Chrome
Monthly
Integer overflow in Google Chrome's Editing component (CWE-190) lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page potentially execute arbitrary code, though the vendor states the resulting execution is confined to the Chromium sandbox. All Chrome builds prior to 156.0.8078.79 are affected; the flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and a Chromium security severity of High. No public exploit code has been identified at time of analysis and EPSS is low at 0.20% (10th percentile), while SSVC rates technical impact as total but exploitation as none and automatable as no, placing it in a 'this_week' remediation queue rather than an emergency.
Remote code execution inside the Chrome renderer sandbox affects Google Chrome builds prior to 156.0.8078.79, where memory corruption in the DOM lets a crafted HTML page execute arbitrary code. Attackers must convince a victim to load attacker-controlled HTML (UI:R) and need no credentials, but the impact is confined to the sandboxed renderer unless a separate sandbox-escape vulnerability is chained. No public exploit identified at time of analysis; the issue is not in CISA KEV, and an EPSS score of 0.20% (10th percentile) indicates low predicted exploitation.
Memory corruption in the V8 JavaScript engine of Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. User interaction is mandatory and the resulting code execution is sandbox-contained, so compromising the host would require an additional sandbox-escape flaw; the CVSS 3.1 score is 8.8 with C:H/I:H/A:H. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.73; the priority is this week, not an emergency.
Improper input validation in Google Chrome's command handling component can let a remote attacker potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, affecting desktop Chrome builds prior to 156.0.8078.73. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code has been identified at time of analysis, while EPSS is low at 0.21% (11th percentile) and Chromium rates the flaw High; per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) no authentication is required but the victim must interact with attacker-controlled content, and the resulting impact crosses a security boundary (S:C). Despite the modest EPSS figure, the vendor patch is available and the exposure combines a sandbox-escape-class impact with trivial remote delivery, so this warrants prompt remediation.
Memory corruption in the Skia graphics library shipped in Google Chrome before 156.0.8078.73 allows a remote attacker to achieve code execution inside the renderer sandbox when a victim loads a crafted HTML page. Affected users are those running Chrome builds prior to 156.0.8078.73; exploitation requires user interaction (CVSS UI:R, PR:N, AV:N), and the impact is confined to the renderer sandbox rather than host-level compromise. No public exploit is identified at time of analysis, and EPSS/KEV signals were not provided; the vendor classifies the issue as Chromium security severity High.
Arbitrary code execution inside the Chrome sandbox can be triggered in Google Chrome builds prior to 156.0.8078.73 by a crafted HTML page that exploits a memory-corruption flaw in the Payments component. The CVSS score of 8.8 reflects high confidentiality and integrity impact, but exploitation requires user interaction (UI:R) and the code execution is scoped to inside the sandbox, so host compromise would require an additional sandbox escape. No public exploit or active exploitation is identified at time of analysis, and Google has released a fixed build.
Improper input validation in Chrome's ReadingList component (fixed in 156.0.8078.73) lets a remote attacker who convinces a victim to open a crafted HTML page run arbitrary code inside the renderer sandbox. No authentication or prior privileges are needed, but user interaction is mandatory and the impact is confined to the sandbox - escaping to the host would require chaining a separate sandbox-escape flaw. No public exploit code or CISA KEV entry is reported, and the vendor considers the issue High severity in Chromium; the practical risk is real but not a drop-everything emergency given the sandbox boundary and the fact that a fixed build is already available.
A use-after-free (CWE-416) in Chromium's Animation component affects Google Chrome builds prior to 156.0.8078.73; a remote attacker who convinces a victim to load a crafted HTML page can trigger the memory-corruption condition and execute arbitrary code inside the browser sandbox. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality and integrity impact but requiring user interaction and remaining confined to the renderer sandbox until a separate sandbox escape is chained. There is no CISA KEV listing and no confirmed public exploit code in the supplied intelligence; a Chromium issue tracker reference exists but is not verified as working exploit code, and Google rates the flaw High with a vendor patch already released.
Improper input validation in the Metrics component of Google Chrome for macOS allows remote code execution inside the browser sandbox when a victim opens a crafted HTML page in any build prior to 156.0.8078.73. The attack is unauthenticated and network-delivered (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but it is gated on user interaction and confined to the renderer sandbox - escaping to the host would require a separate, distinct sandbox-escape flaw that is not described here. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-urgency, patch-this-week item rather than a drop-everything emergency; a vendor patch (156.0.8078.73) is available.
A use-after-free in Chrome's ImageCapture component lets remote attackers who convince a victim to open a crafted HTML page execute arbitrary code - but, per the advisory, that execution is confined to the renderer sandbox rather than the host. Chrome builds prior to 156.0.8078.73 are affected and the vendor has released a fix; exploitation requires user interaction (CVSS UI:R) with no authentication or special configuration needed. No public exploit or active exploitation is identified in the supplied data, and the assessed priority places remediation in the near-term 'this week' window rather than emergency status, because host compromise would additionally require a separate sandbox-escape flaw.
Memory corruption in Google Chrome's Media component can let a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting Chrome releases prior to 156.0.8078.73. Exploitation requires user interaction and, with scope unchanged, is limited to renderer-process compromise rather than full host takeover unless combined with a separate sandbox escape. No public exploit identified at time of analysis; the vendor has released a fixed build, and this is a high-priority patch item rather than a drop-everything emergency.
Memory corruption in Chrome's HTML handling lets a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome desktop builds prior to 156.0.8078.73. The CVSS vector shows unauthenticated network delivery (PR:N, AV:N) but requires the user to navigate to the attacker's page (UI:R), and the description scopes any code execution to the sandbox (S:U), so full host compromise would need a separate sandbox escape. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and Google rates the issue Chromium security severity High with a vendor fix already published in 156.0.8078.73.
Sandbox-escaping remote code execution in Google Chrome's V8 JavaScript engine allows an attacker who gets a victim to load a crafted HTML page to run arbitrary code outside the browser sandbox, at host privilege level rather than merely in-page. All Chrome builds prior to 156.0.8078.73 on the stable channel are affected, and no authentication is required, though exploitation depends on the victim navigating to or rendering the attacker-controlled page (UI:R), so delivery hinges on phishing, malvertising, or a compromised or attacker-hosted site rather than autonomous network propagation. Google rates the Chromium severity High and the CVSS v3.1 vector scores 9.6 with a scope change; at the time of analysis EPSS is low at 0.21% (11th percentile) and there is no CISA KEV listing, and no public exploit identified at time of analysis, although the vuln.today decision label is act_now given the sandbox-escape impact and the availability of a vendor fix.
Improper input validation in SVG handling in Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Successful exploitation is gated by mandatory user interaction - the victim must open the attacker-supplied page in a vulnerable build - and the resulting code execution is confined to the Chrome sandbox, so full host compromise requires an additional, separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis and the flaw does not appear on CISA KEV; EPSS is 0.21% (11th percentile), and Google rates the Chromium security severity as High with a fix already shipped in the stable channel.
Improper input validation in the UI layer of Google Chrome for Android before 156.0.8078.73 allows remote attackers to achieve code execution inside the browser sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) but no authentication (PR:N), and impact is contained to the sandbox rather than the underlying Android OS, so full device compromise would need a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low (0.22%, 13th percentile); Google rates the issue High severity and has released a patched build.
Use-after-free in Google Chrome's SVG handling lets a remote attacker who gets a victim to open a crafted HTML page run arbitrary code outside the browser sandbox, affecting Chrome builds prior to 156.0.8078.73. Exploitation needs no authentication or privileges (CVSS PR:N) and no special configuration, since it involves default SVG rendering; the only gate is the required user interaction of loading the page (UI:R), while the changed scope plus high confidentiality, integrity and availability impact give CVSS 9.6 / Chromium severity High. Google has published a fixed build in the stable channel and the priority assessment is act_now; EPSS is modest at 0.22% (13th percentile), the CVE is not in CISA KEV, and no public exploit has been identified at time of analysis.
Memory corruption in Google Chrome's FileSystem component before 156.0.8078.73 can let a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim opens or is navigated to a crafted HTML page. Exploitation requires that user interaction and an unpatched desktop build; the vendor has released 156.0.8078.73 as the fix, and the issue is rated Critical (CVSS 9.6) and prioritized act_now. EPSS is 0.24% (15th percentile); no public exploit code or KEV confirmation is present in the available data.
Memory corruption in Google Chrome's Scroll component affects desktop builds prior to 156.0.8078.47 and lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The user-interaction requirement (UI:R) is the main limiting factor: the attack is not self-propagating and depends on the target navigating to malicious or compromised content, after which the injected code runs only within Chrome's sandboxed renderer process - realistic host compromise would additionally require chaining a separate sandbox-escape flaw. The vendor has shipped a fixed build (156.0.8078.47); no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis, and no EPSS score was supplied to refine the likelihood estimate.
Use-after-free in Google Chrome's Extensions component (versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to open a crafted HTML page corrupt memory and execute arbitrary code inside the renderer sandbox, and can additionally crash the browser. Exploitation is not passive: it requires the target to load attacker-controlled web content, and because the CVSS scope is Unchanged, code execution stays confined to the sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though Chrome renderer memory-corruption bugs are historically attractive to exploit developers; the risk picture is mixed, with Chromium's own severity rating of Medium sitting well below the 8.8 CVSS score derived from the high confidentiality and integrity impact.
Arbitrary code execution inside the Chrome renderer sandbox affects Google Chrome versions prior to 156.0.8078.47 due to improper input validation in the Views component. A remote attacker can exploit the flaw by convincing a user to load a crafted HTML page; the attack requires user interaction (UI:R) but no authentication or privileges (PR:N). The vendor has released a patch, and the impact is contained by the sandbox (S:U), so this flaw alone does not compromise the host OS - it is a high-priority patch candidate rather than an emergency, and no public exploit identified at time of analysis.
Memory corruption in the WebAppInstalls component of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a user to load a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) confirms no privileges are required but victim interaction is mandatory, and the vendor's own 'inside the sandbox' qualifier means host-level compromise would additionally require a separate sandbox escape. No public exploit code or CISA KEV entry is associated with this CVE in the available intelligence, so it is a hardening/patch-priority item rather than a confirmed active threat; a vendor fix exists in Chrome 156.0.8078.47.
Memory corruption in Google Chrome's FullScreen component before version 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction to navigate to attacker-controlled content, and no public exploit was identified at time of analysis. The CVSS base score is 8.8, but realistic host compromise is limited unless the sandbox is separately escaped; Chromium rates the security severity as Low.
