Authentication Bypass
Monthly
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes names and IDs of non-public taxonomy terms to any remote caller. The plugin performs no capability or nonce verification before fulfilling taxonomy data requests, meaning access controls enforced by WordPress core are entirely bypassed at the plugin layer. A publicly available proof-of-concept exists per WPScan, and exploitation is assessed as automatable with partial technical impact by the SSVC framework.
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visitor to overwrite like-count and visitor-tracking post meta on arbitrary posts, including private and draft posts, because the plugin's AJAX handler validates only a nonce - a value scrapeable from any public page - without performing any WordPress capability or post-ownership check. A publicly available proof-of-concept exists per WPScan. While exploitation is automatable and requires no credentials, the integrity impact is narrow, limited to engagement metadata rather than post content or authentication data.
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending posts - including the plaintext passwords and full content of password-protected posts - to any unauthenticated HTTP client via an unprotected REST API namespace. The flaw arises from missing authorization checks on post status and ownership within that namespace, meaning no credentials or privileges are required to enumerate and read content the site owner intended to restrict. A publicly available proof-of-concept exploit exists, and the attack is fully automatable per the SSVC framework, though CISA has not listed this in KEV and the EPSS score is low (0.18%), suggesting exploitation has not yet been widespread.
Authorization bypass and privilege escalation in Apache APISIX 3.11.0-3.17.0 stem from the `attach-consumer-label` plugin failing to strip client-supplied consumer-label headers before using them in security decisions. An attacker who can reach the gateway can forge header values to impersonate a higher-privileged consumer label, bypassing route-level access controls. No vendor-released patch is available at time of analysis (fix version marked pending); no public exploit code or CISA KEV listing has been identified.
Cross-organizational information disclosure in Katello - the content management engine of Red Hat Satellite 6 - allows any authenticated user to read lifecycle history of Content Views belonging to organizations other than their own. By supplying an arbitrary Content View identifier to the Content View History API endpoint, a low-privileged user bypasses organization-scope authorization and retrieves publication events, promotion history, associated usernames, and timestamps for foreign tenants. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; the CVSS 4.3 Medium rating reflects the strictly read-only, single-organization-boundary impact.
Unauthenticated integrity compromise in Cohere North AI v1.1.5 exposes an internal user-management API endpoint with no effective access control, allowing any remote attacker to overwrite arbitrary user account data via crafted HTTP requests to /api/internal/v1/users/{USER_ID}. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag both confirm exploitation requires no credentials and no user interaction. A researcher-published PoC exists on GitHub, though EPSS remains low (0.14%, 4th percentile) and no CISA KEV listing has been issued.
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x through 11.3.14, 11.4.x through 11.4.4, and all 11.0.x-11.2.x) allows unauthenticated remote attackers to bypass authorization and directly access protected resources due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network-reachable exploitation but with high complexity and required user interaction, limiting opportunistic mass attacks. No active exploitation is confirmed - EPSS stands at 0.13% (3rd percentile) and CISA SSVC rates exploitation as none and not automatable - but a vendor patch is available via SA-CORE-2026-010.
Missing authentication on a critical function in the Drupal PanKM contributed module allows a network-accessible, high-privilege attacker-given required user interaction-to bypass module authorization controls and achieve high confidentiality and integrity impact against all currently released versions. All known PanKM releases are affected (CPE wildcard cpe:2.3:a:drupal:pankm:*:*:*:*:*:*:*:*), with the Drupal security team (sa-contrib-2026-083) confirming the issue. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none.
Cross-workspace domain deletion in TypeBot prior to 3.18.0 allows any authenticated non-guest workspace member to remove custom domains belonging to other workspaces, rendering their chatbots unavailable. The `handleDeleteCustomDomain` API handler validates the caller's membership in a client-supplied workspaceId but forwards the client-supplied domain name to the shared Vercel project API without confirming that domain is owned by the authorized workspace - a classic IDOR flaw (CWE-639). No public exploit code and no CISA KEV listing exist at time of analysis, but the attack requires only valid workspace membership on the target deployment.
Privilege escalation in Doorkeeper OpenID Connect prior to 1.10.4 allows self-registered OAuth clients to obtain scopes beyond what the server intends to grant. The Dynamic Client Registration endpoint directly assigns client-supplied scope values to the application record without intersecting them against the server's configured `default_scopes` and `optional_scopes`, and because `enforce_configured_scopes` is disabled by default, Doorkeeper's ScopeChecker subsequently honors those persisted application-level scopes over server-level restrictions. No public exploit has been identified at time of analysis; a vendor patch was released July 2, 2026.
Incorrect reference resolution in the CustomTabs component of Google Chrome for Android (all versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to bypass Android system access restrictions by delivering a crafted HTML page. The integrity impact is limited (I:L, S:U) with no confidentiality or availability consequence. No public exploit code exists and exploitation status is confirmed as none by SSVC assessment, placing this squarely in standard patch-cycle priority rather than emergency response.
Cookie input validation bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to circumvent web origin policy restrictions. Exploitation requires a second-stage attack where a separately compromised renderer is leveraged via a crafted HTML page, making this a chained exploit component rather than a standalone initial-access vulnerability. No public exploit code has been identified and CISA has not listed this in the KEV catalog; EPSS at 0.18% (8th percentile) and a 'Low' Chromium-internal severity rating reflect limited real-world exploitation risk.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to potentially leak sensitive information by serving a crafted HTML page to a victim. The flaw is classified as CWE-863 (Incorrect Authorization), meaning Chrome's DOM implementation fails to properly enforce access controls for certain document-level resources. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with Chrome's own 'Low' severity rating despite the medium CVSS 6.5 score driven by the C:H metric.
Incorrect authorization in the Forms component of Google Chrome prior to version 152.0.7977.65 enables a remote unauthenticated attacker to obtain sensitive browser-held form data by directing a victim to a crafted HTML page. The CVSS 6.5 score reflects high confidentiality impact (C:H) with no integrity or availability consequence, consistent with a pure information disclosure primitive. No public exploit identified at time of analysis; EPSS of 0.17% at the 6th percentile and Chromium's own 'Low' internal severity rating together suggest low near-term exploitation likelihood despite the meaningful CVSS base score.
Missing authorization in Chrome's InterestGroups API allows a renderer-compromised attacker to bypass system access restrictions via a crafted PDF file. Affected are all Google Chrome versions prior to 152.0.7977.65 across desktop platforms. This is a chained exploit: a prerequisite renderer-process compromise must already exist before the InterestGroups flaw can be leveraged to escalate beyond sandbox constraints and achieve high integrity impact. No public exploit or CISA KEV listing exists; EPSS stands at 0.23% (13th percentile), reflecting very low exploitation probability in the wild.
Incorrect authorization (CWE-863) in Chrome's Browser component on Android allows remote attackers to bypass system access restrictions through social engineering and UI interaction. Affected versions are all Chrome releases for Android prior to 152.0.7977.65. The flaw carries only a limited integrity impact with no confidentiality or availability consequence, and Chromium's own severity rating of 'Low' is consistent with the very low EPSS score of 0.17% (7th percentile). No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog.
System access restriction bypass in Google Chrome Mobile on iOS prior to version 152.0.7977.65 enables a remote attacker to circumvent platform-level security controls by luring a victim to a specially crafted HTML page. The flaw stems from improper input validation (CWE-20) in Chrome's iOS mobile implementation and results in a low-integrity impact with no confidentiality or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.22% (12th percentile), and CISA SSVC classifies exploitation as none and technical impact as partial, consistent with a low-priority patching posture for most organizations.
Race condition in Chrome's Extensions subsystem (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions via a crafted Chrome extension, achieving high integrity impact with no confidentiality or availability effect. User interaction is required, and Chromium's own internal severity rating is Low - notably lower than the NVD CVSS Medium score of 6.5 - consistent with EPSS of 0.22% (12th percentile) and SSVC's 'none' exploitation status. No public exploit exists and the vulnerability is not in CISA KEV at time of analysis.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to violate the browser's same-origin isolation guarantees through a crafted Chrome extension delivered via social engineering. The CWE-459 incomplete cleanup root cause means residual state is left after a browsing or extension context transition, enabling a malicious extension to interact with origins it should not have access to - resulting in a High integrity impact per the CVSS vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the EPSS score of 0.24% (14th percentile) reflects low observed exploitation pressure, consistent with the social-engineering prerequisite and the Chromium team's own Low severity designation.
Web origin policy bypass in Google Chrome's ReaderMode feature prior to version 152.0.7977.65 allows a remote attacker to inject content into a privileged browser page context via a crafted HTML page, requiring social engineering to achieve user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) limits impact to integrity only, with no confidentiality or availability consequences. No public exploit code or CISA KEV listing exists; EPSS at 0.26% (17th percentile) confirms very low observed exploitation probability.
UI misrepresentation in Google Chrome's Web Authentication (WebAuthn) subsystem - covering both Passkeys and hardware Security Keys - prior to version 152.0.7977.65 allows remote attackers to manipulate authentication dialog presentation via a crafted HTML page, enabling bypass of system access restrictions through social engineering. The CVSS vector rates Integrity impact as High (I:H) with no privileges required (PR:N), yet Chromium's own team assigned Low severity, and EPSS exploitation probability is just 0.22% (12th percentile), reflecting the social engineering dependency. No public exploit has been identified and no CISA KEV listing exists at time of analysis.
