Chrome
Monthly
An out-of-bounds write in the GPU process of Google Chrome prior to 154.0.8037.92 allows an attacker to break out of the browser sandbox and potentially execute arbitrary code at the browser's privilege level via a crafted HTML page. The attack is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed exploitation conditions indicate the attacker must have already compromised Chrome's renderer process, and the victim must load attacker-controlled content, making this a sandbox-escape link in a multi-stage exploit chain rather than a directly reachable remote bug. Only Chrome builds below 154.0.8037.92 are affected, and effective exploitation requires overcoming non-trivial memory-corruption and chaining conditions (AC:H); no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Google has released a vendor patch in Chrome 154.0.8037.92.
Use-after-free in Chrome's Views UI framework allows a remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code outside the browser sandbox on any Chrome desktop build prior to 154.0.8037.92. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) confirms remote, unauthenticated attack with no special privileges, but also confirms that user interaction - social engineering to get the victim to load the page - is mandatory, which is the main limiting factor; the scope change (S:C) reflects that impact is not confined to the renderer. No public exploit was identified at the time of analysis and CISA's SSVC assessment rates exploitation as 'none' and not automatable, but a vendor patch is available from Google and the technical impact is total, making prompt updating the priority.
Use-after-free in Google Chrome's FullScreen implementation prior to 154.0.8037.92 allows a remote, unauthenticated attacker to execute arbitrary code outside the browser's renderer sandbox by enticing a victim to load a crafted HTML page. The vulnerability carries a CVSS 3.1 base score of 9.6 with scope change (S:C) and High confidentiality, integrity, and availability impact, reflecting that successful exploitation escapes the sandbox rather than being confined to a compromised renderer. No public exploit code and no confirmed active exploitation have been identified at time of analysis (SSVC Exploitation: none), and the attack is not automatable for mass exploitation because it requires the victim to visit attacker-controlled content (UI:R); Google has released a vendor patch in Chrome 154.0.8037.92.
Type confusion in V8, Chrome's JavaScript engine, allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation requires user interaction (CVSS PR:N/UI:R) - the target must navigate to attacker-controlled or compromised content - and no public exploit code has been identified at time of analysis, with CISA's SSVC assessment recording Exploitation = none. Because V8 is the always-on JavaScript engine, any HTML/JS-rendering context is a viable trigger with no special configuration needed, but the resulting code execution is confined to the renderer sandbox (S:U), so full host compromise requires chaining a separate sandbox-escape vulnerability.
Remote code execution outside the browser sandbox is possible in Google Chrome builds prior to 154.0.8037.92 through a use-after-free in the Passwords component, which a remote attacker can trigger by convincing a victim to open a crafted HTML page. Because the CVSS vector is PR:N/UI:R, no authentication or special configuration is required, but the victim must actively navigate to the attacker's content and a successful chain must also defeat the sandbox, leaving full compromise achievable but non-trivial. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, while Google has released a vendor patch in Chrome 154.0.8037.92; the scope-change (S:C) rating reflects that a working exploit would escape the renderer boundary rather than remain confined to a single security context.
A use-after-free in Chrome's Views UI framework allows an unauthenticated remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code outside the browser sandbox in Google Chrome desktop builds prior to 154.0.8037.92. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), no credentials or special browser configuration are required - default installations are affected - but exploitation depends on user interaction with attacker-controlled content and on overcoming the difficulty of turning a use-after-free into a reliable sandbox escape, so a working exploit is not trivial. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; a vendor patch (154.0.8037.92) is available, which makes rapid update the decisive control.
Type confusion in the V8 JavaScript engine in Google Chrome prior to 154.0.8037.92 lets remote attackers execute arbitrary code inside the renderer sandbox by luring a victim into opening a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction - the victim must render the attacker's page - and because V8 runs JavaScript on essentially every page, default desktop configurations are exposed. Impact is scored 8.8 High (C:H/I:H/A:H) with the important caveat that code execution is confined to the sandbox, so full host compromise requires chaining a separate sandbox-escape bug; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available as Chrome 154.0.8037.92.
Type confusion in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the V8 sandbox when a victim loads a crafted HTML page in any Chrome build prior to 154.0.8037.92. Exploitation requires user interaction (the victim must browse to the malicious or compromised page) but no authentication or special configuration, since default JavaScript execution is sufficient; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Google has released a vendor patch in 154.0.8037.92, and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) has been identified. Because the flaw is contained by the V8 sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability.
Remote code execution outside the browser sandbox can potentially be achieved by an unauthenticated attacker in Google Chrome versions prior to 154.0.8037.92 by exploiting a use-after-free in the Bluetooth subsystem. The victim must navigate to a crafted HTML page that exercises the Web Bluetooth code path (UI:R), and successful exploitation can lead to arbitrary code execution with a scope change (S:C), meaning a sandbox escape. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in Chrome 154.0.8037.92.
Type confusion in the V8 JavaScript engine allows remote code execution inside the Chrome renderer sandbox on any unpatched build prior to 154.0.8037.92. Because the flaw is triggered by a crafted HTML page, the attacker needs only to convince a victim to visit it - no credentials or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8, Chromium severity High) - and exploitation works against default configurations with JavaScript enabled. Successful exploitation yields arbitrary code execution confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape bug; exploitability is high but not trivially mass-exploitable. No public exploit was identified at time of analysis, and our assessment rates this as a genuinely high-priority browser vulnerability rather than an inflated-CVSS artifact. Vendor-released patch: 154.0.8037.92.
Sandbox escape in Google Chrome on Windows prior to 154.0.8037.92 allows a local attacker to execute arbitrary code outside the browser sandbox through improper privilege management in the Mojo IPC layer. Exploitation requires local access to a Windows host and some user interaction (UI:R) but no authentication (PR:N), and it functions as a second-stage capability: an attacker who already holds a sandboxed foothold, such as a compromised renderer, can leverage the flaw to reach the full privileges of the browser process, yielding high confidentiality, integrity, and availability impact with a scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS-style risk signal is low; non-Windows Chrome builds are unaffected because the defect is Windows-specific. A vendor patch is available in Chrome 154.0.8037.92.