Memory corruption in Google Chrome's Core component before version 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction but no credentials, and the vendor rates the issue Chromium severity Low because the resulting code execution is confined to the renderer sandbox rather than the host OS. No public exploit code has been identified at time of analysis.
Memory corruption in Google Chrome's Accessibility implementation before version 156.0.8078.47 lets remote attackers execute arbitrary code at Chrome's sandbox privilege level by convincing a victim to open a crafted HTML page. Unauthenticated attackers can trigger the flaw through normal browsing, and because code execution is confined to the renderer sandbox, achieving host-level compromise requires chaining a separate sandbox-escape vulnerability. Google rates this Critical (Chromium severity) with a CVSS of 8.8; a vendor patch is available and no public exploit has been identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the ReadingMode component of Google Chrome builds prior to 156.0.8078.47, triggered when a victim opens a crafted HTML page. The flaw is unauthenticated from the network perspective but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and Google's own Chromium severity rating for this issue is Low - a sharp conflict with the 8.8 base score that materially changes how the risk should be weighed. Because the description confines the code execution to the sandbox, a complete host compromise would require chaining a separate sandbox-escape bug that this CVE does not supply; no public exploit was identified at the time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
Memory corruption in the BrowserTag component of Google Chrome before 156.0.8078.47 lets a remote attacker who convinces a victim to load a crafted HTML page corrupt memory within the renderer and potentially execute arbitrary code inside the browser sandbox; no credentials or privileges are required, only that the victim renders the page (CVSS PR:N/UI:R). The resulting code execution is scope-limited to the sandbox - escaping to the host requires a separate sandbox-escape bug not covered by this CVE - which is why Google rates the Chromium security severity Low even though the generic CVSS base score computes to 8.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and Chrome's silent auto-update mechanism shortens the exposure window on default desktop installations. Signals are mixed and must be weighed carefully: the numeric severity is high while the practical post-exploitation impact is constrained by the sandbox.
Remote code execution inside Chrome's renderer sandbox on Android is possible via memory corruption in ANGLE, the browser's graphics translation layer, when a victim running Google Chrome prior to 156.0.8078.47 loads a crafted HTML page. Exploitation requires user interaction, since the victim must navigate to or open the malicious page, and does not require authentication, but successful code execution stays within Chrome's renderer sandbox, so device-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Improper input validation in Chrome's Extensions component allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox in Google Chrome desktop builds prior to 156.0.8078.47, triggered when a victim renders a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not zero-click: the UI:R metric and the 'crafted HTML page' wording confirm the user must actively visit or load attacker-controlled content, and the resulting code execution is contained within the browser sandbox unless chained with a separate sandbox-escape flaw. No public exploit code has been identified at the time of analysis, there is no CISA KEV listing, and EPSS is low at 0.30% (22nd percentile), so real-world priority is moderate even though vendor-released patch 156.0.8078.47 is available.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 (Critical), driven by the scope change reflecting a sandbox escape, although Chromium rates the flaw Medium and the vendor describes code execution outside the sandbox as potential. Exploitation requires user interaction to load the crafted page; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome's Extensions component before 156.0.8078.47 lets unauthenticated remote attackers potentially execute arbitrary code inside the Chrome sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R), and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining with a separate sandbox escape. No public exploit was identified at time of analysis, but the vendor has released a fixed build and the issue should be treated as a high-priority patch item.
Use-after-free in Google Chrome's Permissions component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page on any Chrome build prior to 156.0.8078.47. No authentication or privileges are required, though exploitation is not zero-click (UI:R) and the resulting code execution is contained within the Chrome sandbox - full host compromise would require chaining a separate sandbox-escape flaw. Chromium rates the bug Low severity, but the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Memory corruption in Google Chrome's DevTools component (versions prior to 156.0.8078.47) allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim opens an attacker-crafted HTML page. No authentication is required, but exploitation hinges on user interaction (UI:R), and because the CVSS scope is unchanged (S:U), the impact is confined to the renderer sandbox rather than a full host compromise - chaining a separate sandbox escape would be required to break out. Signals conflict and must be read together: NVD-style scoring is 8.8 while Google rates the Chromium security severity as Low, no public exploit code was identified at time of analysis, there is no CISA KEV entry, and the vendor has released a fixed build (156.0.8078.47).
Sandbox-confined code execution in Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page trigger improper input validation in the browser's UI layer and potentially run arbitrary code inside the renderer sandbox. No privileges are required (PR:N), but the attacker cannot act without the victim actively loading the page (UI:R), and any code that does run is contained by Chrome's sandbox - escaping to the host would require a separate, unrelated sandbox-escape flaw. The issue carries a notably conflicting risk profile: the raw 8.8 base score contrasts with Google's 'Low' Chromium severity rating and with our assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, and no public exploit has been identified at time of analysis even though the fix is already shipping.
Use-after-free in the Chromecast component of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who persuades a victim to open a crafted HTML page potentially execute arbitrary code - but only inside the browser sandbox, as confirmed by the vendor's own wording. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a high-confidentiality and high-integrity impact that requires user interaction; there is no fully drive-by, zero-interaction path, and no public exploit code or CISA KEV entry was identified at time of analysis. Because code execution stays within the sandbox, host compromise would require a separate sandbox-escape primitive, which is the main factor capping real-world impact.
Memory corruption in ANGLE, Chrome's WebGL/graphics translation layer, lets remote attackers potentially achieve arbitrary code execution inside the renderer sandbox on Chrome builds prior to 156.0.8078.47 by convincing a victim to load a crafted HTML page. The bug is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-119), with the mandatory user-interaction requirement and unchanged sandbox scope being the main constraints - full host compromise would require chaining a separate sandbox-escape flaw. Google has released a fixed build, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a high-priority patch item rather than a drop-everything emergency.
Memory corruption in Chrome's Search component lets a remote, unauthenticated attacker achieve code execution inside the browser sandbox when a victim simply loads a crafted HTML page in any Chrome build prior to 156.0.8078.47 (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High). Because the flaw is explicitly scoped to code execution 'inside the sandbox', it does not by itself grant host-level compromise and would need to be chained with a separate sandbox escape for full system takeover, though an in-sandbox primitive already exposes credentials, session data, and files reachable by the renderer. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Google has shipped a vendor patch and the required user interaction (a single page visit) keeps the practical bar to exploitation low for targeted campaigns.
Use-after-free in Google Chrome's Loader component before 156.0.8078.47 allows an unauthenticated remote attacker who persuades a victim to load a crafted HTML page to execute arbitrary code inside the renderer sandbox. Exploitation requires user interaction (UI:R) and no special configuration, but the impact is bounded by Chrome's sandbox; full host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and Google rates the issue Chromium severity Low despite the 8.8 CVSS score.
Memory corruption in the DevTools component of Google Chrome desktop builds prior to 156.0.8078.47 allows a remote attacker who convinces a victim to open a crafted HTML page to run arbitrary code within the browser sandbox. Although Google rates the Chromium security severity as Low, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8 because successful exploitation yields high confidentiality, integrity and availability impact inside the sandboxed renderer; no authentication is needed but user interaction (opening the page) is required. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is tempered by the need for a separate sandbox-escape chain to reach the host.
Use-after-free in Google Chrome's ContextualSearch component (all versions prior to 156.0.8078.47) allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a low-complexity, network-reachable flaw whose only prerequisite is victim navigation; however, per the vendor description, the resulting code execution is confined to the renderer sandbox, so host-level compromise requires a separate sandbox-escape vulnerability. Chromium rates this a Medium-severity issue, no public exploit code was identified at time of analysis, and it is not listed in CISA KEV.
A use-after-free in ANGLE, the graphics translation layer behind Chrome's WebGL and hardware-accelerated canvas rendering, lets a crafted HTML page corrupt renderer memory and achieve arbitrary code execution inside the browser sandbox in Google Chrome builds prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled web content that exercises WebGL paths, and no non-default configuration is needed - the component is enabled by default. Multiple signals align toward genuine priority with one important nuance: code execution is confined to the renderer sandbox, so host compromise would require chaining a separate sandbox escape. At time of analysis, no public exploit code and no confirmed active exploitation (CISA KEV) were identified, though the 8.8 CVSS and RCE-class tagging warrant prompt patching.
Memory corruption in the WebAppInstalls component of Google Chrome for Android before 156.0.8078.47 can be triggered when a user opens an attacker-crafted HTML page, potentially allowing remote code execution outside the browser sandbox. No authentication is required, but exploitation depends on user interaction, is limited to Android builds below the fixed version, and our assessment applies AC:H despite the mechanical 9.6 CVSS score. No public exploit has been identified at time of analysis, and Google rates the Chromium issue Low, so the conflicting severity signals should be reconciled before treating this as a high-urgency RCE campaign.
Memory corruption in Chrome's SiteIsolation component lets a remote attacker who convinces a user to open a crafted HTML page potentially execute arbitrary code inside the browser sandbox on Chrome builds prior to 156.0.8078.47. Exploitation is not silent or wormable: the CVSS vector AV:N/AC:L/PR:N/UI:R means no credentials are needed but victim interaction is mandatory, and the vendor scopes the outcome to code execution 'inside the sandbox,' so full host compromise would require chaining a separate sandbox-escape flaw. Google rates the underlying bug Medium severity while the derived CVSS base score is 8.8; no public exploit code or active exploitation is identified in the available intelligence at time of analysis, and a vendor patch (156.0.8078.47) is already published.
Memory corruption in the SignIn component of Google Chrome releases prior to 156.0.8078.47 lets a remote, unauthenticated attacker potentially execute arbitrary code - but only inside the renderer sandbox - after convincing a victim to open a crafted HTML page. Google's Chromium team rated this 'Low' severity even though the CVSS 3.1 base score is 8.8, because the corruption yields in-sandbox code execution and host compromise would require chaining a separate sandbox escape. No public exploit code has been identified and the issue is not in CISA KEV, although the vendor has already shipped a fixed build; the conflict between the high numeric score and the Low vendor rating is the main judgement call for prioritisation.
Origin-policy bypass in Google Chrome before 156.0.8078.47 can let a remote attacker use a crafted HTML page to make unauthorized cross-origin accesses after the victim visits the page. The flaw is a missing authorization check in Chrome's Animation component (CWE-862); it affects default installations and requires user interaction, with no authentication needed. There is no evidence of active exploitation and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), and Google has released 156.0.8078.47 as the fixed build.