ServiceWorker improper input validation in Google Chrome prior to 152.0.7977.65 enables a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms no authentication is required from the attacker but user interaction is necessary, limiting the scope of practical exploitation. No public exploit has been identified at time of analysis, and EPSS is low at 0.30% (23rd percentile), consistent with the internal Chromium severity rating of Low.
Incorrect authorization in Google Chrome's Media component on Windows enables a remote attacker who has already compromised the renderer process to bypass OS-level system access restrictions via a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on Windows. No public exploit code has been identified and EPSS probability is very low at 0.21% (11th percentile), though the sandbox-escape nature of this flaw makes it a meaningful chaining risk in multi-stage attacks.
StorageAccessAPI incorrect authorization in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass web origin policy via a crafted HTML page, achieving high-integrity impact against cross-origin resources. The flaw (CWE-863) is a post-exploitation second-stage primitive: it cannot be leveraged without a preceding renderer compromise, substantially narrowing its realistic threat scope beyond what the CVSS 6.5 score implies. No public exploit code has been identified, EPSS stands at 0.19%, Chromium's own internal severity rating is Low, and there is no CISA KEV listing at time of analysis.
Missing authorization in Google Chrome's Browser component on macOS (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy and reach privileged browser pages via a crafted HTML page, contingent on social engineering the victim into visiting the page. Impact is limited to integrity (CVSS I:L) with no confidentiality or availability consequences; EPSS at 0.26% (18th percentile) signals negligible current exploitation probability. No public exploit identified at time of analysis, and the vendor-released patch is available as of version 152.0.7977.65.
Address bar spoofing in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to deceive users about the current page origin via a crafted HTML page. The root cause is missing authorization (CWE-862) in Chrome Core, where the renderer can influence address bar state without proper permission checks. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is very low at 0.28%, consistent with the chained exploitation requirement.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to circumvent same-origin restrictions via a crafted HTML page, achieving limited integrity impact in the user's browsing context. The flaw is rooted in incorrect authorization logic (CWE-863) within Chrome's Select component, as confirmed by the vendor's stable channel advisory. No public exploit has been identified at time of analysis, and EPSS signals very low exploitation probability at 0.26% (18th percentile), consistent with Chromium's own Low severity rating.
Incorrect authorization in Chrome's StorageAccessAPI (versions prior to 152.0.7977.65) enables a renderer-compromised attacker to bypass the web origin policy via a crafted HTML page. This is a chained vulnerability - exploitation is contingent on a prior renderer process compromise, making it a second-stage component in a multi-bug attack chain rather than a standalone threat. No public exploit identified at time of analysis; EPSS at 0.23% (14th percentile) confirms low independent exploitation probability, consistent with Chromium's own 'Low' internal severity rating despite the NVD-assigned 6.5 CVSS score.
Web origin policy bypass in Google Chrome on Windows (prior to 152.0.7977.65) via improper input validation in the New Tab Page (NTP) Footer component enables integrity compromise without confidentiality loss. Exploitation is contingent on the attacker having already achieved renderer process compromise, making this a chained, post-exploitation primitive rather than a standalone vector. No public exploit code exists and EPSS sits at the 8th percentile, consistent with Chromium's own Low severity rating - though the integrity impact is rated High under CVSS.
Web origin policy bypass in Google Chrome's ReadingList component on Windows enables a renderer-compromised attacker to cross origin boundaries via a crafted HTML page. Affected are all Chrome for Windows versions prior to 152.0.7977.65. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), and Chromium's own security team rates this as Low severity despite the NVD CVSS score of 6.5.
Incorrect reference resolution in the WebView component of Google Chrome on Android (versions prior to 152.0.7977.65) enables a remote attacker to potentially bypass the web origin policy by delivering a crafted HTML page. The flaw carries a Chromium-internal severity of Low, consistent with the limited confidentiality-only impact (C:L/I:N/A:N) reflected in the CVSS 4.3 score. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) confirms negligible current exploitation probability.
Incorrect authorization in the Controls component of Google Chrome prior to version 152.0.7977.65 enables web origin policy bypass via a crafted HTML page, requiring only that a user visit the attacker-controlled page. The flaw (CWE-863) allows limited cross-origin integrity manipulation with no confidentiality or availability impact, as reflected in the CVSS integrity-only impact score. No public exploit has been identified at time of analysis, EPSS stands at 0.19% (8th percentile), and the Chromium team internally rated severity as Low - all signals consistent with a narrow-impact, user-interaction-dependent authorization gap.
Race condition in Google Chrome's Transactions Platform on Android (prior to 152.0.7977.65) enables remote attackers to bypass system access restrictions with high integrity impact. Exploitation requires social engineering the victim into visiting a crafted HTML page, and the race window makes reliable triggering difficult (AC:H per CVSS). Chromium's own severity rating is Low; EPSS at 0.18% (7th percentile) confirms minimal real-world exploitation pressure, and no public exploit or KEV listing has been identified.
Missing authorization in the BrowserTag component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by distributing a crafted Chrome extension via social engineering. The flaw bypasses authorization checks within BrowserTag, allowing the malicious extension to access data it should not be permitted to read. No active exploitation has been identified (CISA KEV absent), EPSS sits at 0.23% (13th percentile), and Chromium's own severity classification is 'Low' - all consistent with the UI:R prerequisite of tricking a user into installing a hostile extension.
Web origin policy bypass in Google Chrome Extensions affects all desktop versions prior to 152.0.7977.65, exploitable only by an attacker who has already compromised the renderer process. The incorrect authorization flaw (CWE-863) in the Extensions subsystem allows the renderer-level attacker to cross Same-Origin Policy boundaries via a specially crafted HTML page, potentially reading data from origins the renderer should not access. No public exploit code and no CISA KEV listing exist; EPSS is 0.19% (8th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Improper input validation in Chrome's DeviceBoundSessionCredentials (DBSC) component allows remote attackers to bypass the web origin policy by delivering crafted network traffic, contingent on social engineering the user into triggering the request. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the low-to-medium CVSS 4.3 rating and the user-interaction prerequisite.
Incorrect authorization in Chrome's WebProtect component (CWE-863) allows a remote attacker to bypass system access restrictions via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms impact is limited to partial integrity loss with no confidentiality or availability consequence, and exploitation is gated on the victim actively navigating to attacker-controlled content. No active exploitation is confirmed - CISA KEV status is absent and EPSS stands at 0.19% (8th percentile), consistent with the Low severity rating assigned by the Chromium security team.
Chrome's Workers component prior to version 152.0.7977.65 mismanages resource lifetimes (CWE-664), enabling a site isolation bypass that allows cross-origin data to be read by an attacker who has already compromised the renderer process via a separate exploit. This is a second-stage chained primitive, not a standalone attack - it requires both user interaction with a crafted HTML page and a pre-existing renderer compromise. No public exploit code has been identified and EPSS of 0.20% (10th percentile) reflects very low observed exploitation probability.
Missing authorization in Chrome's Preload subsystem (CWE-862) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. The bypass results in limited cross-origin data disclosure (confidentiality impact only). No public exploit code has been identified and the CVE is absent from the CISA KEV catalog; EPSS stands at 0.22% (13th percentile), consistent with low real-world exploitation activity.
UI misrepresentation in Google Chrome's Linux Toolkit Theming component enables remote attackers to bypass system access restrictions through a crafted HTML page, relying on social engineering to complete the attack. All Chrome versions prior to 152.0.7977.65 on Linux are affected; Google shipped the fix in stable channel release 152.0.7977.65. No active exploitation has been confirmed (absent from CISA KEV), and an EPSS of 0.30% at the 23rd percentile reflects low automated exploitation probability.
Incorrect authorization in Google Chrome's browser component prior to version 152.0.7977.65 allows web origin policy bypass via a crafted HTML page. Remote unauthenticated attackers can exploit this flaw by inducing a user to visit a malicious page, resulting in limited cross-origin data reads - a breach of the same-origin policy, which is a foundational browser security boundary. No public exploit identified at time of analysis and not listed in CISA KEV; EPSS of 0.19% (8th percentile) confirms low exploitation probability in the current threat landscape.
System access restriction bypass in Google Chrome's Workers subsystem affects all versions prior to 152.0.7977.65, functioning as the second link in an exploit chain where an attacker must first compromise the renderer process. Improper input validation in Workers then allows a crafted HTML page to circumvent Chrome's sandbox-enforced access controls, yielding limited confidentiality and integrity impact on the host. EPSS is 0.22% (12th percentile) with no confirmed active exploitation via CISA KEV, placing this squarely in the category of a chained, low-probability threat rather than a mass-exploitation vector.
Site isolation bypass in Google Chrome DevTools (versions prior to 152.0.7977.65) enables cross-origin data theft as a second-stage exploit following renderer process compromise. An attacker who has already gained control of a Chrome renderer - itself requiring exploitation of a separate vulnerability - can serve a crafted HTML page exploiting improper input validation in DevTools to breach the browser's inter-site boundary and read data from other open origins. No public exploit code exists and EPSS of 0.22% (12th percentile) confirms this is not currently seeing broad opportunistic exploitation, though the technique is highly attractive for targeted, multi-stage browser exploit chains.