Remote code execution is possible in Google Chrome on Android builds prior to 154.0.8037.92, where a heap-based buffer overflow in the ANGLE graphics layer can be triggered when a user renders a crafted HTML page. Successful exploitation corrupts memory out of bounds and, per Google's Critical severity rating and the scope-changed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), can potentially execute arbitrary code outside the browser sandbox. The issue is remotely deliverable without authentication but hinges on user interaction, and no public exploit code or active exploitation has been identified at time of analysis; CISA's SSVC assessment likewise records no observed exploitation and rates the flaw non-automatable, while a vendor patch (154.0.8037.92) is available.
Use-after-free in Google Chrome desktop versions prior to the September 2026 stable channel update allows remote attackers to cause information disclosure and memory corruption when a victim loads attacker-controlled web content. Exploitation requires user interaction (UI:R) and a high-complexity timing or heap-state precondition (AC:H), but no authentication (PR:N); the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, yielding a base score of 8.3. A vendor patch is available in the September 2026 stable channel update, and no public exploit code or active exploitation has been identified in the provided intelligence.
Type confusion (CWE-843) in Google Chrome before 154.0.8037.57 lets remote attackers corrupt memory and potentially disclose information or execute code inside the renderer by having a victim load attacker-controlled web content. The bug is unauthenticated and network-delivered (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8 High), but requires the user to visit or render a malicious page, and the assessed scope is unchanged (S:U), so renderer-scoped compromise would need a separate sandbox escape to reach full system impact; no public exploit identified at time of analysis, and no CISA KEV entry is associated with this CVE. Chrome ships on an aggressive release cadence, so the fix is already available in the stable channel and risk is concentrated in unpatched or auto-update-disabled fleets.
Google Chrome stable builds earlier than 154.0.8037.57 contain a race condition (CWE-362) that a remote attacker can trigger by getting a victim to load attacker-controlled web content, yielding high confidentiality, integrity, and availability impact within the browser's renderer sandbox. No authentication or special browser configuration is required (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), though user interaction - visiting or rendering hostile content - is the primary exploitation prerequisite, and a separate sandbox escape would be needed to reach the host. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV listing; the vendor has shipped a fixed release.
Google Chrome desktop builds earlier than 154.0.8037.57 are affected by an improper input validation flaw (CWE-20) rated CVSS 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), in which an unauthenticated remote attacker who persuades a user to load attacker-controlled web content can potentially achieve high confidentiality, integrity and availability impact that crosses a browser security boundary. Although the public tagging labels this issue as information disclosure, the assessed vector indicates broader high impact across all three CIA dimensions combined with a scope change (S:C), consistent with escaping the Chrome renderer sandbox. Exploitation is constrained by mandatory user interaction and high attack complexity, no public exploit has been identified at time of analysis, and Google has already shipped the fix in the stable channel, so auto-updating installations are remediated on restart.
Type confusion in Google Chrome's core rendering code allows remote attackers to corrupt memory and execute arbitrary code inside the browser renderer, affecting Chrome builds prior to 154.0.8037.57 on all platforms. Exploitation requires the victim to load attacker-controlled web content (a malicious or compromised page), matching the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H profile - no credentials are needed, and default configurations are exposed because the flaw sits in normal rendering rather than an optional feature. At the time of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; the impact is contained to the sandboxed renderer (S:U), so full host compromise would require a separate sandbox escape not described in this record, but the integrity and confidentiality impact within the renderer is high and the issue is rated 8.8.
Memory corruption via use-after-free in Google Chrome allows remote code execution or sensitive data disclosure in the renderer when a victim loads attacker-controlled web content in any version earlier than 154.0.8037.57. The flaw is network-reachable, low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High), but it does require the user to open a malicious page, ad or iframe, and because the scope is Unchanged the immediate impact stays inside the sandboxed renderer, so full host compromise realistically needs a second, chained sandbox-escape bug. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); a vendor patch is available in Chrome 154.0.8037.57.
Authentication bypass in Google Chrome prior to 154.0.8037.57 allows an attacker with local access to the machine to slip past an authorization check in a browser component, yielding high confidentiality, integrity, and availability impact. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) means no privileges and no user interaction are needed once local access exists, so the realistic prerequisite is the ability to execute or otherwise interact with the vulnerable Chrome component on the host rather than reaching it over the network; a purely remote, unauthenticated web-based attack is not supported by the available data. Exploitation signals are currently weak and non-urgent: EPSS is only 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, while the vendor has shipped a fixed build. Note that the affected feature or component is not named in the available data because no vendor description was published, so the exact local precondition should be confirmed against the Chrome release advisory.
An authorization-bypass flaw in Google Chrome desktop builds prior to 154.0.8037.57 lets remote attackers escape a security boundary by having the victim load crafted web content in the browser. Successful exploitation crosses a sandbox boundary (S:C) and can compromise confidentiality, integrity and availability of the affected system, but the CVSS vector (AC:H, UI:R) means the attacker must satisfy specific timing or memory-state conditions and the user must actively visit or interact with the malicious page. No confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and a vendor patch is available, so prioritization should reflect a high-severity but hard-to-trigger client-side issue rather than an imminent mass-exploitation event.
Use-after-free memory corruption in Google Chrome desktop (Stable channel below 154.0.8037.57) allows remote attackers to corrupt browser memory and reach code-execution-class impact when a victim browses an attacker-controlled page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) and carries high attack complexity (AC:H) because reliable reuse of the freed object depends on heap grooming or an allocation/timing race; the S:C scope change with C:H/I:H/A:H indicates the compromise can extend beyond the browser's original security context toward a sandbox escape. CVSS 3.1 base score is 8.3 (HIGH); no public exploit code was identified at time of analysis, and a vendor fix is available as Chrome 154.0.8037.57.
Type confusion in Google Chrome builds prior to 154.0.8037.57 lets a remote attacker who convinces a victim to load attacker-controlled web content corrupt memory inside the renderer and potentially achieve code execution in that process. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-843), meaning no authentication or privileges are required but exploitation is not zero-click: the victim must render a malicious page, and because scope is unchanged the initial compromise is confined to the renderer sandbox unless chained with a separate sandbox escape. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); a vendor-released patch is available in Chrome 154.0.8037.57.
Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 allows a remote, unauthenticated attacker to trigger heap memory corruption in the browser by convincing a victim to load attacker-controlled web content - a single page navigation is sufficient (UI:R, PR:N, AV:N). The flaw is rated CVSS 9.6 with a scope change (S:C), indicating the corruption can affect resources beyond the initially vulnerable component; no authentication, prior privileges, or non-default configuration is required, though exploitation hinges entirely on user interaction with a malicious or compromised page. Google has already shipped a fixed build (154.0.8037.57) on the stable channel, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine high-priority patch-and-update item rather than an emergency zero-day response.
Improper input validation in Google Chrome before 154.0.8037.57 can be triggered when a victim loads attacker-controlled web content, yielding a scope-changed impact rated high for confidentiality, integrity, and availability (CVSS 8.3). Exploitation is network-reachable without credentials (PR:N) but demands victim interaction (UI:R) plus non-trivial preconditions such as specific memory state, heap grooming, or timing windows (AC:H), and the affected component is undisclosed because chromium issue 517730821 is access-restricted. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available in the Chrome stable channel at 154.0.8037.57.
Use-after-free memory corruption in Google Chrome desktop builds earlier than 154.0.8037.57 (CWE-416) allows remote attackers to corrupt memory and potentially achieve code execution inside the renderer process when a victim opens a malicious or compromised web page. The flaw is remotely reachable with low attack complexity and no privileges required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but it hinges on user interaction and, because scope is unchanged, exploitation is contained to the sandboxed renderer; full host compromise realistically requires chaining a separate sandbox-escape bug. There is no confirmed active exploitation and no public exploit identified at time of analysis, so the elevated priority is driven by Chrome's ubiquity and the reliability of memory-safety bugs in this class rather than by observed attacks; vendor patches are already available.
Use-after-free memory corruption in Google Chrome before 154.0.8037.57 allows a remote, unauthenticated attacker to potentially escape the browser's renderer sandbox by persuading a victim to visit attacker-controlled web content. Exploitation requires mandatory user interaction (UI:R) and a high-complexity precondition such as precise heap grooming or a timing race (AC:H), and no public exploit has been identified at time of analysis. Google has issued a vendor-released patch in version 154.0.8037.57 that removes the vulnerable code path.
Use-after-free memory corruption in Google Chrome builds prior to 154.0.8037.57 allows a remote, unauthenticated attacker to corrupt memory and potentially execute code within the browser renderer by persuading a victim to load attacker-controlled web content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Exploitation requires the victim to open a malicious page or attacker-embedded content in a trusted site, and because the assessed scope is unchanged (S:U) the impact is initially confined to the renderer sandbox, so full host takeover would require a separate sandbox escape; Google has shipped a fixed build that is distributed through Chrome auto-update, shrinking the exposure window on kept-current fleets.
Google Chrome versions prior to 154.0.8037.57 contain an incorrectly-resolved name or reference flaw (CWE-706) that remote, unauthenticated attackers can trigger by convincing a user to load attacker-controlled web content; the issue is rated CVSS 3.1 8.3 High with scope change (S:C) and high confidentiality, integrity and availability impact. Exploitation is gated by mandatory user interaction (UI:R) and high attack complexity (AC:H), requiring non-trivial prerequisites such as specific timing, memory grooming or a race condition, and no public exploit code has been identified at time of analysis. Google has already shipped a stable-channel fix in Chrome 154.0.8037.57, so patched or auto-updated browsers are not exposed.
Improper output encoding in Google Chrome before the 154.0.8037.57 stable release allows a remote attacker to break out of the intended data context when a victim opens or interacts with an attacker-controlled web page, resulting in cross-boundary confidentiality and integrity impact according to the assessed CVSS vector (S:C/C:H/I:H/A:H). No authentication or pre-existing privileges are required (PR:N), but exploitation demands user interaction (UI:R) and non-trivial attacker-controlled preconditions (AC:H), which materially limits reliable, high-volume exploitation; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. Google has shipped a vendor patch, so upgrading the browser is a direct and effective fix rather than a mitigation-only situation.
A use-after-free in Google Chrome desktop can be triggered when a victim renders attacker-controlled web content, allowing memory corruption that may lead to code execution or disclosure of sensitive in-process data. Affected are Chrome desktop builds on Windows, macOS, and Linux prior to the September 2026 stable channel update; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) requires no authentication or privileges but does require the victim to open or load a malicious or compromised page, and the S:C metric indicates the attack can affect a component beyond the one that is corrupted. Vendor-released patch available; no public exploit identified at time of analysis, and the reporting originator is Ubuntu.
Use-after-free in Google Chrome affects desktop installations older than the 154.0.8037.57 stable channel release (September 2026), allowing an attacker who can get a victim to interact with crafted content to corrupt browser memory and potentially achieve code execution, data theft, or an information leak. The flaw is unauthenticated (PR:N) with low attack complexity but requires user interaction (UI:R), and the CVSS 3.1 vector scores it 7.8 with high confidentiality, integrity, and availability impact; note that the vector is AV:L, so the trigger is reached locally rather than as a pure remote drive-by. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though CWE-416 use-after-free flaws in browsers are historically attractive targets; a vendor fix is available in Chrome 154.0.8037.57.
Out-of-bounds write (CWE-787) in Google Chrome permits a remote, unauthenticated attacker to corrupt memory in the browser when a victim opens or is redirected to attacker-controlled web content (UI:R), with high confidentiality and integrity impact and a scope change (S:C) that the independent assessment reads as the corruption crossing the renderer sandbox boundary. Exploitation is not turnkey: the high attack complexity (AC:H) reflects a precondition the attacker must satisfy - typically heap grooming, a race, or a specific object/memory state - before the write is reachable, which constrains reliability and mass exploitation. No public exploit identified at time of analysis, and the fixed build 154.0.8037.57 is already shipping, so exposure is limited to un-updated Chrome clients, making this a genuine high-priority browser issue rather than a top-tier emergency.