Memory corruption in Google Chrome's PolicyContainer component affects desktop builds prior to 156.0.8078.47 and can allow a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires the target to actively visit attacker-controlled content (CVSS UI:R, PR:N), and while the vector scores 9.6 because the scope change pushes confidentiality, integrity, and availability impact to High, Chromium's own 'Medium' severity rating and the description's 'potentially' indicate weaponization is non-trivial. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Memory corruption in the DevTools component of Google Chrome desktop builds prior to 156.0.8078.47 allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the Chrome renderer sandbox by convincing a victim to open a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). The required user interaction and the fact that execution is confined within the sandbox - no sandbox escape or host compromise was demonstrated - are the key limiting factors, which is why Chromium assigned this a security severity of Low despite the high base score. No public exploit code or confirmed active exploitation was identified in the available intelligence, and EPSS data was not provided, so real-world risk should be treated as contextual rather than demonstrated; signals conflict and must be weighed carefully, since the high CVSS and RCE tag coexist with a Low vendor severity and sandbox confinement. Fixed builds are available from the vendor in Chrome 156.0.8078.47 and later.
Memory corruption in Google Chrome's DataTransfer component can potentially allow a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page in a build prior to 156.0.8078.47. The CVSS 8.8 rating reflects high confidentiality and integrity impact, but exploitation requires user interaction (UI:R) and does not by itself escape the renderer sandbox (S:U), so host-level compromise would require a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and Google has released a fixed build, 156.0.8078.47.
Use-after-free in Google Chrome's Extensions subsystem enables remote code execution inside the renderer sandbox when a victim opens attacker-controlled crafted HTML, affecting desktop builds prior to 156.0.8078.47. The attack is unauthenticated over the network but requires user interaction (CVSS UI:R), and because the scope is unchanged (S:U), the code execution is contained by the browser sandbox - full host compromise would need a separate sandbox escape. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) on record; risk is moderated by Chrome's auto-update cadence, since users already on 156.0.8078.47 or later are not exploitable.
Memory corruption in Google Chrome's Shadow DOM implementation allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting desktop Chrome builds prior to 156.0.8078.47. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact within the compromised renderer, but with unchanged scope and execution confined 'inside the sandbox,' full host compromise would require chaining a separate sandbox-escape flaw. Chromium's own security severity rating is Medium, Google has shipped a fixed build, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's Script component before 156.0.8078.47 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and works against default browser configurations, but the code execution is contained by the Chrome sandbox, so host compromise would require chaining a separate sandbox-escape flaw. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Memory corruption in Chrome's Frames component allows a remote attacker who convinces a victim to open a crafted HTML page to achieve arbitrary code execution inside the Chromium renderer sandbox. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires no authentication - the only real barrier is the mandatory user interaction of loading attacker-controlled frame content (CVSS UI:R). Google rates the issue High severity (Chromium) and lists it as fixed in the 156.0.8078.47 stable release; no public exploit code has been identified at time of analysis, and the practical impact is bounded by the sandbox, so full host compromise would require chaining with a separate sandbox-escape flaw.
Use-after-free in Google Chrome's SiteIsolation component before 156.0.8078.47 allows unauthenticated remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) and does not by itself escape Chrome's sandbox, so host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit identified at time of analysis, but the vendor has released a fixed build and the issue is rated High severity.
Improper input validation in Google Chrome's Omnibox on Android before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load or interact with a crafted HTML page. Exploitation requires user interaction (UI:R) and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining a separate sandbox-escape flaw. Google rates the Chromium severity as Medium and has shipped a fixed build (156.0.8078.47); no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so real-world priority is lower than the raw 8.8 CVSS score suggests.
Out-of-bounds read in Google Chrome's Focus handling prior to 156.0.8078.47 can be triggered by a crafted HTML page and may allow arbitrary code execution inside the renderer sandbox. The issue is remotely reachable without credentials but requires user interaction, since the victim must load attacker-controlled web content; CVSS 8.8 reflects high confidentiality and integrity impact with unchanged scope. No public exploit code or CISA KEV entry was identified at time of analysis, and Google has released Chrome 156.0.8078.47 to address it.
Memory corruption in Google Chrome's browser API handling allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation is unauthenticated from the network but requires user interaction, since the target must navigate to or render attacker-controlled content; successful abuse yields high confidentiality, integrity, and availability impact within the sandboxed renderer rather than at the host level. A vendor patch is available in 156.0.8078.47, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in Google Chrome's Interstitials component (versions prior to 156.0.8078.47) can allow remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and the unchanged scope indicates that host compromise would require chaining with a separate sandbox escape. No public exploit code has been identified at time of analysis, and Google has released a fixed version.
Memory corruption in Google Chrome for Android prior to 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) - navigating to attacker-controlled content - and the resulting code execution is confined to the renderer sandbox, so full device compromise would require a separate sandbox-escape vulnerability. Signals conflict sharply: the CVSS 3.1 score is 8.8 while Google assigns Chromium security severity Low, and no public exploit code or CISA KEV entry was identified at time of analysis; a vendor patch is available in 156.0.8078.47.
Memory corruption in Google Chrome's Compositing component allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page in desktop versions prior to 156.0.8078.47. User interaction is mandatory, and successful exploitation is confined to the sandbox, so host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit was identified at the time of analysis, and Google has released a patched version; the 8.8 CVSS score contrasts with Chromium's Medium severity rating because of the sandbox confinement.
Memory corruption in Google Chrome's Core component allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in any desktop build prior to 156.0.8078.47. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) reflects low-complexity exploitation gated only by the user-interaction requirement, with sandbox containment (S:U) meaning a standalone compromise yields renderer-level code execution rather than direct host takeover. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied in the source feed; Google rates the flaw Medium under its own Chromium severity scale, and a vendor patch is available.
Use-after-free in Google Chrome's V8 JavaScript engine (versions prior to 156.0.8078.47) allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is rated CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting network reachability, low complexity, no privileges, and required user interaction; code execution is confined to the sandbox, so OS compromise would require an additional sandbox escape. A vendor-released patch is available as version 156.0.8078.47, and no public exploit has been identified at time of analysis.
Remote code execution in Google Chrome's Proxy component (versions before 156.0.8078.47) stems from improper input validation that can be triggered when an unauthenticated remote attacker convinces a victim to load a crafted HTML page. Exploitation requires user interaction (UI:R) and yields code execution confined within the browser sandbox; no public exploit was identified at time of analysis.
Memory corruption in the Chrome FileSystem component allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 on desktop are affected, and because exploitation requires only a page visit (UI:R) with no privileges (PR:N), browsing-driven attacks are practical despite the medium rating Chromium assigned. Code execution is confined to the sandbox, so full host compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not provided.
Google Chrome builds prior to 156.0.8078.47 contain an improper input-validation weakness in the GPU component that allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox after a victim loads a crafted HTML page. Exploitation requires user interaction but no privileges, and the resulting code execution is confined to Chrome's sandbox unless chained with a separate sandbox-escape flaw. CVSS 3.1 scores this as 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, and it is not reported as actively exploited.
Memory corruption in Google Chrome's Paint rendering component can allow a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in a version prior to 156.0.8078.47. Exploitation is user-interaction-gated because the victim must visit or be redirected to attacker-controlled content, and the resulting code execution is confined to the renderer sandbox unless combined with a separate sandbox-escape flaw. No public exploit identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fixed version.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
Heap-based buffer overflow in Google Chrome's Animation component allows a remote attacker to execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page in any build prior to 155.0.8059.79. The bug carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication or special configuration is required, but exploitation depends on the user rendering attacker-controlled content, and because the scope is unchanged the resulting code execution is confined to the sandboxed renderer process rather than the host OS. No public exploit code and no confirmed active exploitation have been identified at time of analysis - CISA's SSVC evaluation rates Exploitation as 'none' - so this is a patch-promptly item rather than an emergency, with Google rating the issue High severity.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Information disclosure in the Permissions component of Google Chrome before 155.0.8059.39 allows a remote, unauthenticated attacker to bypass the browser's site-isolation boundary by luring a victim into loading a crafted HTML page. Exploitation requires user interaction (UI:R) - the target must visit attacker-controlled content - and the resulting impact is limited to leaking information across origins rather than code execution, data modification, or denial of service. A vendor fix is already available in 155.0.8059.39, there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating a low near-term exploitation likelihood.
Arbitrary code execution confined to Chrome's renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39, where an incorrect comparison in the font rendering pipeline can be triggered by a crafted HTML page. This is an unauthenticated remote attack (AV:N/PR:N) that requires the victim to load attacker-controlled web content (UI:R); the resulting code execution stays inside the renderer sandbox (S:U), and escaping to the host operating system requires a separate, unrelated sandbox-escape vulnerability - which is why Chromium assigned a Low security severity despite the CVSS 8.8 base score. No public exploit code was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Missing authorization in the Actor component of Google Chrome prior to 155.0.8059.39 allows code to escape the browser sandbox, but only after the attacker has already compromised the renderer process via a separate bug and then gets the victim to load a crafted HTML page. This prerequisite, combined with required user interaction (UI:R) and high attack complexity (AC:H) from the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector, means the flaw is only usable as a link in an exploit chain rather than as a standalone initial-access vector; the changed scope (S:C) and high confidentiality, integrity and availability impact reflect the potential for full code execution outside the sandbox. No public exploit code identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, so risk should be weighed against the conflicting 8.3 score versus the demanding exploitation preconditions. A vendor patch is available in Chrome 155.0.8059.39.
Arbitrary code execution outside the browser sandbox is possible in Google Chrome on macOS prior to 155.0.8059.39, where incorrect reference resolution in the WebAppInstalls component allows crafted network traffic to cross a process trust boundary. Exploitation is not standalone: the attacker must already have compromised the Chrome renderer process, which makes this a second-stage sandbox-escape primitive in a larger exploit chain rather than a directly reachable remote compromise, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects that non-trivial precondition. A vendor-released patch (Chrome 155.0.8059.39) is available, and no public exploit code was identified at the time of analysis.