Incorrect USB authorization in Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass system USB access restrictions by socially engineering a user into visiting a crafted HTML page. The flaw (CWE-863) in Chrome's USB subsystem grants unauthorized access without proper permission verification, resulting in a limited integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS is very low at 0.21% (11th percentile), consistent with Chromium's own Medium severity rating; a vendor patch has been released.
Incorrect authorization in Google Chrome's WebXR implementation prior to version 152.0.7977.65 enables cross-origin data exfiltration via a crafted HTML page, requiring attacker-driven social engineering to direct a victim to the malicious page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5, reflecting high confidentiality impact but no integrity or availability loss, and user interaction is a necessary prerequisite. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog at time of analysis, with EPSS at 0.21% (11th percentile) confirming low observed exploitation activity.
Incorrect authorization in the Device component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions - specifically controls governing device-level API access - through a crafted HTML page delivered via social engineering. Exploitation requires user interaction, limiting opportunistic mass exploitation, and EPSS at 0.29% (21st percentile) reflects low real-world exploitation probability. No public exploit identified and no CISA KEV listing; a vendor patch is available.
Incorrect authorization in Chrome's GetUserMedia API allows remote attackers to obtain sensitive information - specifically unauthorized access to a user's camera or microphone feed - by luring the victim to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the High confidentiality impact warrants timely patching given Chrome's ubiquitous deployment.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) grants a remote attacker who has already compromised the renderer process the ability to circumvent Same-Origin Policy restrictions via a crafted HTML page, leaking limited confidential data from cross-origin contexts. This is a second-stage exploitation primitive - it is only dangerous when chained with a separate renderer compromise vulnerability. No public exploit identified at time of analysis, and the low EPSS score of 0.26% (18th percentile) reflects minimal current exploitation interest.
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. No public exploit code and no CISA KEV listing are present; EPSS places exploitation probability at 0.24% (15th percentile), consistent with a low-priority but broadly applicable patch.
DevTools Missing Authorization in Google Chrome prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers who socially engineer victims into performing specific UI interactions. The CWE-862 root cause indicates the DevTools component lacks proper authorization checks on certain UI-driven data access paths, allowing an attacker-controlled page to extract information the browser context holds. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.15% at the 5th percentile confirms minimal near-term exploitation probability despite the C:H CVSS impact rating.
Site isolation bypass in Google Chrome's Speech component allows an attacker who has already established a foothold in the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65 across all platforms covered by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis, EPSS probability is very low at 0.20% (10th percentile), and the vulnerability is not listed in CISA KEV - however its value as a second-stage exploit in a browser attack chain elevates practical concern above the low CVSS score alone.
Incorrect authorization in Google Chrome's Web Authentication subsystem (Passkeys and Security Keys) allows a remote attacker to bypass the web origin policy by inducing a user to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop platforms are affected. The impact is limited to partial confidentiality - origin policy bypass could expose authentication context or credential associations across origins - with no integrity or availability impact confirmed.
Chrome's FileSystem API prior to version 152.0.7977.65 improperly handles case sensitivity when enforcing access restrictions, enabling a remote attacker to bypass system-level file access controls via a crafted HTML page delivered through social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms a network-reachable, unauthenticated path with high integrity impact, though the mandatory user interaction requirement limits mass exploitation. No public exploit has been identified at time of analysis, and an EPSS of 0.33% at the 26th percentile reflects limited observed exploitation activity.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits incomplete cleanup (CWE-459) in the SiteIsolation component, enabling a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin process separation via a crafted HTML page. This is a chained, second-stage attack - the CVSS score of 3.1 (Low) and EPSS of 0.28% (20th percentile) reflect the high prerequisite bar of a prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in Google Chrome's Network component prior to version 152.0.7977.65 allows a remote, unauthenticated attacker to bypass the browser's web origin policy by delivering a crafted HTML page to a victim. The bypass yields limited confidentiality exposure, consistent with the CVSS C:L rating, and requires the target user to interact with attacker-controlled content. No public exploit code has been identified and EPSS stands at 0.19% (8th percentile), indicating low current exploitation probability despite the broad deployment footprint of Chrome.
Web origin policy bypass in Google Chrome's cache component affects all versions prior to 152.0.7977.65, exploitable by a remote unauthenticated attacker who tricks a user into visiting a crafted HTML page. The incorrect reference resolution (CWE-706) in the cache layer allows cross-origin data to be read, constituting a Same-Origin Policy bypass with limited confidentiality impact. No active exploitation is confirmed and EPSS sits at 0.20% (10th percentile), indicating low real-world exploitation pressure at this time.
Incorrect authorization in Chrome's ServiceWorker component (CWE-863) allows remote unauthenticated attackers who can socially engineer a user into installing a crafted Chrome extension to bypass the web origin policy, resulting in limited cross-origin data exposure. All Chrome releases prior to 152.0.7977.65 are affected across platforms; a vendor patch is available. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) indicates very low current exploitation probability, consistent with the absence of a CISA KEV listing.
Incorrect authorization in Chrome's Editing component (prior to 152.0.7977.65) permits remote attackers to read sensitive information by enticing a user to visit a specially crafted HTML page. The flaw (CWE-863) affects all Chrome versions across all platforms below the fixed release, with a high confidentiality impact but no integrity or availability consequence. No public exploit code or active exploitation is confirmed; EPSS stands at 0.36% (28th percentile), indicating low real-world exploitation probability at time of analysis.
Missing authorization in Google Chrome's Network component prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions with high integrity impact by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-reachable exploitation requiring no attacker-side privileges, though a single user interaction gates the attack. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.23% (13th percentile) reflects low observed exploitation probability despite broad product exposure.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process - and further leverages social engineering - to circumvent Chrome's cross-origin security boundary via a crafted HTML page, resulting in limited confidentiality exposure. The flaw resides in the SiteIsolation authorization logic (CWE-863), meaning Chrome fails to correctly validate whether a renderer process is permitted to access data belonging to a different origin. With an EPSS of 0.23% (13th percentile) and no CISA KEV listing, real-world exploitation probability is low; the dual prerequisite of a pre-existing renderer compromise plus social engineering substantially raises the attack bar beyond what the low CVSS score alone conveys.
Web origin policy bypass in Google Chrome's StorageAccessAPI enables an attacker who has already compromised the renderer process to exfiltrate cross-origin storage data via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The vulnerability is rated medium severity (CVSS 4.3) and requires both user interaction and a pre-existing renderer compromise, making it a second-stage chained exploit component rather than a standalone initial access vector. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
Race condition in Google Chrome's Workers implementation before version 152.0.7977.65 allows a remote attacker to bypass system access restrictions, resulting in high integrity impact. Exploitation requires a victim to visit a crafted HTML page, placing this in the social-engineering-dependent threat category. No public exploit has been identified, and the EPSS score of 0.19% (9th percentile) indicates negligible observed exploitation in the wild at time of analysis.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to exfiltrate sensitive information by luring a user to a crafted HTML page. The flaw (CWE-863) bypasses DOM-level permission checks, resulting in High confidentiality impact with no integrity or availability consequences. No public exploit has been identified at time of analysis, and EPSS at 0.36% (28th percentile) indicates minimal observed exploitation pressure despite the patch now being available from Google.
Incorrect authorization in Google Chrome's Network subsystem (all versions before 152.0.7977.65) permits remote unauthenticated attackers to bypass system access restrictions by inducing a user to visit a crafted HTML page. Classified as CWE-863, the flaw allows a limited integrity violation against the affected system without confidentiality or availability impact. No public exploit has been identified at time of analysis, and the low EPSS score (0.38%, 31st percentile) indicates minimal current exploitation pressure.
Improper input validation in Google Chrome's Safebrowsing component prior to version 152.0.7977.65 allows remote attackers to bypass system access restrictions via a crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is network-reachable without authentication but requires user interaction, constraining opportunistic or automated exploitation at scale. EPSS at 0.22% (12th percentile) and absence from CISA KEV indicate low real-world exploitation probability at time of analysis; no public exploit code has been identified.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to cross origin security boundaries via a crafted HTML page, resulting in limited cross-site data disclosure. The flaw is an incorrect authorization check (CWE-863) in Chrome's SiteIsolation subsystem - a defense-in-depth mechanism that keeps different origins in separate OS processes. No public exploit has been identified and EPSS stands at 0.38%, consistent with the high prerequisite of prior renderer compromise; this vulnerability is not listed in CISA KEV.
Site isolation boundary bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read cross-origin data via a crafted PDF file. This is a chained, second-stage attack technique - not a standalone exploit - requiring renderer process compromise as a hard prerequisite before the missing authorization check (CWE-862) in SiteIsolation becomes actionable. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.35% (27th percentile) aligns with the complex prerequisites that suppress widespread exploitation.