Use-after-free memory corruption in Google Chrome builds earlier than 154.0.8037.57 allows a remote, unauthenticated attacker to corrupt memory in the browser by having a victim load attacker-controlled web content, yielding code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, CWE-416). Exploitation is network-reachable with low complexity and requires no credentials, but is gated on user interaction (UI:R) - the victim must visit a malicious page or view attacker-controlled content such as a malicious ad or iframe. Because scope is unchanged (S:U), the primitive is contained within the renderer process, so full host compromise realistically requires chaining an additional sandbox-escape vulnerability; a fixed build is already available and there is no public exploit identified at time of analysis (no CISA KEV listing, no confirmed in-the-wild activity reported in the supplied intelligence).
Improper input validation in Google Chrome before 154.0.8037.57 allows unauthenticated remote attackers to achieve high confidentiality, integrity, and availability impact with a scope change, though exploitation requires the victim to visit attacker-controlled web content and overcome high attack complexity. The flaw, tracked as CVE-2026-95341 with a CVSS 8.3 base score, affects default installations of Chrome on all platforms and could permit renderer-level code execution or sandbox escape; no public exploit identified at time of analysis. Vendor-released patch 154.0.8037.57 addresses the issue.
Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 lets an attacker who convinces a user to open or interact with crafted content trigger the reclamation and subsequent dereference of a freed object, yielding high confidentiality, integrity, and availability impact within the affected process (CVSS 3.1 base 7.8). The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates no authentication is required but that user interaction is mandatory and that the scored attack path is local rather than a pure remote drive-by; if the underlying bug proves remotely web-reachable, real-world exposure would be higher than the AV:L score implies. Vendor-released patched builds exist (154.0.8037.57 and later, stable-channel desktop update tracked as EUVD-2026-89226), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Out-of-bounds memory write in Google Chrome (desktop builds) lets remote, unauthenticated attackers corrupt browser memory when a victim loads attacker-controlled web content. The vendor CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U with C:H/I:H/A:H (base 8.8), so the only prerequisite is that a user navigates to or renders a malicious page, and because the vector is scope-unchanged the memory corruption is expected to remain within the renderer/browser process rather than granting an inherent sandbox escape. The underlying flaw is an out-of-bounds write (CWE-787) in Chrome builds predating the vendor's September 2026 stable channel fix; patched builds are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow (CWE-122) in Google Chrome's stable channel, addressed in the September 2026 desktop stable-channel update, lets remote, unauthenticated attackers corrupt heap memory in a vulnerable build and potentially escape the browser's renderer sandbox for full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.6, S:C). Exploitation requires the victim to interact with attacker-controlled web content - typically visiting a malicious page or rendering a hostile ad - so the practical window depends on how quickly users and Linux distributions apply the update. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; details remain limited because the referenced Chromium issue tracker entry is access-restricted.
Use-after-free memory corruption in Google Chrome's desktop stable channel lets remote, unauthenticated attackers achieve high-integrity/high-availability impact against a victim who simply renders attacker-controlled web content - the attacker must first convince the user to visit a malicious or compromised page (or load a malicious ad/iframe), which is why the assessed vector carries UI:R despite PR:N. Per our independent assessment, a practical exploit must win a heap-grooming race to reclaim the freed object and, because of the scope change (S:C), chain a further sandbox escape to fully realize the 9.6 severity, so exploitation is possible but not trivial. A vendor fix is available in the referenced Chrome stable channel update, and no public exploit code has been identified at time of analysis; the specific vulnerable component and exact fixed build are not disclosed in the available data.
Type confusion in Google Chrome's renderer allows remote attackers to corrupt memory and potentially achieve code execution inside the browser by convincing a victim to open a crafted web page; the attack is network-delivered, requires no authentication (PR:N), and has low complexity, with the only meaningful barrier being that the user must interact with attacker-controlled content (UI:R). A vendor patch is available per the September 2026 stable-channel update, and no public exploit code or confirmed active exploitation was identified at time of analysis, so the high priority here is driven mainly by Chrome's ubiquity rather than observed attacks. Because the CVSS scope is unchanged (S:U), full-system compromise as scored would likely require chaining this bug with a separate sandbox-escape vulnerability, while on its own the flaw is expected to yield renderer-level memory corruption, information disclosure, and potential arbitrary code within the sandboxed process.
Use-after-free in Google Chrome builds prior to 154.0.8037.57 allows remote, unauthenticated attackers to corrupt memory when a victim loads attacker-controlled web content, with potential for information disclosure and code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates low-complexity, network-reachable exploitation that is gated only by user interaction, and because scope is unchanged (S:U) any initial code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor patch in Chrome 154.0.8037.57 is available.
Out-of-bounds memory write in Google Chrome allows remote attackers to corrupt memory in a victim's browser by having them load attacker-controlled web content, rated CVSS 3.1 base 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). No authentication or non-default configuration is required, but exploitation depends on user interaction (the victim must visit or load the malicious page) and on running an unpatched build predating the September 2026 stable-channel fix; exact affected versions are not confirmed in the available data. The scope-change component suggests impact extending beyond the initially affected component - the classic profile of a renderer-process compromise crossing Chrome's process boundary - and while a vendor patch is available, no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Heap-based buffer overflow in Google Chrome desktop (stable channel) allows a remote, unauthenticated attacker to corrupt heap memory when a victim renders attacker-controlled web content such as a malicious page, iframe, or ad, yielding high impact to confidentiality, integrity, and availability with a changed scope that suggests effects can extend beyond the initially affected component. Exploitation requires user interaction (UI:R) - the victim must load the hostile content - but needs no credentials (PR:N), is network-reachable (AV:N) and low complexity (AC:L), making actively browsing, unpatched endpoints the realistic exposure. No public exploit has been identified at time of analysis; the referenced Chrome stable channel advisory and Chromium issue 551573368 confirm a vendor fix, and the independent assessment rates this a genuine high priority at CVSS 9.6.
Use-after-free in Google Chrome before 154.0.8037.57 can be triggered when a victim visits attacker-controlled web content, potentially allowing a remote unauthenticated attacker to corrupt memory and escape the renderer sandbox to execute code or disclose information. The vendor-assigned CVSS 3.1 score is 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting mandatory user interaction and high attack complexity. Vendor-released patch: 154.0.8037.57; no public exploit was identified at time of analysis.