Incorrect authorization in Google Chrome's WebProtect component lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page read sensitive information held in the browser context - the assessed impact is confidentiality-only (C:H/I:N/A:N), with no integrity or availability loss. Every Chrome build prior to 155.0.8059.39 is affected across platforms, and Google rates the underlying issue as Chromium security severity Medium. Exploitation is not drive-by: the CVSS vector requires user interaction (UI:R) and PR:N, so no credentials or non-default configuration are needed but the victim must be lured to the attacker-controlled page, and no public exploit code has been identified at time of analysis, making the base score of 8.8 an overstatement of realistic risk.
Incorrect authorization in Google Chrome's Autofill feature (versions prior to 155.0.8059.39) allows an unauthenticated remote attacker (PR:N) to obtain sensitive information via a crafted HTML page, but exploitation requires social engineering to trick the victim into visiting and interacting with the page (UI:R). The independent assessment limits the impact to confidentiality (C:L) with no integrity or availability effect, and exploitation further depends on the victim having relevant data stored in Autofill; no public exploit or active exploitation has been identified. A vendor patch is available.
Race condition in the V8 JavaScript engine allows remote code execution inside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. A remote, unauthenticated attacker can trigger the flaw by getting a victim to open attacker-supplied HTML that drives V8 into the timing window (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - the required user interaction is the only precondition, and code execution is confined to the renderer/V8 sandbox, so host compromise would require a second, separate sandbox-escape bug. Google has shipped a fixed stable-channel build, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC records Exploitation: none; no KEV listing or PoC in the available sources).
System access restriction bypass in Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to break out of the browser's security boundary through the FullScreen component, but only after having already compromised the Chrome renderer process and only with successful social engineering to make the victim interact with a crafted HTML page. Because it is a chain component rather than a standalone bug, exploitation requires a pre-existing renderer foothold plus mandatory user interaction (UI:R) and carries high attack complexity (AC:H), so it is not exploitable against a fully patched default browser on its own. No KEV listing and no publicly available exploit code have been identified at time of analysis, and EPSS is low at 0.22% (12th percentile), consistent with the conditional nature of the flaw despite the 8.3 CVSS base score and a Chromium security severity rating of Medium.
Sensitive information disclosure in Google Chrome builds prior to 155.0.8059.39 lets an unauthenticated remote attacker obtain data through the browser's Bluetooth handling by convincing a victim to open a crafted HTML page (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N per the independent assessment). The root cause is an incorrect authorization check (CWE-863) in the Web Bluetooth code path, so exploitation is limited to an information leak rather than code execution; the mandatory UI:R requirement means this is not a no-interaction drive-by, and the victim must be running a vulnerable Chrome version that reaches the affected Bluetooth logic. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV entry), although the vendor-rated 8.8 score conflicts with the assessed confidentiality-only vector and should be weighed as a severity signal rather than proof of integrity or availability impact. Vendor-released patch: 155.0.8059.39.
Use-after-free in Google Chrome's garbage-collection code before 155.0.8059.39 allows an unauthenticated remote attacker to corrupt memory and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (PR:N, UI:R) and the code execution stays contained in the browser sandbox, so OS-level compromise would require chaining a separate sandbox-escape flaw; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', which tempers the high 8.8 CVSS base score. Vendor-released patch: 155.0.8059.39, distributed through Chrome's stable channel.
Sandbox escape in Google Chrome's WebAppInstalls component allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim visits a crafted HTML page and is socially engineered into interacting with the web app installation flow. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 155.0.8059.39; the technical impact is total, but the vendor rates it Medium because exploitation requires a prior renderer compromise, deliberate user interaction (UI:R), and high attack complexity (AC:H) rather than a default-configuration remote hit. No public exploit code and no confirmed active exploitation have been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no).
Type confusion in the V8 JavaScript engine of Google Chrome prior to 155.0.8059.39 lets a remote, unauthenticated attacker execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page; the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so the sole prerequisite is that the victim renders attacker-controlled content in an unpatched desktop build. No public exploit code or active exploitation was identified at time of analysis, and CISA KEV does not list this CVE. The vendor-released patch is Chrome 155.0.8059.39, and installations already updated past that version are not affected. Because the impact is scoped to the sandbox (S:U) per the description, full host compromise would require chaining a separate sandbox-escape vulnerability.
Incorrect authorization in Google Chrome's FileSystem component allows a remote attacker to break out of the browser sandbox and potentially execute arbitrary code at the operating system level on desktop builds prior to 155.0.8059.39. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), no authentication or prior privileges are required, but exploitation is not automatic: the attacker must use social engineering to convince the victim to open a crafted HTML page, which aligns with CISA's SSVC rating of "not automatable" and a technical impact of "total" given the scope change across the sandbox boundary. There is no CISA KEV listing and no public exploit code identified at time of analysis, and a vendor patch is available, so this should be treated as a high-severity, patch-now issue rather than an actively exploited emergency.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39 through a race condition in the V8 JavaScript engine, triggered when a victim loads a crafted HTML page. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) and depends on winning a non-deterministic timing window, which is reflected in the assessed AC:H and makes reliable exploitation harder. Resulting code execution stays within the renderer sandbox, so escaping to the host OS would require chaining a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis, and vendor patches are available.
An integer overflow in the WebGL implementation of Google Chrome on Android lets a remote attacker potentially execute arbitrary code outside the browser sandbox on devices running any build prior to 155.0.8059.39. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning exploitation is unauthenticated but requires the victim to open an attacker-controlled HTML page that exercises the vulnerable WebGL code path; the scope change (S:C) reflects the potential escape from Chrome's renderer sandbox rather than a mere renderer crash. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none and Automatable: no, and a vendor patch exists, so the issue is high priority on impact and patch urgency rather than on observed exploitation. Because WebGL is enabled by default on Android Chrome, no special configuration is needed on the victim side beyond navigation to the malicious page.
Type confusion in ANGLE, Chrome's OpenGL ES abstraction layer, lets a remote attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox in Google Chrome versions prior to 155.0.8059.39. The victim must load attacker-controlled graphics content (crafted HTML invoking WebGL/ANGLE paths), so user interaction is required, and the bug cannot be triggered by merely visiting a page without a separate renderer exploit first - it is a second-stage sandbox-escape primitive in a multi-bug chain rather than an initial-access vector. No public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, but technical impact as total, consistent with the CVSS scope change (S:C), high confidentiality and integrity impact, and the High Chromium security severity rating.
Type confusion in the V8 JavaScript engine of Google Chrome allows remote code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page, affecting all versions prior to 154.0.8037.97 (Chromium severity: High, CVSS 3.1 base 8.8). Exploitation is unauthenticated but requires user interaction (UI:R) - the victim must navigate to or render attacker-controlled HTML/JavaScript - and code execution is confined to the sandbox with scope Unchanged, so escaping to the host OS would require a separate sandbox-escape flaw and site isolation further limits cross-origin reach. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available.
Sandbox escape in Google Chrome's WebView component on Android (versions prior to 154.0.8037.92) lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by serving a crafted HTML page to the victim. The flaw is a second-stage, chain-completing bug rather than a standalone remote-compromise vector: it requires an existing renderer-level foothold, high attack complexity, and victim user interaction, which is why CISA's SSVC assessment marks exploitation as 'none', automatability as 'no', and Chromium rates its own security severity as Low despite a 7.5 CVSS base score. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; a vendor patch is available in Chrome 154.0.8037.92.
Arbitrary code execution inside the renderer sandbox can be achieved by a remote attacker who lures a Google Chrome user, on any build prior to 154.0.8037.92, into loading a crafted HTML page that triggers a type confusion in the V8 JavaScript engine. No authentication or special privileges are required, but the victim must actively render attacker-controlled HTML/JavaScript (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), so exploitation is dependent on user interaction. Per the CISA SSVC evaluation exploitation is currently none and no public exploit code has been identified at time of analysis; the risk is driven instead by Chrome's enormous install base, the total technical impact rating, and the fact that any resulting code execution stays confined to the renderer sandbox - full host compromise would require chaining a separate sandbox-escape vulnerability. Google classifies the issue as High severity and a vendor patch is available.
A stack-based buffer overflow (CWE-121) in the V8 JavaScript engine allows remote code execution inside the renderer sandbox of Google Chrome builds prior to 154.0.8037.92 when a victim is lured to a crafted HTML page. Exploitation requires user interaction - the target must open or be navigated to the attacker-controlled page - but no authentication or privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and the default browser configuration is sufficient. No public exploit code or active exploitation has been identified, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no'; the practical ceiling on impact is the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. All signals align on a genuine but not emergency-level browser RCE, and Google has shipped a vendor patch.
Sandbox escape via a use-after-free in Google Chrome's PictureInPicture component affects all versions prior to 154.0.8037.92 and can lead to arbitrary code execution outside the browser sandbox, but only as a second-stage primitive: the attacker must already have compromised Chrome's sandboxed renderer process and must convince a victim to render a crafted HTML page. Scored CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), the High AC:H value reflects that precondition, so this is realistically usable only as one link in an exploit chain rather than a standalone remote compromise. CISA's SSVC assessment records no exploitation activity and no public exploit code has been identified at time of analysis; the Chromium severity is High and a vendor patch is available.
Integer overflow in Google Chrome's Editing component (CWE-190) lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page potentially execute arbitrary code, though the vendor states the resulting execution is confined to the Chromium sandbox. All Chrome builds prior to 156.0.8078.79 are affected; the flaw carries a CVSS score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and a Chromium security severity of High. No public exploit code has been identified at time of analysis and EPSS is low at 0.20% (10th percentile), while SSVC rates technical impact as total but exploitation as none and automatable as no, placing it in a 'this_week' remediation queue rather than an emergency.
Remote code execution inside the Chrome renderer sandbox affects Google Chrome builds prior to 156.0.8078.79, where memory corruption in the DOM lets a crafted HTML page execute arbitrary code. Attackers must convince a victim to load attacker-controlled HTML (UI:R) and need no credentials, but the impact is confined to the sandboxed renderer unless a separate sandbox-escape vulnerability is chained. No public exploit identified at time of analysis; the issue is not in CISA KEV, and an EPSS score of 0.20% (10th percentile) indicates low predicted exploitation.
Memory corruption in the V8 JavaScript engine of Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. User interaction is mandatory and the resulting code execution is sandbox-contained, so compromising the host would require an additional sandbox-escape flaw; the CVSS 3.1 score is 8.8 with C:H/I:H/A:H. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.73; the priority is this week, not an emergency.