Site Isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin boundary enforcement and access a privileged page via a crafted HTML page. This is a chaining vulnerability rather than a standalone exploit - it requires a pre-existing renderer compromise (typically from a separate, higher-severity CVE) before the SiteIsolation authorization flaw can be leveraged. No public exploit code has been identified and EPSS at 0.27% (19th percentile) reflects low standalone exploitation probability, though this class of flaw is historically weaponized as a second stage in full browser sandbox escape chains.
Web origin policy bypass in Google Chrome's Preload component (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a specially crafted HTML page. Classified as CWE-20 (Improper Input Validation) with a vendor-assigned CVSS score of 4.3 (Medium), the vulnerability is a second-stage attack primitive rather than a standalone exploit - requiring prior renderer compromise as a hard prerequisite. No public exploit code or active exploitation has been confirmed at time of analysis; Google has released a fix in Chrome 152.0.7977.65.
Missing authorization in Google Chrome's BFCache (Back/Forward Cache) component allows a remote attacker who has already compromised the renderer process to bypass system access restrictions via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. The integrity impact is rated High, enabling unauthorized writes or modifications to protected resources beyond the renderer sandbox. EPSS is low at 0.38% (31st percentile), and no active exploitation or public POC has been identified, but the vulnerability is noteworthy as a sandbox-escape primitive in a chained attack.
Chrome's FileSystem API implementation prior to version 152.0.7977.65 contains incorrect authorization logic (CWE-863) that permits a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page via social engineering. The bypass produces a limited integrity impact - unauthorized write or access to filesystem-restricted resources - with no confidentiality or availability consequence per the CVSS vector (I:L, C:N, A:N). No public exploit code exists and the vulnerability is absent from CISA KEV; EPSS of 0.27% (19th percentile) reflects low near-term exploitation probability.
Incorrect authorization in Google Chrome Mobile on iOS (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw stems from improper authorization enforcement (CWE-863) within the iOS-specific mobile browser code path, permitting limited integrity violations without confidentiality or availability impact. No public exploit has been identified and EPSS sits at a low 0.23% (13th percentile), consistent with a medium-severity, user-interaction-dependent issue not yet seeing active targeting.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits a missing authorization flaw (CWE-862) in the Lighthouse auditing component, allowing an attacker who has already achieved renderer process compromise to cross site isolation boundaries and access limited cross-origin data. The attack chain requires high complexity - a pre-compromised renderer plus active social engineering - making this a second-stage vulnerability in a chained exploit rather than an independently weaponizable flaw. No public exploit code exists and no CISA KEV listing has been identified; EPSS at 0.32% (24th percentile) corroborates the low priority for standalone exploitation.
Web origin policy bypass in Google Chrome's Loader component (all versions prior to 152.0.7977.65) enables remote unauthenticated attackers to read limited cross-origin data by luring a user to a crafted HTML page. The flaw stems from incorrect authorization (CWE-863) in how the Loader enforces origin boundaries, allowing an attacker-controlled page to extract content from another origin the victim is browsing. EPSS is 0.34% (26th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, placing this in the lower tier of active exploitation risk despite broad product prevalence.
Improper access control in Chrome's Workers subsystem allows a remote unauthenticated attacker to bypass the web origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin data leakage. Affected versions span all Chrome releases prior to 152.0.7977.65 across desktop platforms. No public exploit identified at time of analysis and EPSS probability stands at 0.24% (15th percentile), indicating this is a low-urgency but real boundary-enforcement gap in the browser's sandboxing model.
Incorrect reference resolution in Google Chrome's Passwords feature (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by delivering a crafted file that a user must open. The integrity impact is limited (CVSS I:L), and no confidentiality or availability loss is indicated. With EPSS at 0.36% (29th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low despite the network-accessible attack vector.
Incorrect authorization in Chrome's Network component allows remote unauthenticated attackers to bypass system access restrictions via a crafted HTML page, resulting in low-integrity impact. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS at 0.23% (13th percentile) reflects low real-world exploitation probability; a vendor patch has been issued in the stable channel.
Missing authorization in the Payments component of Google Chrome on Android (prior to 152.0.7977.65) allows remote attackers to potentially bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw is classified as CWE-862 and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to integrity. No public exploit code has been identified at time of analysis, and EPSS scoring of 0.32% (24th percentile) indicates statistically low exploitation probability at scale.
Origin policy bypass in Google Chrome prior to 152.0.7977.65 exposes users to potential cross-site data leakage when a victim visits an attacker-controlled page. The Network component fails to properly validate input (CWE-20), enabling circumvention of the browser's web origin policy - a fundamental Same-Origin Policy enforcement mechanism - allowing a remote attacker to read data from origins other than the page's own. No public exploit has been identified and EPSS stands at 0.24% (15th percentile), indicating low current exploitation probability, though Chrome's ubiquitous global deployment amplifies the aggregate exposure.
Missing authorization in Google Chrome's HTTP/2 implementation prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers via crafted network traffic. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication is required but high attack complexity, consistent with a need for specific network positioning or traffic crafting. No public exploit code or active exploitation has been identified; EPSS at 0.20% (10th percentile) confirms low current exploitation probability.
Safebrowsing in Google Chrome prior to 152.0.7977.65 fails to properly validate input from crafted files, permitting remote attackers to bypass system access restrictions that the component is designed to enforce. The attack requires user interaction - specifically opening a crafted file - and results in limited integrity impact with no confidentiality or availability compromise. No public exploit code or CISA KEV listing has been identified; EPSS exploitation probability is very low at 0.22% (12th percentile), consistent with the Chromium team's Medium severity classification.
Origin policy bypass in Google Chrome's Editing component (prior to 152.0.7977.65) requires an attacker who has already compromised the renderer process to additionally leverage social engineering against the user via a crafted HTML page. Successful exploitation leaks limited cross-origin data by circumventing the same-origin policy through improper input validation in the editing subsystem. No public exploit code exists and EPSS sits at the 15th percentile, indicating low near-term exploitation probability; no active exploitation confirmed by CISA KEV.
Incorrect authorization in Chrome's WebAppInstalls component on Android (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. The flaw (CWE-863) results in a low-integrity impact with no confidentiality or availability consequence, consistent with CVSS 4.3 Medium. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS of 0.24% (15th percentile) signals low current exploitation interest.
Missing authorization in Google Chrome's Network component, prior to version 152.0.7977.65, allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by serving a crafted HTML page to a user. This is effectively a second-stage sandbox-bypass vulnerability requiring a pre-compromised renderer as a prerequisite, making it a chained exploit component rather than a standalone critical flaw. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.23% (13th percentile), consistent with low near-term exploitation probability. A vendor patch is available in stable channel release 152.0.7977.65.
Incorrect authorization in the TabGroups feature of Google Chrome prior to 152.0.7977.65 allows a remote attacker to leak sensitive browser information by serving crafted network traffic to a victim user. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser fails to properly enforce access control within tab group contexts, and was rated Medium severity by the Chromium security team. No public exploit identified at time of analysis, and an EPSS of 0.20% at the 10th percentile confirms very low observed exploitation activity.
Chrome's Network subsystem before version 152.0.7977.65 allows remote attackers to bypass the browser's web origin policy due to improper initialization (CWE-665), exploitable via a crafted HTML page that requires user interaction. The impact is limited to partial confidentiality disclosure (C:L), with no integrity or availability consequences, and the CVSS score of 4.3 (Medium) aligns with EPSS exploitation probability of 0.36% (29th percentile). No public exploit code or CISA KEV listing exists at the time of analysis; a vendor patch is available in the stable channel.
Incorrect authorization in Google Chrome's WebProtect component before version 152.0.7977.65 allows a remote, unauthenticated attacker to exfiltrate sensitive information by directing a user to a specially crafted HTML page. The flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H) and no integrity or availability impact, scoped entirely within the browser process. No public exploit is identified at time of analysis, and the EPSS score of 0.27% (19th percentile) indicates low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Missing authorization in Chrome's CustomTabs feature on Android exposes sensitive browser information to co-installed malicious applications on versions prior to 152.0.7977.65. The vulnerability stems from CWE-862 (Missing Authorization), meaning Chrome does not properly verify whether a companion app is permitted to access data surfaced through the CustomTabs interface. No public exploit code or active exploitation has been identified; EPSS sits at the 6th percentile, confirming low real-world exploitation probability despite the High confidentiality impact in the CVSS vector.
Web origin policy bypass in Google Chrome's WebRTC component (prior to 152.0.7977.65) enables a network-positioned attacker who has already compromised the renderer process to cross same-origin boundaries via a crafted HTML page requiring user interaction. This is a chained exploitation step - not a standalone critical flaw - making it most relevant as a second-stage component in a targeted multi-stage browser exploit. No public exploit code exists and EPSS of 0.28% at the 20th percentile is consistent with no observed opportunistic exploitation; the vulnerability is not listed in CISA KEV.
Unauthenticated information disclosure in Royal Addons for Elementor (WordPress plugin) before version 1.7.1066 exposes names and IDs of non-public taxonomy terms to any remote caller. The plugin performs no capability or nonce verification before fulfilling taxonomy data requests, meaning access controls enforced by WordPress core are entirely bypassed at the plugin layer. A publicly available proof-of-concept exists per WPScan, and exploitation is assessed as automatable with partial technical impact by the SSVC framework.