Use-after-free code execution in PDFium, Chrome's bundled PDF rendering engine, allows a remote attacker who lures a victim into opening a crafted HTML page to run arbitrary code inside Chrome's renderer sandbox on any build prior to 153.0.8010.52. The bug is network-reachable and low-complexity with no authentication required, but it does require user interaction (the victim must navigate to the attacker-supplied page), and because the CVSS scope is unchanged (S:U) the compromise is contained within the renderer - full system takeover would require chaining a separate sandbox-escape flaw. Google has released a fixed build and there is no public exploit identified at time of analysis, though the CVSS 8.8 score and memory-corruption tag make timely patching advisable.
Heap buffer overflow in PDFium, the PDF rendering engine built into Google Chrome, allows a remote attacker to potentially execute arbitrary code inside the Chrome renderer sandbox on Windows systems running versions prior to 153.0.8010.52. Exploitation requires the victim to open an attacker-supplied crafted PDF (UI:R), so the attack is delivered via social engineering rather than direct network exploitation; no credentials are needed (PR:N) and default Chrome installations render PDFs without any special configuration. The vendor rates this High severity with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and although a vendor patch is available, no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). Because code execution is confined to the renderer sandbox, full host compromise would additionally require a separate sandbox-escape vulnerability not covered by this advisory.
Type confusion in the V8 JavaScript engine of Google Chrome prior to 153.0.8010.52 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim is socially engineered into loading a crafted HTML page (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not automatic: it requires user interaction, and because the resulting code execution is confined to the renderer sandbox, turning it into host-level compromise would require chaining a separate sandbox-escape vulnerability. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch (Chrome 153.0.8010.52) is available and this is a patch-now item for a ubiquitous product.
Local sandbox escape in Google Chrome on Windows (versions prior to 153.0.8010.52) lets an attacker who can already execute a program on the target host run arbitrary code outside the browser sandbox by abusing incorrect reference resolution in Chrome's Tracing component (CWE-706). The vendor rates it High with a CVSS of 8.1 (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning exploitation is local-only, requires no user interaction, but is gated by high attack complexity - consistent with a race or timing-dependent condition that is not reliably repeatable. No public exploit code has been identified at time of analysis, and because a local foothold is a prerequisite, this is realistically a chained sandbox-escape stage rather than a standalone initial-access vulnerability.
Use-after-free in the Dawn (WebGPU) component of Google Chrome on Android before 153.0.8010.52 allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page. Exploitation requires the user to load attacker-controlled content (CVSS 9.6, AV:N/AC:L/PR:N/UI:R), and Google rates the bug Chromium security severity Critical; the only affected configuration is Chrome on Android below the fixed 153.0.8010.52 build, and devices already updated are not exposed. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by the size of the unpatched Android install base rather than by observed attacks.
Use-after-free in Google Chrome's Extensions component allows a remote attacker to execute arbitrary code outside the browser sandbox on any desktop build prior to 153.0.8010.52, provided the victim loads a crafted, attacker-controlled extension. The flaw carries a 9.6 CVSS score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning no prior authentication to the target is needed, but the attacker must still persuade the user to install or load a malicious extension, which is the real-world limiting factor; the sandbox-scope change (S:C) reflects code execution escaping Chrome's renderer/extensions sandbox. A vendor patch shipping in 153.0.8010.52 is available, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Because Chrome auto-updates aggressively, the exposed population shrinks quickly once the fixed build propagates.
Improper input validation in ANGLE, Google Chrome's graphics abstraction layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by convincing a user to open a crafted HTML page in Chrome builds prior to 153.0.8010.47. Exploitation requires no authentication (PR:N) but does require user interaction (UI:R) - the victim must navigate to attacker-controlled or compromised content - and the scope-change metric (S:C) reflects that successful exploitation implies code execution escaping the renderer sandbox onto the host OS. The issue carries a Critical 9.6 CVSS rating and a vendor patch is available in Chrome 153.0.8010.47; there is no public exploit identified at time of analysis, and Chromium rates the underlying security severity as Medium.
Use-after-free in Google Chrome's DigitalCredentials component lets a remote, unauthenticated attacker execute arbitrary code outside the browser sandbox when a victim is socially engineered into loading a crafted HTML page, affecting all Chrome builds prior to 153.0.8010.47. Exploitation requires no credentials or elevated privileges (CVSS PR:N) but does require the user to navigate to the attacker-controlled page (UI:R), and the resulting scope change (S:C) means impact extends beyond the browser's sandbox boundary to full confidentiality, integrity, and availability loss. Google rates the issue High and has shipped a fix in the stable channel; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the current risk is driven by the ease of phishing/malvertising delivery rather than confirmed active exploitation.
Integer overflow in V8, Chrome's JavaScript engine, allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Chrome builds prior to 153.0.8010.47; the bug carries a high CVSS (9.6 as published, scored 8.8 under our scope-unchanged reassessment) because memory corruption in V8 can be leveraged for code execution, though impact is confined to the renderer process and full host compromise would require chaining a separate sandbox-escape flaw. Chrome ships on a rapid auto-update cadence and a vendor patch is available (153.0.8010.47), which limits mass exposure; EPSS is a modest 0.36% (30th percentile), CISA SSVC records no observed exploitation, and no public exploit code has been identified at time of analysis, so this is a high-severity memory-safety defect to prioritize for unpatched or update-delayed enterprise fleets rather than an active-emergency. No authentication is required (PR:N), but exploitation depends on user interaction: the victim must load attacker-controlled JavaScript with scripting enabled in the default configuration.
Use-after-free in Google Chrome's Auth component allows a remote attacker to achieve code execution outside the browser sandbox when a victim simply loads a crafted HTML page in any desktop Chrome build prior to 153.0.8010.47. Exploitation is unauthenticated and requires no special configuration - the only prerequisite is the user interaction of visiting or rendering the attacker-controlled page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), and because the flaw is not confined to the renderer, no separate sandbox-escape bug is needed to reach the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Google has released a fixed build (153.0.8010.47), and details remain restricted in the Chromium tracker until most users have updated.