Improper input validation in Google Chrome's command handling component can let a remote attacker potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page, affecting desktop Chrome builds prior to 156.0.8078.73. Exploitation is not confirmed as active (no CISA KEV listing) and no public exploit code has been identified at time of analysis, while EPSS is low at 0.21% (11th percentile) and Chromium rates the flaw High; per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) no authentication is required but the victim must interact with attacker-controlled content, and the resulting impact crosses a security boundary (S:C). Despite the modest EPSS figure, the vendor patch is available and the exposure combines a sandbox-escape-class impact with trivial remote delivery, so this warrants prompt remediation.
Memory corruption in the Skia graphics library shipped in Google Chrome before 156.0.8078.73 allows a remote attacker to achieve code execution inside the renderer sandbox when a victim loads a crafted HTML page. Affected users are those running Chrome builds prior to 156.0.8078.73; exploitation requires user interaction (CVSS UI:R, PR:N, AV:N), and the impact is confined to the renderer sandbox rather than host-level compromise. No public exploit is identified at time of analysis, and EPSS/KEV signals were not provided; the vendor classifies the issue as Chromium security severity High.
Arbitrary code execution inside the Chrome sandbox can be triggered in Google Chrome builds prior to 156.0.8078.73 by a crafted HTML page that exploits a memory-corruption flaw in the Payments component. The CVSS score of 8.8 reflects high confidentiality and integrity impact, but exploitation requires user interaction (UI:R) and the code execution is scoped to inside the sandbox, so host compromise would require an additional sandbox escape. No public exploit or active exploitation is identified at time of analysis, and Google has released a fixed build.
Improper input validation in Chrome's ReadingList component (fixed in 156.0.8078.73) lets a remote attacker who convinces a victim to open a crafted HTML page run arbitrary code inside the renderer sandbox. No authentication or prior privileges are needed, but user interaction is mandatory and the impact is confined to the sandbox - escaping to the host would require chaining a separate sandbox-escape flaw. No public exploit code or CISA KEV entry is reported, and the vendor considers the issue High severity in Chromium; the practical risk is real but not a drop-everything emergency given the sandbox boundary and the fact that a fixed build is already available.
A use-after-free (CWE-416) in Chromium's Animation component affects Google Chrome builds prior to 156.0.8078.73; a remote attacker who convinces a victim to load a crafted HTML page can trigger the memory-corruption condition and execute arbitrary code inside the browser sandbox. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting high confidentiality and integrity impact but requiring user interaction and remaining confined to the renderer sandbox until a separate sandbox escape is chained. There is no CISA KEV listing and no confirmed public exploit code in the supplied intelligence; a Chromium issue tracker reference exists but is not verified as working exploit code, and Google rates the flaw High with a vendor patch already released.
Improper input validation in the Metrics component of Google Chrome for macOS allows remote code execution inside the browser sandbox when a victim opens a crafted HTML page in any build prior to 156.0.8078.73. The attack is unauthenticated and network-delivered (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but it is gated on user interaction and confined to the renderer sandbox - escaping to the host would require a separate, distinct sandbox-escape flaw that is not described here. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is a moderate-urgency, patch-this-week item rather than a drop-everything emergency; a vendor patch (156.0.8078.73) is available.
A use-after-free in Chrome's ImageCapture component lets remote attackers who convince a victim to open a crafted HTML page execute arbitrary code - but, per the advisory, that execution is confined to the renderer sandbox rather than the host. Chrome builds prior to 156.0.8078.73 are affected and the vendor has released a fix; exploitation requires user interaction (CVSS UI:R) with no authentication or special configuration needed. No public exploit or active exploitation is identified in the supplied data, and the assessed priority places remediation in the near-term 'this week' window rather than emergency status, because host compromise would additionally require a separate sandbox-escape flaw.
Memory corruption in Google Chrome's Media component can let a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting Chrome releases prior to 156.0.8078.73. Exploitation requires user interaction and, with scope unchanged, is limited to renderer-process compromise rather than full host takeover unless combined with a separate sandbox escape. No public exploit identified at time of analysis; the vendor has released a fixed build, and this is a high-priority patch item rather than a drop-everything emergency.
Memory corruption in Chrome's HTML handling lets a remote attacker potentially execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome desktop builds prior to 156.0.8078.73. The CVSS vector shows unauthenticated network delivery (PR:N, AV:N) but requires the user to navigate to the attacker's page (UI:R), and the description scopes any code execution to the sandbox (S:U), so full host compromise would need a separate sandbox escape. No public exploit code or in-the-wild exploitation has been identified at time of analysis, and Google rates the issue Chromium security severity High with a vendor fix already published in 156.0.8078.73.
Sandbox-escaping remote code execution in Google Chrome's V8 JavaScript engine allows an attacker who gets a victim to load a crafted HTML page to run arbitrary code outside the browser sandbox, at host privilege level rather than merely in-page. All Chrome builds prior to 156.0.8078.73 on the stable channel are affected, and no authentication is required, though exploitation depends on the victim navigating to or rendering the attacker-controlled page (UI:R), so delivery hinges on phishing, malvertising, or a compromised or attacker-hosted site rather than autonomous network propagation. Google rates the Chromium severity High and the CVSS v3.1 vector scores 9.6 with a scope change; at the time of analysis EPSS is low at 0.21% (11th percentile) and there is no CISA KEV listing, and no public exploit identified at time of analysis, although the vuln.today decision label is act_now given the sandbox-escape impact and the availability of a vendor fix.
Improper input validation in SVG handling in Google Chrome before 156.0.8078.73 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Successful exploitation is gated by mandatory user interaction - the victim must open the attacker-supplied page in a vulnerable build - and the resulting code execution is confined to the Chrome sandbox, so full host compromise requires an additional, separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis and the flaw does not appear on CISA KEV; EPSS is 0.21% (11th percentile), and Google rates the Chromium security severity as High with a fix already shipped in the stable channel.
Improper input validation in the UI layer of Google Chrome for Android before 156.0.8078.73 allows remote attackers to achieve code execution inside the browser sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) but no authentication (PR:N), and impact is contained to the sandbox rather than the underlying Android OS, so full device compromise would need a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS is low (0.22%, 13th percentile); Google rates the issue High severity and has released a patched build.
Use-after-free in Google Chrome's SVG handling lets a remote attacker who gets a victim to open a crafted HTML page run arbitrary code outside the browser sandbox, affecting Chrome builds prior to 156.0.8078.73. Exploitation needs no authentication or privileges (CVSS PR:N) and no special configuration, since it involves default SVG rendering; the only gate is the required user interaction of loading the page (UI:R), while the changed scope plus high confidentiality, integrity and availability impact give CVSS 9.6 / Chromium severity High. Google has published a fixed build in the stable channel and the priority assessment is act_now; EPSS is modest at 0.22% (13th percentile), the CVE is not in CISA KEV, and no public exploit has been identified at time of analysis.
Memory corruption in Google Chrome's FileSystem component before 156.0.8078.73 can let a remote, unauthenticated attacker potentially execute arbitrary code outside the browser sandbox when a victim opens or is navigated to a crafted HTML page. Exploitation requires that user interaction and an unpatched desktop build; the vendor has released 156.0.8078.73 as the fix, and the issue is rated Critical (CVSS 9.6) and prioritized act_now. EPSS is 0.24% (15th percentile); no public exploit code or KEV confirmation is present in the available data.
Memory corruption in Google Chrome's Scroll component affects desktop builds prior to 156.0.8078.47 and lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The user-interaction requirement (UI:R) is the main limiting factor: the attack is not self-propagating and depends on the target navigating to malicious or compromised content, after which the injected code runs only within Chrome's sandboxed renderer process - realistic host compromise would additionally require chaining a separate sandbox-escape flaw. The vendor has shipped a fixed build (156.0.8078.47); no public exploit code or confirmed active exploitation was identified in the available intelligence at time of analysis, and no EPSS score was supplied to refine the likelihood estimate.
Use-after-free in Google Chrome's Extensions component (versions prior to 156.0.8078.47) lets a remote attacker who convinces a victim to open a crafted HTML page corrupt memory and execute arbitrary code inside the renderer sandbox, and can additionally crash the browser. Exploitation is not passive: it requires the target to load attacker-controlled web content, and because the CVSS scope is Unchanged, code execution stays confined to the sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though Chrome renderer memory-corruption bugs are historically attractive to exploit developers; the risk picture is mixed, with Chromium's own severity rating of Medium sitting well below the 8.8 CVSS score derived from the high confidentiality and integrity impact.
Arbitrary code execution inside the Chrome renderer sandbox affects Google Chrome versions prior to 156.0.8078.47 due to improper input validation in the Views component. A remote attacker can exploit the flaw by convincing a user to load a crafted HTML page; the attack requires user interaction (UI:R) but no authentication or privileges (PR:N). The vendor has released a patch, and the impact is contained by the sandbox (S:U), so this flaw alone does not compromise the host OS - it is a high-priority patch candidate rather than an emergency, and no public exploit identified at time of analysis.
Memory corruption in the WebAppInstalls component of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a user to load a crafted HTML page potentially execute arbitrary code inside the browser sandbox. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R) confirms no privileges are required but victim interaction is mandatory, and the vendor's own 'inside the sandbox' qualifier means host-level compromise would additionally require a separate sandbox escape. No public exploit code or CISA KEV entry is associated with this CVE in the available intelligence, so it is a hardening/patch-priority item rather than a confirmed active threat; a vendor fix exists in Chrome 156.0.8078.47.
Memory corruption in Google Chrome's FullScreen component before version 156.0.8078.47 allows remote attackers to potentially execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction to navigate to attacker-controlled content, and no public exploit was identified at time of analysis. The CVSS base score is 8.8, but realistic host compromise is limited unless the sandbox is separately escaped; Chromium rates the security severity as Low.
Memory corruption in Google Chrome's Core component before version 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction but no credentials, and the vendor rates the issue Chromium severity Low because the resulting code execution is confined to the renderer sandbox rather than the host OS. No public exploit code has been identified at time of analysis.
Memory corruption in Google Chrome's Accessibility implementation before version 156.0.8078.47 lets remote attackers execute arbitrary code at Chrome's sandbox privilege level by convincing a victim to open a crafted HTML page. Unauthenticated attackers can trigger the flaw through normal browsing, and because code execution is confined to the renderer sandbox, achieving host-level compromise requires chaining a separate sandbox-escape vulnerability. Google rates this Critical (Chromium severity) with a CVSS of 8.8; a vendor patch is available and no public exploit has been identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the ReadingMode component of Google Chrome builds prior to 156.0.8078.47, triggered when a victim opens a crafted HTML page. The flaw is unauthenticated from the network perspective but requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and Google's own Chromium severity rating for this issue is Low - a sharp conflict with the 8.8 base score that materially changes how the risk should be weighed. Because the description confines the code execution to the sandbox, a complete host compromise would require chaining a separate sandbox-escape bug that this CVE does not supply; no public exploit was identified at the time of analysis, and a vendor patch is available in Chrome 156.0.8078.47.