Unauthenticated metadata tampering in Royal Addons for Elementor WordPress plugin before 1.7.1066 allows any remote visitor to overwrite like-count and visitor-tracking post meta on arbitrary posts, including private and draft posts, because the plugin's AJAX handler validates only a nonce - a value scrapeable from any public page - without performing any WordPress capability or post-ownership check. A publicly available proof-of-concept exists per WPScan. While exploitation is automatable and requires no credentials, the integrity impact is narrow, limited to engagement metadata rather than post content or authentication data.
Unauthenticated information disclosure in the Eventin WordPress plugin before 4.1.22 exposes private, draft, and pending posts - including the plaintext passwords and full content of password-protected posts - to any unauthenticated HTTP client via an unprotected REST API namespace. The flaw arises from missing authorization checks on post status and ownership within that namespace, meaning no credentials or privileges are required to enumerate and read content the site owner intended to restrict. A publicly available proof-of-concept exploit exists, and the attack is fully automatable per the SSVC framework, though CISA has not listed this in KEV and the EPSS score is low (0.18%), suggesting exploitation has not yet been widespread.
Authorization bypass and privilege escalation in Apache APISIX 3.11.0-3.17.0 stem from the `attach-consumer-label` plugin failing to strip client-supplied consumer-label headers before using them in security decisions. An attacker who can reach the gateway can forge header values to impersonate a higher-privileged consumer label, bypassing route-level access controls. No vendor-released patch is available at time of analysis (fix version marked pending); no public exploit code or CISA KEV listing has been identified.
Cross-organizational information disclosure in Katello - the content management engine of Red Hat Satellite 6 - allows any authenticated user to read lifecycle history of Content Views belonging to organizations other than their own. By supplying an arbitrary Content View identifier to the Content View History API endpoint, a low-privileged user bypasses organization-scope authorization and retrieves publication events, promotion history, associated usernames, and timestamps for foreign tenants. No public exploit has been identified at time of analysis, and no CISA KEV listing exists; the CVSS 4.3 Medium rating reflects the strictly read-only, single-organization-boundary impact.
Unauthenticated integrity compromise in Cohere North AI v1.1.5 exposes an internal user-management API endpoint with no effective access control, allowing any remote attacker to overwrite arbitrary user account data via crafted HTTP requests to /api/internal/v1/users/{USER_ID}. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the 'Authentication Bypass' tag both confirm exploitation requires no credentials and no user interaction. A researcher-published PoC exists on GitHub, though EPSS remains low (0.14%, 4th percentile) and no CISA KEV listing has been issued.
Forceful Browsing in Drupal Core across multiple active and end-of-life release branches (10.x through 10.6.13, 11.3.x through 11.3.14, 11.4.x through 11.4.4, and all 11.0.x-11.2.x) allows unauthenticated remote attackers to bypass authorization and directly access protected resources due to missing authorization checks (CWE-862). The CVSS vector (AV:N/AC:H/PR:N/UI:R) indicates network-reachable exploitation but with high complexity and required user interaction, limiting opportunistic mass attacks. No active exploitation is confirmed - EPSS stands at 0.13% (3rd percentile) and CISA SSVC rates exploitation as none and not automatable - but a vendor patch is available via SA-CORE-2026-010.
Missing authentication on a critical function in the Drupal PanKM contributed module allows a network-accessible, high-privilege attacker-given required user interaction-to bypass module authorization controls and achieve high confidentiality and integrity impact against all currently released versions. All known PanKM releases are affected (CPE wildcard cpe:2.3:a:drupal:pankm:*:*:*:*:*:*:*:*), with the Drupal security team (sa-contrib-2026-083) confirming the issue. No public exploit code has been identified at time of analysis, and SSVC confirms exploitation status as none.
Cross-workspace domain deletion in TypeBot prior to 3.18.0 allows any authenticated non-guest workspace member to remove custom domains belonging to other workspaces, rendering their chatbots unavailable. The `handleDeleteCustomDomain` API handler validates the caller's membership in a client-supplied workspaceId but forwards the client-supplied domain name to the shared Vercel project API without confirming that domain is owned by the authorized workspace - a classic IDOR flaw (CWE-639). No public exploit code and no CISA KEV listing exist at time of analysis, but the attack requires only valid workspace membership on the target deployment.
Privilege escalation in Doorkeeper OpenID Connect prior to 1.10.4 allows self-registered OAuth clients to obtain scopes beyond what the server intends to grant. The Dynamic Client Registration endpoint directly assigns client-supplied scope values to the application record without intersecting them against the server's configured `default_scopes` and `optional_scopes`, and because `enforce_configured_scopes` is disabled by default, Doorkeeper's ScopeChecker subsequently honors those persisted application-level scopes over server-level restrictions. No public exploit has been identified at time of analysis; a vendor patch was released July 2, 2026.
Incorrect reference resolution in the CustomTabs component of Google Chrome for Android (all versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to bypass Android system access restrictions by delivering a crafted HTML page. The integrity impact is limited (I:L, S:U) with no confidentiality or availability consequence. No public exploit code exists and exploitation status is confirmed as none by SSVC assessment, placing this squarely in standard patch-cycle priority rather than emergency response.
Cookie input validation bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to circumvent web origin policy restrictions. Exploitation requires a second-stage attack where a separately compromised renderer is leveraged via a crafted HTML page, making this a chained exploit component rather than a standalone initial-access vulnerability. No public exploit code has been identified and CISA has not listed this in the KEV catalog; EPSS at 0.18% (8th percentile) and a 'Low' Chromium-internal severity rating reflect limited real-world exploitation risk.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to potentially leak sensitive information by serving a crafted HTML page to a victim. The flaw is classified as CWE-863 (Incorrect Authorization), meaning Chrome's DOM implementation fails to properly enforce access controls for certain document-level resources. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with Chrome's own 'Low' severity rating despite the medium CVSS 6.5 score driven by the C:H metric.
Incorrect authorization in the Forms component of Google Chrome prior to version 152.0.7977.65 enables a remote unauthenticated attacker to obtain sensitive browser-held form data by directing a victim to a crafted HTML page. The CVSS 6.5 score reflects high confidentiality impact (C:H) with no integrity or availability consequence, consistent with a pure information disclosure primitive. No public exploit identified at time of analysis; EPSS of 0.17% at the 6th percentile and Chromium's own 'Low' internal severity rating together suggest low near-term exploitation likelihood despite the meaningful CVSS base score.
Missing authorization in Chrome's InterestGroups API allows a renderer-compromised attacker to bypass system access restrictions via a crafted PDF file. Affected are all Google Chrome versions prior to 152.0.7977.65 across desktop platforms. This is a chained exploit: a prerequisite renderer-process compromise must already exist before the InterestGroups flaw can be leveraged to escalate beyond sandbox constraints and achieve high integrity impact. No public exploit or CISA KEV listing exists; EPSS stands at 0.23% (13th percentile), reflecting very low exploitation probability in the wild.
Incorrect authorization (CWE-863) in Chrome's Browser component on Android allows remote attackers to bypass system access restrictions through social engineering and UI interaction. Affected versions are all Chrome releases for Android prior to 152.0.7977.65. The flaw carries only a limited integrity impact with no confidentiality or availability consequence, and Chromium's own severity rating of 'Low' is consistent with the very low EPSS score of 0.17% (7th percentile). No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog.
System access restriction bypass in Google Chrome Mobile on iOS prior to version 152.0.7977.65 enables a remote attacker to circumvent platform-level security controls by luring a victim to a specially crafted HTML page. The flaw stems from improper input validation (CWE-20) in Chrome's iOS mobile implementation and results in a low-integrity impact with no confidentiality or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.22% (12th percentile), and CISA SSVC classifies exploitation as none and technical impact as partial, consistent with a low-priority patching posture for most organizations.
Race condition in Chrome's Extensions subsystem (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions via a crafted Chrome extension, achieving high integrity impact with no confidentiality or availability effect. User interaction is required, and Chromium's own internal severity rating is Low - notably lower than the NVD CVSS Medium score of 6.5 - consistent with EPSS of 0.22% (12th percentile) and SSVC's 'none' exploitation status. No public exploit exists and the vulnerability is not in CISA KEV at time of analysis.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to violate the browser's same-origin isolation guarantees through a crafted Chrome extension delivered via social engineering. The CWE-459 incomplete cleanup root cause means residual state is left after a browsing or extension context transition, enabling a malicious extension to interact with origins it should not have access to - resulting in a High integrity impact per the CVSS vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the EPSS score of 0.24% (14th percentile) reflects low observed exploitation pressure, consistent with the social-engineering prerequisite and the Chromium team's own Low severity designation.
Web origin policy bypass in Google Chrome's ReaderMode feature prior to version 152.0.7977.65 allows a remote attacker to inject content into a privileged browser page context via a crafted HTML page, requiring social engineering to achieve user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) limits impact to integrity only, with no confidentiality or availability consequences. No public exploit code or CISA KEV listing exists; EPSS at 0.26% (17th percentile) confirms very low observed exploitation probability.