Type confusion in Chrome's ServiceWorker implementation allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by enticing a victim to load a crafted HTML page in any Chrome build prior to 153.0.8010.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit or be redirected to attacker-controlled content - and the resulting code execution is confined to the sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. There is no public exploit identified at time of analysis, and a vendor-released patch (153.0.8010.47) is available, making this a high-priority but practically bounded patching task rather than an urgent zero-day response.
Remote code execution in SiYuan's Electron renderer occurs when users hover over search results, file tree items, or attribute view elements containing URL-encoded XSS payloads in document titles or metadata. The vulnerability chains a URL-decoding step (decodeURIComponent) with unsafe innerHTML assignment in tooltip rendering, bypassing the escapeAriaLabel sanitizer that only handles HTML entities but ignores %XX URL escapes. Because SiYuan's renderer runs with nodeIntegration:true and contextIsolation:false, the XSS escalates to arbitrary code execution via require('child_process'). Exploitation requires user interaction (hovering) but no authentication, and malicious payloads survive .sy.zip export/import and sync replication, enabling supply-chain and shared-workspace attacks. No public exploit code identified at time of analysis, though detailed proof-of-concept is published in the GitHub advisory.
Remote code execution in SiYuan's Electron desktop application allows authenticated attackers (or browser extensions on localhost) to inject malicious JavaScript through unescaped Attribute View names, escalating from stored XSS to arbitrary system command execution. The Go kernel backend stores AV names without HTML escaping, then embeds them via string replacement into HTML templates pushed over WebSocket. Three TypeScript renderer paths (render.ts, Title.ts, transaction.ts) consume this data using innerHTML/outerHTML without sanitization. Because the Electron main window runs with nodeIntegration:true and contextIsolation:false, script injection grants full Node.js API access—enabling attackers to spawn child processes (calc.exe/xcalc demonstrated in PoC), exfiltrate SSH keys, install backdoors, or pivot to cloud credentials. Payloads persist in JSON files under data/storage/av/, replicate across all sync transports (S3/WebDAV/cloud), survive .sy.zip export-import, and trigger for any user role (Administrator/Editor/Reader/Visitor) opening a document bound to the poisoned database view. CVSS 9.4 (Network/Low/None/High Confidentiality-Integrity-Availability + Scope Changed) reflects worst-case remote network vector, though the primary realistic attack path is via installed browser extensions (chrome-extension:// Origin explicitly allowlisted in session.go:277) calling the /api/transactions endpoint as an auto-granted admin on default installations with no Access Authorization Code. GitHub advisory GHSA-2h64-c999-c9r6 confirms patch available in kernel commit 0.0.0-20260512140701-d7b77d945e0d. No public exploit code identified at time of analysis, but detailed reproduction steps with curl payloads and Electron DevTools inspection are published in the advisory.
Chrome DevTools Protocol exposure in OpenClaw sandbox browser allows adjacent network attackers to remotely control sandboxed Chrome instances and access sensitive data. The CDP relay binds to 0.0.0.0 without source IP restrictions in versions before 2026.4.10, enabling attackers on the same Docker network to bypass sandbox isolation and execute arbitrary JavaScript in browser contexts. Vendor-released patch available (v2026.4.10); no public exploit identified at time of analysis. CVSS 9.0 reflects adjacent network attack vector with high confidentiality, integrity, and availability impact across virtual and system scopes.
Privilege escalation in Google Chrome versions prior to 148.0.7778.96 enables remote attackers to elevate privileges through malicious HTML pages exploiting improper cookie validation. The vulnerability requires user interaction (clicking a link or visiting a malicious site) but no authentication, making it viable for phishing or watering-hole attacks. CVSS score of 8.8 indicates high severity across confidentiality, integrity, and availability. Vendor-released patch available in Chrome 148.0.7778.96 per Google's stable channel update. EPSS and KEV data not provided; exploitation status unknown at time of analysis.
Heap corruption via malicious Chrome extension exploits use-after-free flaw in V8 JavaScript engine, affecting Chrome versions prior to 147.0.7727.55. Attacker must convince user to install a crafted extension to achieve potential remote code execution with high confidentiality, integrity, and availability impact. EPSS score of 0.01% (1st percentile) indicates minimal observed exploitation activity; no CISA KEV listing or public exploit code identified at time of analysis. Despite high CVSS 8.8
Remote code execution in Google Chrome's Federated Credential Management (FedCM) prior to version 146.0.7680.165 enables unauthenticated attackers to execute arbitrary code within the browser sandbox through a malicious HTML page. This use-after-free vulnerability in memory management affects Chrome on all supported platforms and requires only user interaction to trigger. A patch is available in Chrome 146.0.7680.165 and later.
Out-of-bounds memory write in Google Chrome's font handling prior to version 146.0.7680.165 enables remote code execution when users visit malicious HTML pages. An unauthenticated attacker can exploit an integer overflow vulnerability to achieve complete system compromise with high integrity and confidentiality impact. Patches are available for Chrome and affected Debian systems.
Sandboxed code execution in Google Chrome's WebGPU implementation (prior to 146.0.7680.165) stems from a use-after-free memory vulnerability that can be triggered via malicious HTML pages. An unauthenticated remote attacker can exploit this to execute arbitrary code within the Chrome sandbox without user interaction beyond viewing a crafted webpage. A patch is available for affected users.
This vulnerability is an out-of-bounds memory read flaw in the WebAudio API implementation within Google Chrome prior to version 146.0.7680.165. A remote attacker can craft a malicious HTML page to trigger the vulnerability and read sensitive memory contents, leading to information disclosure. Although no CVSS score or EPSS data is provided, the Chromium security severity is rated as High, and the vulnerability affects all users of vulnerable Chrome versions until patching.
Sandbox escape in Google Chrome prior to version 146.0.7680.165 via a use-after-free vulnerability in the Dawn graphics component enables remote attackers to execute arbitrary code when users visit malicious HTML pages. The vulnerability affects multiple platforms including Debian systems and requires only user interaction to trigger, bypassing Chrome's sandbox isolation. A patch is available to remediate this high-severity memory corruption flaw.
Google Chrome's WebGL implementation contains a heap buffer overflow that enables remote attackers to read arbitrary memory by serving a specially crafted HTML page to users prior to version 146.0.7680.165. This network-based vulnerability requires only user interaction and affects Chrome on all platforms, granting attackers access to sensitive data in the browser's memory. A patch is available and should be applied immediately given the high severity and potential for exploitation.