Memory corruption in the BrowserTag component of Google Chrome before 156.0.8078.47 lets a remote attacker who convinces a victim to load a crafted HTML page corrupt memory within the renderer and potentially execute arbitrary code inside the browser sandbox; no credentials or privileges are required, only that the victim renders the page (CVSS PR:N/UI:R). The resulting code execution is scope-limited to the sandbox - escaping to the host requires a separate sandbox-escape bug not covered by this CVE - which is why Google rates the Chromium security severity Low even though the generic CVSS base score computes to 8.8. No public exploit code or confirmed active exploitation was identified at time of analysis, and Chrome's silent auto-update mechanism shortens the exposure window on default desktop installations. Signals are mixed and must be weighed carefully: the numeric severity is high while the practical post-exploitation impact is constrained by the sandbox.
Remote code execution inside Chrome's renderer sandbox on Android is possible via memory corruption in ANGLE, the browser's graphics translation layer, when a victim running Google Chrome prior to 156.0.8078.47 loads a crafted HTML page. Exploitation requires user interaction, since the victim must navigate to or open the malicious page, and does not require authentication, but successful code execution stays within Chrome's renderer sandbox, so device-level compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at the time of analysis.
Improper input validation in Chrome's Extensions component allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox in Google Chrome desktop builds prior to 156.0.8078.47, triggered when a victim renders a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not zero-click: the UI:R metric and the 'crafted HTML page' wording confirm the user must actively visit or load attacker-controlled content, and the resulting code execution is contained within the browser sandbox unless chained with a separate sandbox-escape flaw. No public exploit code has been identified at the time of analysis, there is no CISA KEV listing, and EPSS is low at 0.30% (22nd percentile), so real-world priority is moderate even though vendor-released patch 156.0.8078.47 is available.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 score is 9.6 (Critical), driven by the scope change reflecting a sandbox escape, although Chromium rates the flaw Medium and the vendor describes code execution outside the sandbox as potential. Exploitation requires user interaction to load the crafted page; no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome's Extensions component before 156.0.8078.47 lets unauthenticated remote attackers potentially execute arbitrary code inside the Chrome sandbox when a victim visits a crafted HTML page. Exploitation requires user interaction (UI:R), and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining with a separate sandbox escape. No public exploit was identified at time of analysis, but the vendor has released a fixed build and the issue should be treated as a high-priority patch item.
Use-after-free in Google Chrome's Permissions component allows a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page on any Chrome build prior to 156.0.8078.47. No authentication or privileges are required, though exploitation is not zero-click (UI:R) and the resulting code execution is contained within the Chrome sandbox - full host compromise would require chaining a separate sandbox-escape flaw. Chromium rates the bug Low severity, but the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch (156.0.8078.47) is available.
Memory corruption in Google Chrome's DevTools component (versions prior to 156.0.8078.47) allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim opens an attacker-crafted HTML page. No authentication is required, but exploitation hinges on user interaction (UI:R), and because the CVSS scope is unchanged (S:U), the impact is confined to the renderer sandbox rather than a full host compromise - chaining a separate sandbox escape would be required to break out. Signals conflict and must be read together: NVD-style scoring is 8.8 while Google rates the Chromium security severity as Low, no public exploit code was identified at time of analysis, there is no CISA KEV entry, and the vendor has released a fixed build (156.0.8078.47).
Sandbox-confined code execution in Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who convinces a victim to open a crafted HTML page trigger improper input validation in the browser's UI layer and potentially run arbitrary code inside the renderer sandbox. No privileges are required (PR:N), but the attacker cannot act without the victim actively loading the page (UI:R), and any code that does run is contained by Chrome's sandbox - escaping to the host would require a separate, unrelated sandbox-escape flaw. The issue carries a notably conflicting risk profile: the raw 8.8 base score contrasts with Google's 'Low' Chromium severity rating and with our assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L, and no public exploit has been identified at time of analysis even though the fix is already shipping.
Use-after-free in the Chromecast component of Google Chrome builds prior to 156.0.8078.47 lets a remote attacker who persuades a victim to open a crafted HTML page potentially execute arbitrary code - but only inside the browser sandbox, as confirmed by the vendor's own wording. The CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting a high-confidentiality and high-integrity impact that requires user interaction; there is no fully drive-by, zero-interaction path, and no public exploit code or CISA KEV entry was identified at time of analysis. Because code execution stays within the sandbox, host compromise would require a separate sandbox-escape primitive, which is the main factor capping real-world impact.
Memory corruption in ANGLE, Chrome's WebGL/graphics translation layer, lets remote attackers potentially achieve arbitrary code execution inside the renderer sandbox on Chrome builds prior to 156.0.8078.47 by convincing a victim to load a crafted HTML page. The bug is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-119), with the mandatory user-interaction requirement and unchanged sandbox scope being the main constraints - full host compromise would require chaining a separate sandbox-escape flaw. Google has released a fixed build, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, making this a high-priority patch item rather than a drop-everything emergency.
Memory corruption in Chrome's Search component lets a remote, unauthenticated attacker achieve code execution inside the browser sandbox when a victim simply loads a crafted HTML page in any Chrome build prior to 156.0.8078.47 (CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High). Because the flaw is explicitly scoped to code execution 'inside the sandbox', it does not by itself grant host-level compromise and would need to be chained with a separate sandbox escape for full system takeover, though an in-sandbox primitive already exposes credentials, session data, and files reachable by the renderer. No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, but Google has shipped a vendor patch and the required user interaction (a single page visit) keeps the practical bar to exploitation low for targeted campaigns.
Use-after-free in Google Chrome's Loader component before 156.0.8078.47 allows an unauthenticated remote attacker who persuades a victim to load a crafted HTML page to execute arbitrary code inside the renderer sandbox. Exploitation requires user interaction (UI:R) and no special configuration, but the impact is bounded by Chrome's sandbox; full host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified in the supplied intelligence, and Google rates the issue Chromium severity Low despite the 8.8 CVSS score.
Memory corruption in the DevTools component of Google Chrome desktop builds prior to 156.0.8078.47 allows a remote attacker who convinces a victim to open a crafted HTML page to run arbitrary code within the browser sandbox. Although Google rates the Chromium security severity as Low, the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) scores 8.8 because successful exploitation yields high confidentiality, integrity and availability impact inside the sandboxed renderer; no authentication is needed but user interaction (opening the page) is required. No public exploit code or confirmed active exploitation was identified at time of analysis, so the practical risk is tempered by the need for a separate sandbox-escape chain to reach the host.
Use-after-free in Google Chrome's ContextualSearch component (all versions prior to 156.0.8078.47) allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) reflects a low-complexity, network-reachable flaw whose only prerequisite is victim navigation; however, per the vendor description, the resulting code execution is confined to the renderer sandbox, so host-level compromise requires a separate sandbox-escape vulnerability. Chromium rates this a Medium-severity issue, no public exploit code was identified at time of analysis, and it is not listed in CISA KEV.
A use-after-free in ANGLE, the graphics translation layer behind Chrome's WebGL and hardware-accelerated canvas rendering, lets a crafted HTML page corrupt renderer memory and achieve arbitrary code execution inside the browser sandbox in Google Chrome builds prior to 156.0.8078.47. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled web content that exercises WebGL paths, and no non-default configuration is needed - the component is enabled by default. Multiple signals align toward genuine priority with one important nuance: code execution is confined to the renderer sandbox, so host compromise would require chaining a separate sandbox escape. At time of analysis, no public exploit code and no confirmed active exploitation (CISA KEV) were identified, though the 8.8 CVSS and RCE-class tagging warrant prompt patching.
Memory corruption in the WebAppInstalls component of Google Chrome for Android before 156.0.8078.47 can be triggered when a user opens an attacker-crafted HTML page, potentially allowing remote code execution outside the browser sandbox. No authentication is required, but exploitation depends on user interaction, is limited to Android builds below the fixed version, and our assessment applies AC:H despite the mechanical 9.6 CVSS score. No public exploit has been identified at time of analysis, and Google rates the Chromium issue Low, so the conflicting severity signals should be reconciled before treating this as a high-urgency RCE campaign.
Memory corruption in Chrome's SiteIsolation component lets a remote attacker who convinces a user to open a crafted HTML page potentially execute arbitrary code inside the browser sandbox on Chrome builds prior to 156.0.8078.47. Exploitation is not silent or wormable: the CVSS vector AV:N/AC:L/PR:N/UI:R means no credentials are needed but victim interaction is mandatory, and the vendor scopes the outcome to code execution 'inside the sandbox,' so full host compromise would require chaining a separate sandbox-escape flaw. Google rates the underlying bug Medium severity while the derived CVSS base score is 8.8; no public exploit code or active exploitation is identified in the available intelligence at time of analysis, and a vendor patch (156.0.8078.47) is already published.
Memory corruption in the SignIn component of Google Chrome releases prior to 156.0.8078.47 lets a remote, unauthenticated attacker potentially execute arbitrary code - but only inside the renderer sandbox - after convincing a victim to open a crafted HTML page. Google's Chromium team rated this 'Low' severity even though the CVSS 3.1 base score is 8.8, because the corruption yields in-sandbox code execution and host compromise would require chaining a separate sandbox escape. No public exploit code has been identified and the issue is not in CISA KEV, although the vendor has already shipped a fixed build; the conflict between the high numeric score and the Low vendor rating is the main judgement call for prioritisation.
Origin-policy bypass in Google Chrome before 156.0.8078.47 can let a remote attacker use a crafted HTML page to make unauthorized cross-origin accesses after the victim visits the page. The flaw is a missing authorization check in Chrome's Animation component (CWE-862); it affects default installations and requires user interaction, with no authentication needed. There is no evidence of active exploitation and no public exploit identified at time of analysis; EPSS is 0.24% (14th percentile), and Google has released 156.0.8078.47 as the fixed build.