UI misrepresentation in Google Chrome's Web Authentication (WebAuthn) subsystem - covering both Passkeys and hardware Security Keys - prior to version 152.0.7977.65 allows remote attackers to manipulate authentication dialog presentation via a crafted HTML page, enabling bypass of system access restrictions through social engineering. The CVSS vector rates Integrity impact as High (I:H) with no privileges required (PR:N), yet Chromium's own team assigned Low severity, and EPSS exploitation probability is just 0.22% (12th percentile), reflecting the social engineering dependency. No public exploit has been identified and no CISA KEV listing exists at time of analysis.
ServiceWorker improper input validation in Google Chrome prior to 152.0.7977.65 enables a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms no authentication is required from the attacker but user interaction is necessary, limiting the scope of practical exploitation. No public exploit has been identified at time of analysis, and EPSS is low at 0.30% (23rd percentile), consistent with the internal Chromium severity rating of Low.
Incorrect authorization in Google Chrome's Media component on Windows enables a remote attacker who has already compromised the renderer process to bypass OS-level system access restrictions via a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on Windows. No public exploit code has been identified and EPSS probability is very low at 0.21% (11th percentile), though the sandbox-escape nature of this flaw makes it a meaningful chaining risk in multi-stage attacks.
StorageAccessAPI incorrect authorization in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass web origin policy via a crafted HTML page, achieving high-integrity impact against cross-origin resources. The flaw (CWE-863) is a post-exploitation second-stage primitive: it cannot be leveraged without a preceding renderer compromise, substantially narrowing its realistic threat scope beyond what the CVSS 6.5 score implies. No public exploit code has been identified, EPSS stands at 0.19%, Chromium's own internal severity rating is Low, and there is no CISA KEV listing at time of analysis.
Missing authorization in Google Chrome's Browser component on macOS (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy and reach privileged browser pages via a crafted HTML page, contingent on social engineering the victim into visiting the page. Impact is limited to integrity (CVSS I:L) with no confidentiality or availability consequences; EPSS at 0.26% (18th percentile) signals negligible current exploitation probability. No public exploit identified at time of analysis, and the vendor-released patch is available as of version 152.0.7977.65.
Address bar spoofing in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to deceive users about the current page origin via a crafted HTML page. The root cause is missing authorization (CWE-862) in Chrome Core, where the renderer can influence address bar state without proper permission checks. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is very low at 0.28%, consistent with the chained exploitation requirement.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to circumvent same-origin restrictions via a crafted HTML page, achieving limited integrity impact in the user's browsing context. The flaw is rooted in incorrect authorization logic (CWE-863) within Chrome's Select component, as confirmed by the vendor's stable channel advisory. No public exploit has been identified at time of analysis, and EPSS signals very low exploitation probability at 0.26% (18th percentile), consistent with Chromium's own Low severity rating.
Incorrect authorization in Chrome's StorageAccessAPI (versions prior to 152.0.7977.65) enables a renderer-compromised attacker to bypass the web origin policy via a crafted HTML page. This is a chained vulnerability - exploitation is contingent on a prior renderer process compromise, making it a second-stage component in a multi-bug attack chain rather than a standalone threat. No public exploit identified at time of analysis; EPSS at 0.23% (14th percentile) confirms low independent exploitation probability, consistent with Chromium's own 'Low' internal severity rating despite the NVD-assigned 6.5 CVSS score.
Web origin policy bypass in Google Chrome on Windows (prior to 152.0.7977.65) via improper input validation in the New Tab Page (NTP) Footer component enables integrity compromise without confidentiality loss. Exploitation is contingent on the attacker having already achieved renderer process compromise, making this a chained, post-exploitation primitive rather than a standalone vector. No public exploit code exists and EPSS sits at the 8th percentile, consistent with Chromium's own Low severity rating - though the integrity impact is rated High under CVSS.
Web origin policy bypass in Google Chrome's ReadingList component on Windows enables a renderer-compromised attacker to cross origin boundaries via a crafted HTML page. Affected are all Chrome for Windows versions prior to 152.0.7977.65. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), and Chromium's own security team rates this as Low severity despite the NVD CVSS score of 6.5.
Incorrect reference resolution in the WebView component of Google Chrome on Android (versions prior to 152.0.7977.65) enables a remote attacker to potentially bypass the web origin policy by delivering a crafted HTML page. The flaw carries a Chromium-internal severity of Low, consistent with the limited confidentiality-only impact (C:L/I:N/A:N) reflected in the CVSS 4.3 score. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) confirms negligible current exploitation probability.
Incorrect authorization in the Controls component of Google Chrome prior to version 152.0.7977.65 enables web origin policy bypass via a crafted HTML page, requiring only that a user visit the attacker-controlled page. The flaw (CWE-863) allows limited cross-origin integrity manipulation with no confidentiality or availability impact, as reflected in the CVSS integrity-only impact score. No public exploit has been identified at time of analysis, EPSS stands at 0.19% (8th percentile), and the Chromium team internally rated severity as Low - all signals consistent with a narrow-impact, user-interaction-dependent authorization gap.
Race condition in Google Chrome's Transactions Platform on Android (prior to 152.0.7977.65) enables remote attackers to bypass system access restrictions with high integrity impact. Exploitation requires social engineering the victim into visiting a crafted HTML page, and the race window makes reliable triggering difficult (AC:H per CVSS). Chromium's own severity rating is Low; EPSS at 0.18% (7th percentile) confirms minimal real-world exploitation pressure, and no public exploit or KEV listing has been identified.
Missing authorization in the BrowserTag component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by distributing a crafted Chrome extension via social engineering. The flaw bypasses authorization checks within BrowserTag, allowing the malicious extension to access data it should not be permitted to read. No active exploitation has been identified (CISA KEV absent), EPSS sits at 0.23% (13th percentile), and Chromium's own severity classification is 'Low' - all consistent with the UI:R prerequisite of tricking a user into installing a hostile extension.
Web origin policy bypass in Google Chrome Extensions affects all desktop versions prior to 152.0.7977.65, exploitable only by an attacker who has already compromised the renderer process. The incorrect authorization flaw (CWE-863) in the Extensions subsystem allows the renderer-level attacker to cross Same-Origin Policy boundaries via a specially crafted HTML page, potentially reading data from origins the renderer should not access. No public exploit code and no CISA KEV listing exist; EPSS is 0.19% (8th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Improper input validation in Chrome's DeviceBoundSessionCredentials (DBSC) component allows remote attackers to bypass the web origin policy by delivering crafted network traffic, contingent on social engineering the user into triggering the request. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the low-to-medium CVSS 4.3 rating and the user-interaction prerequisite.
Incorrect authorization in Chrome's WebProtect component (CWE-863) allows a remote attacker to bypass system access restrictions via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms impact is limited to partial integrity loss with no confidentiality or availability consequence, and exploitation is gated on the victim actively navigating to attacker-controlled content. No active exploitation is confirmed - CISA KEV status is absent and EPSS stands at 0.19% (8th percentile), consistent with the Low severity rating assigned by the Chromium security team.
Chrome's Workers component prior to version 152.0.7977.65 mismanages resource lifetimes (CWE-664), enabling a site isolation bypass that allows cross-origin data to be read by an attacker who has already compromised the renderer process via a separate exploit. This is a second-stage chained primitive, not a standalone attack - it requires both user interaction with a crafted HTML page and a pre-existing renderer compromise. No public exploit code has been identified and EPSS of 0.20% (10th percentile) reflects very low observed exploitation probability.
Missing authorization in Chrome's Preload subsystem (CWE-862) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. The bypass results in limited cross-origin data disclosure (confidentiality impact only). No public exploit code has been identified and the CVE is absent from the CISA KEV catalog; EPSS stands at 0.22% (13th percentile), consistent with low real-world exploitation activity.
UI misrepresentation in Google Chrome's Linux Toolkit Theming component enables remote attackers to bypass system access restrictions through a crafted HTML page, relying on social engineering to complete the attack. All Chrome versions prior to 152.0.7977.65 on Linux are affected; Google shipped the fix in stable channel release 152.0.7977.65. No active exploitation has been confirmed (absent from CISA KEV), and an EPSS of 0.30% at the 23rd percentile reflects low automated exploitation probability.
Incorrect authorization in Google Chrome's browser component prior to version 152.0.7977.65 allows web origin policy bypass via a crafted HTML page. Remote unauthenticated attackers can exploit this flaw by inducing a user to visit a malicious page, resulting in limited cross-origin data reads - a breach of the same-origin policy, which is a foundational browser security boundary. No public exploit identified at time of analysis and not listed in CISA KEV; EPSS of 0.19% (8th percentile) confirms low exploitation probability in the current threat landscape.
System access restriction bypass in Google Chrome's Workers subsystem affects all versions prior to 152.0.7977.65, functioning as the second link in an exploit chain where an attacker must first compromise the renderer process. Improper input validation in Workers then allows a crafted HTML page to circumvent Chrome's sandbox-enforced access controls, yielding limited confidentiality and integrity impact on the host. EPSS is 0.22% (12th percentile) with no confirmed active exploitation via CISA KEV, placing this squarely in the category of a chained, low-probability threat rather than a mass-exploitation vector.
