accessing data from other open origins within the browser. All Chrome desktop versions prior to 151.0.7922.72 are affected. The CVSS 4.2 (Medium) with AC:H reflects that this is a second-stage exploitation primitive requiring prior renderer compromise, not a standalone initial access vector; no public exploit or CISA KEV listing has been identified at time of analysis.

Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.

Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.

Cross-origin data leakage in Google Chrome's Passwords feature prior to version 151.0.7922.72 allows a remote attacker to read cross-origin data by convincing a victim to perform specific UI gestures on a crafted HTML page. Rated High severity by the Chromium security team - higher than the NVD CVSS base score of 3.1 suggests - reflecting the sensitivity of credential-adjacent cross-origin boundary violations. No public exploit identified at time of analysis, and SSVC assessment confirms no current exploitation activity.

Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.

Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.