Out of bounds memory read in Google Chrome's CSS parser prior to version 146.0.7680.165 allows remote attackers to access sensitive memory contents through a malicious HTML page. The vulnerability requires user interaction and affects Chrome on multiple platforms including Debian systems, enabling attackers to potentially leak confidential data with high impact on confidentiality and integrity.
Unauthenticated remote attackers can exploit a heap buffer overflow in Google Chrome's WebAudio component (versions prior to 146.0.7680.165) by hosting malicious HTML pages that trigger out-of-bounds memory writes. This vulnerability enables arbitrary code execution with full system compromise potential. A patch is available from Google and Debian.
An arbitrary file-write vulnerability exists in Pega Browser Extension (PBE) affecting Pega Robot Studio developers using versions 22.1 or R25 who automate Google Chrome and Microsoft Edge browsers. A threat actor can craft a malicious website that, when visited by a developer during interrogation mode in Robot Studio, executes arbitrary file-write operations on the developer's system. This vulnerability does not affect end-user Robot Runtime deployments, limiting its blast radius to development environments.
Heap corruption in Google Chrome's ANGLE graphics library prior to version 146.0.7680.153 can be triggered remotely through a malicious HTML page, potentially enabling arbitrary code execution on affected systems. The vulnerability stems from an integer overflow condition that requires only user interaction with a crafted webpage, affecting Chrome users across Windows, macOS, and Linux platforms. A patch is available and security professionals should prioritize updating to the latest Chrome version to mitigate this high-severity risk.
Heap buffer overflow in Google Chrome's WebRTC component (versions prior to 146.0.7680.153) enables remote code execution when users visit a malicious webpage, requiring only user interaction to trigger the vulnerability. An attacker can exploit this heap corruption to execute arbitrary code with the privileges of the affected browser process. A patch is available for Chrome and affected Linux distributions including Ubuntu and Debian.
An out of bounds read vulnerability exists in the Blink rendering engine of Google Chrome prior to version 146.0.7680.153, allowing remote attackers to read memory outside intended buffer boundaries via a specially crafted HTML page. This vulnerability (CWE-125) has been classified as High severity by the Chromium security team and enables information disclosure attacks without requiring user interaction beyond visiting a malicious webpage. A vendor patch is available, and the vulnerability affects 9 Debian releases, indicating widespread downstream impact across Linux distributions.
Heap corruption in Google Chrome's V8 engine prior to version 146.0.7680.153 enables remote code execution when users visit malicious websites, affecting Chrome, Ubuntu, and Debian systems. An unauthenticated attacker can craft a specially designed HTML page to trigger memory corruption and achieve complete system compromise without user interaction beyond visiting the page. A patch is available for immediate deployment.
Memory disclosure in Google Chrome's Skia rendering engine prior to version 146.0.7680.153 enables unauthenticated attackers to read out-of-bounds memory contents by tricking users into visiting malicious web pages. Affected users across Chrome, Ubuntu, and Debian distributions face potential information leakage including sensitive data from process memory. A patch is available for immediate deployment.
Heap corruption in Google Chrome's WebAudio component (versions prior to 146.0.7680.153) can be triggered through out-of-bounds memory access when processing malicious HTML pages, enabling remote attackers to achieve arbitrary code execution without user interaction beyond viewing the page. The vulnerability affects Chrome, Ubuntu, and Debian systems, with patches now available across all platforms.
Heap memory corruption in Google Chrome prior to version 146.0.7680.153 can be triggered through malicious browser extensions, affecting Chrome users on Google, Ubuntu, and Debian systems. An attacker must convince a user to install a compromised extension to exploit this use-after-free vulnerability and potentially achieve code execution. A patch is available.
Heap memory corruption in Google Chrome's V8 engine (versions prior to 146.0.7680.153) stems from type confusion vulnerabilities that can be triggered through malicious HTML pages without user privileges. An unauthenticated remote attacker can exploit this to achieve arbitrary code execution or crash the browser. The vulnerability affects Chrome, Ubuntu, and Debian systems, with patches now available.
A use-after-free vulnerability in Google Chrome's Digital Credentials API prior to version 146.0.7680.153 enables attackers with a compromised renderer process to escape the sandbox and potentially achieve code execution through a specially crafted HTML page. The vulnerability affects Chrome on multiple platforms including Ubuntu and Debian systems, requiring user interaction to trigger but presenting high impact across confidentiality, integrity, and availability. A patch is available in Chrome 146.0.7680.153 and later versions.
Heap buffer overflow in PDFium within Google Chrome versions prior to 146.0.7680.153 enables remote attackers to corrupt heap memory and potentially achieve code execution by delivering a malicious PDF file. The vulnerability requires user interaction to open the crafted PDF but no authentication or special privileges. Patches are available for affected Google Chrome, Ubuntu, and Debian systems.
Heap memory corruption in Google Chrome versions prior to 146.0.7680.153 can be triggered through a use-after-free vulnerability in the Network component when a user visits a malicious HTML page. An unauthenticated remote attacker can exploit this to achieve arbitrary code execution with high integrity and confidentiality impact. A patch is available for Chrome, Ubuntu, and Debian users.
Heap corruption in Google Chrome's ANGLE graphics library on Windows versions prior to 146.0.7680.153 can be triggered through integer overflow when processing maliciously crafted HTML pages. An unauthenticated remote attacker can exploit this vulnerability by deceiving users into visiting a malicious website, potentially achieving arbitrary code execution. A patch is available across affected platforms including Google Chrome, Microsoft Edge, and various Linux distributions.
A renderer process sandbox escape vulnerability exists in Google Chrome prior to version 146.0.7680.153 due to insufficient input validation in the Navigation component. An attacker who has already compromised the renderer process can exploit this via a crafted HTML page to escape the sandbox and gain elevated privileges on the host system. A patch is available from Google, and the vulnerability is tracked in the EUVD database with High severity classification.
Heap corruption in Google Chrome's V8 engine prior to version 146.0.7680.153 can be triggered through out-of-bounds memory writes when a user visits a malicious webpage. An unauthenticated remote attacker can exploit this vulnerability to achieve arbitrary code execution with high integrity and confidentiality impact. A security patch is available for affected users on Chrome, Ubuntu, and Debian systems.