Site isolation bypass in Google Chrome DevTools (versions prior to 152.0.7977.65) enables cross-origin data theft as a second-stage exploit following renderer process compromise. An attacker who has already gained control of a Chrome renderer - itself requiring exploitation of a separate vulnerability - can serve a crafted HTML page exploiting improper input validation in DevTools to breach the browser's inter-site boundary and read data from other open origins. No public exploit code exists and EPSS of 0.22% (12th percentile) confirms this is not currently seeing broad opportunistic exploitation, though the technique is highly attractive for targeted, multi-stage browser exploit chains.
Incorrect USB authorization in Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass system USB access restrictions by socially engineering a user into visiting a crafted HTML page. The flaw (CWE-863) in Chrome's USB subsystem grants unauthorized access without proper permission verification, resulting in a limited integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS is very low at 0.21% (11th percentile), consistent with Chromium's own Medium severity rating; a vendor patch has been released.
Incorrect authorization in Google Chrome's WebXR implementation prior to version 152.0.7977.65 enables cross-origin data exfiltration via a crafted HTML page, requiring attacker-driven social engineering to direct a victim to the malicious page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5, reflecting high confidentiality impact but no integrity or availability loss, and user interaction is a necessary prerequisite. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog at time of analysis, with EPSS at 0.21% (11th percentile) confirming low observed exploitation activity.
Incorrect authorization in the Device component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions - specifically controls governing device-level API access - through a crafted HTML page delivered via social engineering. Exploitation requires user interaction, limiting opportunistic mass exploitation, and EPSS at 0.29% (21st percentile) reflects low real-world exploitation probability. No public exploit identified and no CISA KEV listing; a vendor patch is available.
Incorrect authorization in Chrome's GetUserMedia API allows remote attackers to obtain sensitive information - specifically unauthorized access to a user's camera or microphone feed - by luring the victim to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the High confidentiality impact warrants timely patching given Chrome's ubiquitous deployment.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) grants a remote attacker who has already compromised the renderer process the ability to circumvent Same-Origin Policy restrictions via a crafted HTML page, leaking limited confidential data from cross-origin contexts. This is a second-stage exploitation primitive - it is only dangerous when chained with a separate renderer compromise vulnerability. No public exploit identified at time of analysis, and the low EPSS score of 0.26% (18th percentile) reflects minimal current exploitation interest.
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. No public exploit code and no CISA KEV listing are present; EPSS places exploitation probability at 0.24% (15th percentile), consistent with a low-priority but broadly applicable patch.
DevTools Missing Authorization in Google Chrome prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers who socially engineer victims into performing specific UI interactions. The CWE-862 root cause indicates the DevTools component lacks proper authorization checks on certain UI-driven data access paths, allowing an attacker-controlled page to extract information the browser context holds. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.15% at the 5th percentile confirms minimal near-term exploitation probability despite the C:H CVSS impact rating.
Site isolation bypass in Google Chrome's Speech component allows an attacker who has already established a foothold in the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65 across all platforms covered by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis, EPSS probability is very low at 0.20% (10th percentile), and the vulnerability is not listed in CISA KEV - however its value as a second-stage exploit in a browser attack chain elevates practical concern above the low CVSS score alone.
Incorrect authorization in Google Chrome's Web Authentication subsystem (Passkeys and Security Keys) allows a remote attacker to bypass the web origin policy by inducing a user to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop platforms are affected. The impact is limited to partial confidentiality - origin policy bypass could expose authentication context or credential associations across origins - with no integrity or availability impact confirmed.
Chrome's FileSystem API prior to version 152.0.7977.65 improperly handles case sensitivity when enforcing access restrictions, enabling a remote attacker to bypass system-level file access controls via a crafted HTML page delivered through social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms a network-reachable, unauthenticated path with high integrity impact, though the mandatory user interaction requirement limits mass exploitation. No public exploit has been identified at time of analysis, and an EPSS of 0.33% at the 26th percentile reflects limited observed exploitation activity.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits incomplete cleanup (CWE-459) in the SiteIsolation component, enabling a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin process separation via a crafted HTML page. This is a chained, second-stage attack - the CVSS score of 3.1 (Low) and EPSS of 0.28% (20th percentile) reflect the high prerequisite bar of a prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in Google Chrome's Network component prior to version 152.0.7977.65 allows a remote, unauthenticated attacker to bypass the browser's web origin policy by delivering a crafted HTML page to a victim. The bypass yields limited confidentiality exposure, consistent with the CVSS C:L rating, and requires the target user to interact with attacker-controlled content. No public exploit code has been identified and EPSS stands at 0.19% (8th percentile), indicating low current exploitation probability despite the broad deployment footprint of Chrome.
Web origin policy bypass in Google Chrome's cache component affects all versions prior to 152.0.7977.65, exploitable by a remote unauthenticated attacker who tricks a user into visiting a crafted HTML page. The incorrect reference resolution (CWE-706) in the cache layer allows cross-origin data to be read, constituting a Same-Origin Policy bypass with limited confidentiality impact. No active exploitation is confirmed and EPSS sits at 0.20% (10th percentile), indicating low real-world exploitation pressure at this time.
Incorrect authorization in Chrome's ServiceWorker component (CWE-863) allows remote unauthenticated attackers who can socially engineer a user into installing a crafted Chrome extension to bypass the web origin policy, resulting in limited cross-origin data exposure. All Chrome releases prior to 152.0.7977.65 are affected across platforms; a vendor patch is available. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) indicates very low current exploitation probability, consistent with the absence of a CISA KEV listing.
Incorrect authorization in Chrome's Editing component (prior to 152.0.7977.65) permits remote attackers to read sensitive information by enticing a user to visit a specially crafted HTML page. The flaw (CWE-863) affects all Chrome versions across all platforms below the fixed release, with a high confidentiality impact but no integrity or availability consequence. No public exploit code or active exploitation is confirmed; EPSS stands at 0.36% (28th percentile), indicating low real-world exploitation probability at time of analysis.
Missing authorization in Google Chrome's Network component prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions with high integrity impact by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-reachable exploitation requiring no attacker-side privileges, though a single user interaction gates the attack. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.23% (13th percentile) reflects low observed exploitation probability despite broad product exposure.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process - and further leverages social engineering - to circumvent Chrome's cross-origin security boundary via a crafted HTML page, resulting in limited confidentiality exposure. The flaw resides in the SiteIsolation authorization logic (CWE-863), meaning Chrome fails to correctly validate whether a renderer process is permitted to access data belonging to a different origin. With an EPSS of 0.23% (13th percentile) and no CISA KEV listing, real-world exploitation probability is low; the dual prerequisite of a pre-existing renderer compromise plus social engineering substantially raises the attack bar beyond what the low CVSS score alone conveys.
Web origin policy bypass in Google Chrome's StorageAccessAPI enables an attacker who has already compromised the renderer process to exfiltrate cross-origin storage data via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The vulnerability is rated medium severity (CVSS 4.3) and requires both user interaction and a pre-existing renderer compromise, making it a second-stage chained exploit component rather than a standalone initial access vector. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
Race condition in Google Chrome's Workers implementation before version 152.0.7977.65 allows a remote attacker to bypass system access restrictions, resulting in high integrity impact. Exploitation requires a victim to visit a crafted HTML page, placing this in the social-engineering-dependent threat category. No public exploit has been identified, and the EPSS score of 0.19% (9th percentile) indicates negligible observed exploitation in the wild at time of analysis.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to exfiltrate sensitive information by luring a user to a crafted HTML page. The flaw (CWE-863) bypasses DOM-level permission checks, resulting in High confidentiality impact with no integrity or availability consequences. No public exploit has been identified at time of analysis, and EPSS at 0.36% (28th percentile) indicates minimal observed exploitation pressure despite the patch now being available from Google.
Incorrect authorization in Google Chrome's Network subsystem (all versions before 152.0.7977.65) permits remote unauthenticated attackers to bypass system access restrictions by inducing a user to visit a crafted HTML page. Classified as CWE-863, the flaw allows a limited integrity violation against the affected system without confidentiality or availability impact. No public exploit has been identified at time of analysis, and the low EPSS score (0.38%, 31st percentile) indicates minimal current exploitation pressure.
Improper input validation in Google Chrome's Safebrowsing component prior to version 152.0.7977.65 allows remote attackers to bypass system access restrictions via a crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is network-reachable without authentication but requires user interaction, constraining opportunistic or automated exploitation at scale. EPSS at 0.22% (12th percentile) and absence from CISA KEV indicate low real-world exploitation probability at time of analysis; no public exploit code has been identified.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to cross origin security boundaries via a crafted HTML page, resulting in limited cross-site data disclosure. The flaw is an incorrect authorization check (CWE-863) in Chrome's SiteIsolation subsystem - a defense-in-depth mechanism that keeps different origins in separate OS processes. No public exploit has been identified and EPSS stands at 0.38%, consistent with the high prerequisite of prior renderer compromise; this vulnerability is not listed in CISA KEV.