Memory corruption in Google Chrome's PolicyContainer component affects desktop builds prior to 156.0.8078.47 and can allow a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires the target to actively visit attacker-controlled content (CVSS UI:R, PR:N), and while the vector scores 9.6 because the scope change pushes confidentiality, integrity, and availability impact to High, Chromium's own 'Medium' severity rating and the description's 'potentially' indicate weaponization is non-trivial. No public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Memory corruption in the DevTools component of Google Chrome desktop builds prior to 156.0.8078.47 allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the Chrome renderer sandbox by convincing a victim to open a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). The required user interaction and the fact that execution is confined within the sandbox - no sandbox escape or host compromise was demonstrated - are the key limiting factors, which is why Chromium assigned this a security severity of Low despite the high base score. No public exploit code or confirmed active exploitation was identified in the available intelligence, and EPSS data was not provided, so real-world risk should be treated as contextual rather than demonstrated; signals conflict and must be weighed carefully, since the high CVSS and RCE tag coexist with a Low vendor severity and sandbox confinement. Fixed builds are available from the vendor in Chrome 156.0.8078.47 and later.
Memory corruption in Google Chrome's DataTransfer component can potentially allow a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page in a build prior to 156.0.8078.47. The CVSS 8.8 rating reflects high confidentiality and integrity impact, but exploitation requires user interaction (UI:R) and does not by itself escape the renderer sandbox (S:U), so host-level compromise would require a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, and Google has released a fixed build, 156.0.8078.47.
Use-after-free in Google Chrome's Extensions subsystem enables remote code execution inside the renderer sandbox when a victim opens attacker-controlled crafted HTML, affecting desktop builds prior to 156.0.8078.47. The attack is unauthenticated over the network but requires user interaction (CVSS UI:R), and because the scope is unchanged (S:U), the code execution is contained by the browser sandbox - full host compromise would need a separate sandbox escape. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV) on record; risk is moderated by Chrome's auto-update cadence, since users already on 156.0.8078.47 or later are not exploitable.
Memory corruption in Google Chrome's Shadow DOM implementation allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, affecting desktop Chrome builds prior to 156.0.8078.47. The CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) reflects high confidentiality and integrity impact within the compromised renderer, but with unchanged scope and execution confined 'inside the sandbox,' full host compromise would require chaining a separate sandbox-escape flaw. Chromium's own security severity rating is Medium, Google has shipped a fixed build, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's Script component before 156.0.8078.47 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and works against default browser configurations, but the code execution is contained by the Chrome sandbox, so host compromise would require chaining a separate sandbox-escape flaw. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Memory corruption in Chrome's Frames component allows a remote attacker who convinces a victim to open a crafted HTML page to achieve arbitrary code execution inside the Chromium renderer sandbox. All Chrome builds prior to 156.0.8078.47 are affected, and exploitation requires no authentication - the only real barrier is the mandatory user interaction of loading attacker-controlled frame content (CVSS UI:R). Google rates the issue High severity (Chromium) and lists it as fixed in the 156.0.8078.47 stable release; no public exploit code has been identified at time of analysis, and the practical impact is bounded by the sandbox, so full host compromise would require chaining with a separate sandbox-escape flaw.
Use-after-free in Google Chrome's SiteIsolation component before 156.0.8078.47 allows unauthenticated remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) and does not by itself escape Chrome's sandbox, so host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit identified at time of analysis, but the vendor has released a fixed build and the issue is rated High severity.
Improper input validation in Google Chrome's Omnibox on Android before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load or interact with a crafted HTML page. Exploitation requires user interaction (UI:R) and the resulting code execution is confined to the sandbox, so host-level compromise would require chaining a separate sandbox-escape flaw. Google rates the Chromium severity as Medium and has shipped a fixed build (156.0.8078.47); no public exploit code was identified at time of analysis and the issue is not listed in CISA KEV, so real-world priority is lower than the raw 8.8 CVSS score suggests.
Out-of-bounds read in Google Chrome's Focus handling prior to 156.0.8078.47 can be triggered by a crafted HTML page and may allow arbitrary code execution inside the renderer sandbox. The issue is remotely reachable without credentials but requires user interaction, since the victim must load attacker-controlled web content; CVSS 8.8 reflects high confidentiality and integrity impact with unchanged scope. No public exploit code or CISA KEV entry was identified at time of analysis, and Google has released Chrome 156.0.8078.47 to address it.
Memory corruption in Google Chrome's browser API handling allows remote code execution inside the renderer sandbox when a victim loads a crafted HTML page in any build prior to 156.0.8078.47. Exploitation is unauthenticated from the network but requires user interaction, since the target must navigate to or render attacker-controlled content; successful abuse yields high confidentiality, integrity, and availability impact within the sandboxed renderer rather than at the host level. A vendor patch is available in 156.0.8078.47, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Memory corruption in Google Chrome's Interstitials component (versions prior to 156.0.8078.47) can allow remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and the unchanged scope indicates that host compromise would require chaining with a separate sandbox escape. No public exploit code has been identified at time of analysis, and Google has released a fixed version.
Memory corruption in Google Chrome for Android prior to 156.0.8078.47 allows a remote, unauthenticated attacker to potentially execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) - navigating to attacker-controlled content - and the resulting code execution is confined to the renderer sandbox, so full device compromise would require a separate sandbox-escape vulnerability. Signals conflict sharply: the CVSS 3.1 score is 8.8 while Google assigns Chromium security severity Low, and no public exploit code or CISA KEV entry was identified at time of analysis; a vendor patch is available in 156.0.8078.47.
Memory corruption in Google Chrome's Compositing component allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to open a crafted HTML page in desktop versions prior to 156.0.8078.47. User interaction is mandatory, and successful exploitation is confined to the sandbox, so host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit was identified at the time of analysis, and Google has released a patched version; the 8.8 CVSS score contrasts with Chromium's Medium severity rating because of the sandbox confinement.
Memory corruption in Google Chrome's Core component allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in any desktop build prior to 156.0.8078.47. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8 High) reflects low-complexity exploitation gated only by the user-interaction requirement, with sandbox containment (S:U) meaning a standalone compromise yields renderer-level code execution rather than direct host takeover. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and no EPSS score was supplied in the source feed; Google rates the flaw Medium under its own Chromium severity scale, and a vendor patch is available.
Use-after-free in Google Chrome's V8 JavaScript engine (versions prior to 156.0.8078.47) allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is rated CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting network reachability, low complexity, no privileges, and required user interaction; code execution is confined to the sandbox, so OS compromise would require an additional sandbox escape. A vendor-released patch is available as version 156.0.8078.47, and no public exploit has been identified at time of analysis.
Remote code execution in Google Chrome's Proxy component (versions before 156.0.8078.47) stems from improper input validation that can be triggered when an unauthenticated remote attacker convinces a victim to load a crafted HTML page. Exploitation requires user interaction (UI:R) and yields code execution confined within the browser sandbox; no public exploit was identified at time of analysis.
Memory corruption in the Chrome FileSystem component allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 156.0.8078.47 on desktop are affected, and because exploitation requires only a page visit (UI:R) with no privileges (PR:N), browsing-driven attacks are practical despite the medium rating Chromium assigned. Code execution is confined to the sandbox, so full host compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at time of analysis, and EPSS data was not provided.
Google Chrome builds prior to 156.0.8078.47 contain an improper input-validation weakness in the GPU component that allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox after a victim loads a crafted HTML page. Exploitation requires user interaction but no privileges, and the resulting code execution is confined to Chrome's sandbox unless chained with a separate sandbox-escape flaw. CVSS 3.1 scores this as 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H); no public exploit was identified at time of analysis, and it is not reported as actively exploited.
Memory corruption in Google Chrome's Paint rendering component can allow a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page in a version prior to 156.0.8078.47. Exploitation is user-interaction-gated because the victim must visit or be redirected to attacker-controlled content, and the resulting code execution is confined to the renderer sandbox unless combined with a separate sandbox-escape flaw. No public exploit identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fixed version.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
Heap-based buffer overflow in Google Chrome's Animation component allows a remote attacker to execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page in any build prior to 155.0.8059.79. The bug carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication or special configuration is required, but exploitation depends on the user rendering attacker-controlled content, and because the scope is unchanged the resulting code execution is confined to the sandboxed renderer process rather than the host OS. No public exploit code and no confirmed active exploitation have been identified at time of analysis - CISA's SSVC evaluation rates Exploitation as 'none' - so this is a patch-promptly item rather than an emergency, with Google rating the issue High severity.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Information disclosure in the Permissions component of Google Chrome before 155.0.8059.39 allows a remote, unauthenticated attacker to bypass the browser's site-isolation boundary by luring a victim into loading a crafted HTML page. Exploitation requires user interaction (UI:R) - the target must visit attacker-controlled content - and the resulting impact is limited to leaking information across origins rather than code execution, data modification, or denial of service. A vendor fix is already available in 155.0.8059.39, there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating a low near-term exploitation likelihood.
Arbitrary code execution confined to Chrome's renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39, where an incorrect comparison in the font rendering pipeline can be triggered by a crafted HTML page. This is an unauthenticated remote attack (AV:N/PR:N) that requires the victim to load attacker-controlled web content (UI:R); the resulting code execution stays inside the renderer sandbox (S:U), and escaping to the host operating system requires a separate, unrelated sandbox-escape vulnerability - which is why Chromium assigned a Low security severity despite the CVSS 8.8 base score. No public exploit code was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Missing authorization in the Actor component of Google Chrome prior to 155.0.8059.39 allows code to escape the browser sandbox, but only after the attacker has already compromised the renderer process via a separate bug and then gets the victim to load a crafted HTML page. This prerequisite, combined with required user interaction (UI:R) and high attack complexity (AC:H) from the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector, means the flaw is only usable as a link in an exploit chain rather than as a standalone initial-access vector; the changed scope (S:C) and high confidentiality, integrity and availability impact reflect the potential for full code execution outside the sandbox. No public exploit code identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, so risk should be weighed against the conflicting 8.3 score versus the demanding exploitation preconditions. A vendor patch is available in Chrome 155.0.8059.39.
Arbitrary code execution outside the browser sandbox is possible in Google Chrome on macOS prior to 155.0.8059.39, where incorrect reference resolution in the WebAppInstalls component allows crafted network traffic to cross a process trust boundary. Exploitation is not standalone: the attacker must already have compromised the Chrome renderer process, which makes this a second-stage sandbox-escape primitive in a larger exploit chain rather than a directly reachable remote compromise, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects that non-trivial precondition. A vendor-released patch (Chrome 155.0.8059.39) is available, and no public exploit code was identified at the time of analysis.