Site isolation boundary bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read cross-origin data via a crafted PDF file. This is a chained, second-stage attack technique - not a standalone exploit - requiring renderer process compromise as a hard prerequisite before the missing authorization check (CWE-862) in SiteIsolation becomes actionable. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.35% (27th percentile) aligns with the complex prerequisites that suppress widespread exploitation.
Site Isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin boundary enforcement and access a privileged page via a crafted HTML page. This is a chaining vulnerability rather than a standalone exploit - it requires a pre-existing renderer compromise (typically from a separate, higher-severity CVE) before the SiteIsolation authorization flaw can be leveraged. No public exploit code has been identified and EPSS at 0.27% (19th percentile) reflects low standalone exploitation probability, though this class of flaw is historically weaponized as a second stage in full browser sandbox escape chains.
Web origin policy bypass in Google Chrome's Preload component (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a specially crafted HTML page. Classified as CWE-20 (Improper Input Validation) with a vendor-assigned CVSS score of 4.3 (Medium), the vulnerability is a second-stage attack primitive rather than a standalone exploit - requiring prior renderer compromise as a hard prerequisite. No public exploit code or active exploitation has been confirmed at time of analysis; Google has released a fix in Chrome 152.0.7977.65.
Missing authorization in Google Chrome's BFCache (Back/Forward Cache) component allows a remote attacker who has already compromised the renderer process to bypass system access restrictions via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. The integrity impact is rated High, enabling unauthorized writes or modifications to protected resources beyond the renderer sandbox. EPSS is low at 0.38% (31st percentile), and no active exploitation or public POC has been identified, but the vulnerability is noteworthy as a sandbox-escape primitive in a chained attack.
Chrome's FileSystem API implementation prior to version 152.0.7977.65 contains incorrect authorization logic (CWE-863) that permits a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page via social engineering. The bypass produces a limited integrity impact - unauthorized write or access to filesystem-restricted resources - with no confidentiality or availability consequence per the CVSS vector (I:L, C:N, A:N). No public exploit code exists and the vulnerability is absent from CISA KEV; EPSS of 0.27% (19th percentile) reflects low near-term exploitation probability.
Incorrect authorization in Google Chrome Mobile on iOS (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw stems from improper authorization enforcement (CWE-863) within the iOS-specific mobile browser code path, permitting limited integrity violations without confidentiality or availability impact. No public exploit has been identified and EPSS sits at a low 0.23% (13th percentile), consistent with a medium-severity, user-interaction-dependent issue not yet seeing active targeting.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits a missing authorization flaw (CWE-862) in the Lighthouse auditing component, allowing an attacker who has already achieved renderer process compromise to cross site isolation boundaries and access limited cross-origin data. The attack chain requires high complexity - a pre-compromised renderer plus active social engineering - making this a second-stage vulnerability in a chained exploit rather than an independently weaponizable flaw. No public exploit code exists and no CISA KEV listing has been identified; EPSS at 0.32% (24th percentile) corroborates the low priority for standalone exploitation.
Web origin policy bypass in Google Chrome's Loader component (all versions prior to 152.0.7977.65) enables remote unauthenticated attackers to read limited cross-origin data by luring a user to a crafted HTML page. The flaw stems from incorrect authorization (CWE-863) in how the Loader enforces origin boundaries, allowing an attacker-controlled page to extract content from another origin the victim is browsing. EPSS is 0.34% (26th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, placing this in the lower tier of active exploitation risk despite broad product prevalence.
Improper access control in Chrome's Workers subsystem allows a remote unauthenticated attacker to bypass the web origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin data leakage. Affected versions span all Chrome releases prior to 152.0.7977.65 across desktop platforms. No public exploit identified at time of analysis and EPSS probability stands at 0.24% (15th percentile), indicating this is a low-urgency but real boundary-enforcement gap in the browser's sandboxing model.
Incorrect reference resolution in Google Chrome's Passwords feature (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by delivering a crafted file that a user must open. The integrity impact is limited (CVSS I:L), and no confidentiality or availability loss is indicated. With EPSS at 0.36% (29th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low despite the network-accessible attack vector.
Incorrect authorization in Chrome's Network component allows remote unauthenticated attackers to bypass system access restrictions via a crafted HTML page, resulting in low-integrity impact. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS at 0.23% (13th percentile) reflects low real-world exploitation probability; a vendor patch has been issued in the stable channel.
Missing authorization in the Payments component of Google Chrome on Android (prior to 152.0.7977.65) allows remote attackers to potentially bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw is classified as CWE-862 and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to integrity. No public exploit code has been identified at time of analysis, and EPSS scoring of 0.32% (24th percentile) indicates statistically low exploitation probability at scale.
Origin policy bypass in Google Chrome prior to 152.0.7977.65 exposes users to potential cross-site data leakage when a victim visits an attacker-controlled page. The Network component fails to properly validate input (CWE-20), enabling circumvention of the browser's web origin policy - a fundamental Same-Origin Policy enforcement mechanism - allowing a remote attacker to read data from origins other than the page's own. No public exploit has been identified and EPSS stands at 0.24% (15th percentile), indicating low current exploitation probability, though Chrome's ubiquitous global deployment amplifies the aggregate exposure.
Missing authorization in Google Chrome's HTTP/2 implementation prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers via crafted network traffic. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication is required but high attack complexity, consistent with a need for specific network positioning or traffic crafting. No public exploit code or active exploitation has been identified; EPSS at 0.20% (10th percentile) confirms low current exploitation probability.
Safebrowsing in Google Chrome prior to 152.0.7977.65 fails to properly validate input from crafted files, permitting remote attackers to bypass system access restrictions that the component is designed to enforce. The attack requires user interaction - specifically opening a crafted file - and results in limited integrity impact with no confidentiality or availability compromise. No public exploit code or CISA KEV listing has been identified; EPSS exploitation probability is very low at 0.22% (12th percentile), consistent with the Chromium team's Medium severity classification.
Origin policy bypass in Google Chrome's Editing component (prior to 152.0.7977.65) requires an attacker who has already compromised the renderer process to additionally leverage social engineering against the user via a crafted HTML page. Successful exploitation leaks limited cross-origin data by circumventing the same-origin policy through improper input validation in the editing subsystem. No public exploit code exists and EPSS sits at the 15th percentile, indicating low near-term exploitation probability; no active exploitation confirmed by CISA KEV.
Incorrect authorization in Chrome's WebAppInstalls component on Android (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. The flaw (CWE-863) results in a low-integrity impact with no confidentiality or availability consequence, consistent with CVSS 4.3 Medium. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS of 0.24% (15th percentile) signals low current exploitation interest.
Missing authorization in Google Chrome's Network component, prior to version 152.0.7977.65, allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by serving a crafted HTML page to a user. This is effectively a second-stage sandbox-bypass vulnerability requiring a pre-compromised renderer as a prerequisite, making it a chained exploit component rather than a standalone critical flaw. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.23% (13th percentile), consistent with low near-term exploitation probability. A vendor patch is available in stable channel release 152.0.7977.65.
Incorrect authorization in the TabGroups feature of Google Chrome prior to 152.0.7977.65 allows a remote attacker to leak sensitive browser information by serving crafted network traffic to a victim user. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser fails to properly enforce access control within tab group contexts, and was rated Medium severity by the Chromium security team. No public exploit identified at time of analysis, and an EPSS of 0.20% at the 10th percentile confirms very low observed exploitation activity.
Chrome's Network subsystem before version 152.0.7977.65 allows remote attackers to bypass the browser's web origin policy due to improper initialization (CWE-665), exploitable via a crafted HTML page that requires user interaction. The impact is limited to partial confidentiality disclosure (C:L), with no integrity or availability consequences, and the CVSS score of 4.3 (Medium) aligns with EPSS exploitation probability of 0.36% (29th percentile). No public exploit code or CISA KEV listing exists at the time of analysis; a vendor patch is available in the stable channel.
Incorrect authorization in Google Chrome's WebProtect component before version 152.0.7977.65 allows a remote, unauthenticated attacker to exfiltrate sensitive information by directing a user to a specially crafted HTML page. The flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H) and no integrity or availability impact, scoped entirely within the browser process. No public exploit is identified at time of analysis, and the EPSS score of 0.27% (19th percentile) indicates low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Missing authorization in Chrome's CustomTabs feature on Android exposes sensitive browser information to co-installed malicious applications on versions prior to 152.0.7977.65. The vulnerability stems from CWE-862 (Missing Authorization), meaning Chrome does not properly verify whether a companion app is permitted to access data surfaced through the CustomTabs interface. No public exploit code or active exploitation has been identified; EPSS sits at the 6th percentile, confirming low real-world exploitation probability despite the High confidentiality impact in the CVSS vector.
Web origin policy bypass in Google Chrome's WebRTC component (prior to 152.0.7977.65) enables a network-positioned attacker who has already compromised the renderer process to cross same-origin boundaries via a crafted HTML page requiring user interaction. This is a chained exploitation step - not a standalone critical flaw - making it most relevant as a second-stage component in a targeted multi-stage browser exploit. No public exploit code exists and EPSS of 0.28% at the 20th percentile is consistent with no observed opportunistic exploitation; the vulnerability is not listed in CISA KEV.