Incorrect authorization in Google Chrome's WebProtect component lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page read sensitive information held in the browser context - the assessed impact is confidentiality-only (C:H/I:N/A:N), with no integrity or availability loss. Every Chrome build prior to 155.0.8059.39 is affected across platforms, and Google rates the underlying issue as Chromium security severity Medium. Exploitation is not drive-by: the CVSS vector requires user interaction (UI:R) and PR:N, so no credentials or non-default configuration are needed but the victim must be lured to the attacker-controlled page, and no public exploit code has been identified at time of analysis, making the base score of 8.8 an overstatement of realistic risk.
Incorrect authorization in Google Chrome's Autofill feature (versions prior to 155.0.8059.39) allows an unauthenticated remote attacker (PR:N) to obtain sensitive information via a crafted HTML page, but exploitation requires social engineering to trick the victim into visiting and interacting with the page (UI:R). The independent assessment limits the impact to confidentiality (C:L) with no integrity or availability effect, and exploitation further depends on the victim having relevant data stored in Autofill; no public exploit or active exploitation has been identified. A vendor patch is available.
Race condition in the V8 JavaScript engine allows remote code execution inside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. A remote, unauthenticated attacker can trigger the flaw by getting a victim to open attacker-supplied HTML that drives V8 into the timing window (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - the required user interaction is the only precondition, and code execution is confined to the renderer/V8 sandbox, so host compromise would require a second, separate sandbox-escape bug. Google has shipped a fixed stable-channel build, and no public exploit code or confirmed active exploitation was identified at time of analysis (CISA SSVC records Exploitation: none; no KEV listing or PoC in the available sources).
System access restriction bypass in Google Chrome versions prior to 155.0.8059.39 allows a remote attacker to break out of the browser's security boundary through the FullScreen component, but only after having already compromised the Chrome renderer process and only with successful social engineering to make the victim interact with a crafted HTML page. Because it is a chain component rather than a standalone bug, exploitation requires a pre-existing renderer foothold plus mandatory user interaction (UI:R) and carries high attack complexity (AC:H), so it is not exploitable against a fully patched default browser on its own. No KEV listing and no publicly available exploit code have been identified at time of analysis, and EPSS is low at 0.22% (12th percentile), consistent with the conditional nature of the flaw despite the 8.3 CVSS base score and a Chromium security severity rating of Medium.
Sensitive information disclosure in Google Chrome builds prior to 155.0.8059.39 lets an unauthenticated remote attacker obtain data through the browser's Bluetooth handling by convincing a victim to open a crafted HTML page (CVSS 3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N per the independent assessment). The root cause is an incorrect authorization check (CWE-863) in the Web Bluetooth code path, so exploitation is limited to an information leak rather than code execution; the mandatory UI:R requirement means this is not a no-interaction drive-by, and the victim must be running a vulnerable Chrome version that reaches the affected Bluetooth logic. No public exploit identified at time of analysis, and the issue is not confirmed actively exploited (no CISA KEV entry), although the vendor-rated 8.8 score conflicts with the assessed confidentiality-only vector and should be weighed as a severity signal rather than proof of integrity or availability impact. Vendor-released patch: 155.0.8059.39.
Use-after-free in Google Chrome's garbage-collection code before 155.0.8059.39 allows an unauthenticated remote attacker to corrupt memory and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (PR:N, UI:R) and the code execution stays contained in the browser sandbox, so OS-level compromise would require chaining a separate sandbox-escape flaw; no public exploit identified at time of analysis, and CISA's SSVC assessment records exploitation as 'none' and automatable as 'no', which tempers the high 8.8 CVSS base score. Vendor-released patch: 155.0.8059.39, distributed through Chrome's stable channel.
Sandbox escape in Google Chrome's WebAppInstalls component allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim visits a crafted HTML page and is socially engineered into interacting with the web app installation flow. The flaw is a missing authorization check (CWE-862) affecting Chrome versions prior to 155.0.8059.39; the technical impact is total, but the vendor rates it Medium because exploitation requires a prior renderer compromise, deliberate user interaction (UI:R), and high attack complexity (AC:H) rather than a default-configuration remote hit. No public exploit code and no confirmed active exploitation have been identified at time of analysis (CISA SSVC Exploitation: none, Automatable: no).
Type confusion in the V8 JavaScript engine of Google Chrome prior to 155.0.8059.39 lets a remote, unauthenticated attacker execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page; the CVSS vector is AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, so the sole prerequisite is that the victim renders attacker-controlled content in an unpatched desktop build. No public exploit code or active exploitation was identified at time of analysis, and CISA KEV does not list this CVE. The vendor-released patch is Chrome 155.0.8059.39, and installations already updated past that version are not affected. Because the impact is scoped to the sandbox (S:U) per the description, full host compromise would require chaining a separate sandbox-escape vulnerability.
Incorrect authorization in Google Chrome's FileSystem component allows a remote attacker to break out of the browser sandbox and potentially execute arbitrary code at the operating system level on desktop builds prior to 155.0.8059.39. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), no authentication or prior privileges are required, but exploitation is not automatic: the attacker must use social engineering to convince the victim to open a crafted HTML page, which aligns with CISA's SSVC rating of "not automatable" and a technical impact of "total" given the scope change across the sandbox boundary. There is no CISA KEV listing and no public exploit code identified at time of analysis, and a vendor patch is available, so this should be treated as a high-severity, patch-now issue rather than an actively exploited emergency.
Remote code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39 through a race condition in the V8 JavaScript engine, triggered when a victim loads a crafted HTML page. The flaw requires no authentication (PR:N) but does require user interaction (UI:R) and depends on winning a non-deterministic timing window, which is reflected in the assessed AC:H and makes reliable exploitation harder. Resulting code execution stays within the renderer sandbox, so escaping to the host OS would require chaining a separate sandbox-escape vulnerability; no public exploit code has been identified at time of analysis, and vendor patches are available.
An integer overflow in the WebGL implementation of Google Chrome on Android lets a remote attacker potentially execute arbitrary code outside the browser sandbox on devices running any build prior to 155.0.8059.39. The CVSS 3.1 base score is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning exploitation is unauthenticated but requires the victim to open an attacker-controlled HTML page that exercises the vulnerable WebGL code path; the scope change (S:C) reflects the potential escape from Chrome's renderer sandbox rather than a mere renderer crash. At time of analysis there is no public exploit identified, CISA's SSVC assessment records Exploitation: none and Automatable: no, and a vendor patch exists, so the issue is high priority on impact and patch urgency rather than on observed exploitation. Because WebGL is enabled by default on Android Chrome, no special configuration is needed on the victim side beyond navigation to the malicious page.
Type confusion in ANGLE, Chrome's OpenGL ES abstraction layer, lets a remote attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox in Google Chrome versions prior to 155.0.8059.39. The victim must load attacker-controlled graphics content (crafted HTML invoking WebGL/ANGLE paths), so user interaction is required, and the bug cannot be triggered by merely visiting a page without a separate renderer exploit first - it is a second-stage sandbox-escape primitive in a multi-bug chain rather than an initial-access vector. No public exploit identified at time of analysis; CISA's SSVC assessment rates exploitation as none and automatable as no, but technical impact as total, consistent with the CVSS scope change (S:C), high confidentiality and integrity impact, and the High Chromium security severity rating.
Type confusion in the V8 JavaScript engine of Google Chrome allows remote code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page, affecting all versions prior to 154.0.8037.97 (Chromium severity: High, CVSS 3.1 base 8.8). Exploitation is unauthenticated but requires user interaction (UI:R) - the victim must navigate to or render attacker-controlled HTML/JavaScript - and code execution is confined to the sandbox with scope Unchanged, so escaping to the host OS would require a separate sandbox-escape flaw and site isolation further limits cross-origin reach. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available.
Sandbox escape in Google Chrome's WebView component on Android (versions prior to 154.0.8037.92) lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by serving a crafted HTML page to the victim. The flaw is a second-stage, chain-completing bug rather than a standalone remote-compromise vector: it requires an existing renderer-level foothold, high attack complexity, and victim user interaction, which is why CISA's SSVC assessment marks exploitation as 'none', automatability as 'no', and Chromium rates its own security severity as Low despite a 7.5 CVSS base score. No confirmed active exploitation (CISA KEV) and no public exploit code were identified at time of analysis; a vendor patch is available in Chrome 154.0.8037.92.
Arbitrary code execution inside the renderer sandbox can be achieved by a remote attacker who lures a Google Chrome user, on any build prior to 154.0.8037.92, into loading a crafted HTML page that triggers a type confusion in the V8 JavaScript engine. No authentication or special privileges are required, but the victim must actively render attacker-controlled HTML/JavaScript (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), so exploitation is dependent on user interaction. Per the CISA SSVC evaluation exploitation is currently none and no public exploit code has been identified at time of analysis; the risk is driven instead by Chrome's enormous install base, the total technical impact rating, and the fact that any resulting code execution stays confined to the renderer sandbox - full host compromise would require chaining a separate sandbox-escape vulnerability. Google classifies the issue as High severity and a vendor patch is available.
A stack-based buffer overflow (CWE-121) in the V8 JavaScript engine allows remote code execution inside the renderer sandbox of Google Chrome builds prior to 154.0.8037.92 when a victim is lured to a crafted HTML page. Exploitation requires user interaction - the target must open or be navigated to the attacker-controlled page - but no authentication or privileges are needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), and the default browser configuration is sufficient. No public exploit code or active exploitation has been identified, and CISA's SSVC decision framework rates exploitation as 'none' with automatable 'no'; the practical ceiling on impact is the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. All signals align on a genuine but not emergency-level browser RCE, and Google has shipped a vendor patch.
Sandbox escape via a use-after-free in Google Chrome's PictureInPicture component affects all versions prior to 154.0.8037.92 and can lead to arbitrary code execution outside the browser sandbox, but only as a second-stage primitive: the attacker must already have compromised Chrome's sandboxed renderer process and must convince a victim to render a crafted HTML page. Scored CVSS 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), the High AC:H value reflects that precondition, so this is realistically usable only as one link in an exploit chain rather than a standalone remote compromise. CISA's SSVC assessment records no exploitation activity and no public exploit code has been identified at time of analysis; the Chromium severity is High and a vendor patch is available.