Heap memory corruption in Google Chrome's Blink rendering engine prior to version 146.0.7680.153 can be triggered through a malicious HTML page, potentially enabling remote code execution. An unauthenticated attacker requires only user interaction to exploit this use-after-free vulnerability across network boundaries. A patch is available for affected Chrome, Ubuntu, and Debian users.
Heap buffer overflow in Google Chrome's ANGLE graphics library (versions prior to 146.0.7680.153) enables remote attackers to corrupt heap memory and potentially achieve arbitrary code execution through malicious HTML pages requiring only user interaction. The vulnerability affects Chrome on multiple platforms including Ubuntu and Debian systems. A patch is available and should be applied immediately given the high severity and attack accessibility.
Heap corruption via use-after-free in Google Chrome's WebRTC implementation (versions prior to 146.0.7680.153) enables remote attackers to achieve arbitrary code execution through malicious HTML pages, requiring only user interaction. The vulnerability affects Chrome, Ubuntu, and Debian systems with a CVSS score of 8.8, though a patch is available.
Heap memory corruption in Google Chrome's WebRTC implementation prior to version 146.0.7680.153 enables remote attackers to execute arbitrary code by tricking users into visiting malicious websites. The use-after-free vulnerability requires only user interaction and affects Chrome on multiple platforms including Ubuntu and Debian systems. A patch is available to address this high-severity flaw.
Stack buffer overflow in Google Chrome's WebRTC implementation prior to version 146.0.7680.153 enables remote attackers to corrupt stack memory and achieve code execution through maliciously crafted HTML pages. The vulnerability affects Chrome, and potentially downstream products including Chromium-based browsers, requiring only user interaction and no authentication. A patch is available across affected platforms including Ubuntu and Debian.
Sandboxed arbitrary code execution in Google Chrome's WebAudio component (versions prior to 146.0.7680.153) can be triggered remotely through malicious HTML, requiring only user interaction. An attacker can craft a weaponized webpage to break out of the Chrome sandbox and execute arbitrary code on affected systems. This high-severity vulnerability impacts Chrome, Ubuntu, and Debian users, with patches now available.
Google Chrome versions prior to 146.0.7680.153 contain a heap buffer overflow in CSS parsing that enables remote code execution when users visit malicious HTML pages. An unauthenticated attacker can trigger heap memory corruption through a crafted webpage, potentially achieving arbitrary code execution with user privileges. A patch is available and should be applied immediately to all affected systems.
Heap corruption in Google Chrome versions before 146.0.7680.153 results from a use-after-free vulnerability in the Base component, enabling remote attackers to execute arbitrary code through malicious HTML pages. The attack requires user interaction but no authentication, affecting Chrome on multiple platforms including Linux distributions. A patch is available to remediate this critical-severity vulnerability.
An out-of-bounds write in the GPU process of Google Chrome prior to 154.0.8037.92 allows an attacker to break out of the browser sandbox and potentially execute arbitrary code at the browser's privilege level via a crafted HTML page. The attack is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed exploitation conditions indicate the attacker must have already compromised Chrome's renderer process, and the victim must load attacker-controlled content, making this a sandbox-escape link in a multi-stage exploit chain rather than a directly reachable remote bug. Only Chrome builds below 154.0.8037.92 are affected, and effective exploitation requires overcoming non-trivial memory-corruption and chaining conditions (AC:H); no public exploit has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none'. Google has released a vendor patch in Chrome 154.0.8037.92.
Use-after-free in Chrome's Views UI framework allows a remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code outside the browser sandbox on any Chrome desktop build prior to 154.0.8037.92. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) confirms remote, unauthenticated attack with no special privileges, but also confirms that user interaction - social engineering to get the victim to load the page - is mandatory, which is the main limiting factor; the scope change (S:C) reflects that impact is not confined to the renderer. No public exploit was identified at the time of analysis and CISA's SSVC assessment rates exploitation as 'none' and not automatable, but a vendor patch is available from Google and the technical impact is total, making prompt updating the priority.
Use-after-free in Google Chrome's FullScreen implementation prior to 154.0.8037.92 allows a remote, unauthenticated attacker to execute arbitrary code outside the browser's renderer sandbox by enticing a victim to load a crafted HTML page. The vulnerability carries a CVSS 3.1 base score of 9.6 with scope change (S:C) and High confidentiality, integrity, and availability impact, reflecting that successful exploitation escapes the sandbox rather than being confined to a compromised renderer. No public exploit code and no confirmed active exploitation have been identified at time of analysis (SSVC Exploitation: none), and the attack is not automatable for mass exploitation because it requires the victim to visit attacker-controlled content (UI:R); Google has released a vendor patch in Chrome 154.0.8037.92.
Type confusion in V8, Chrome's JavaScript engine, allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation requires user interaction (CVSS PR:N/UI:R) - the target must navigate to attacker-controlled or compromised content - and no public exploit code has been identified at time of analysis, with CISA's SSVC assessment recording Exploitation = none. Because V8 is the always-on JavaScript engine, any HTML/JS-rendering context is a viable trigger with no special configuration needed, but the resulting code execution is confined to the renderer sandbox (S:U), so full host compromise requires chaining a separate sandbox-escape vulnerability.
Remote code execution outside the browser sandbox is possible in Google Chrome builds prior to 154.0.8037.92 through a use-after-free in the Passwords component, which a remote attacker can trigger by convincing a victim to open a crafted HTML page. Because the CVSS vector is PR:N/UI:R, no authentication or special configuration is required, but the victim must actively navigate to the attacker's content and a successful chain must also defeat the sandbox, leaving full compromise achievable but non-trivial. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, while Google has released a vendor patch in Chrome 154.0.8037.92; the scope-change (S:C) rating reflects that a working exploit would escape the renderer boundary rather than remain confined to a single security context.
A use-after-free in Chrome's Views UI framework allows an unauthenticated remote attacker who convinces a victim to open a crafted HTML page to execute arbitrary code outside the browser sandbox in Google Chrome desktop builds prior to 154.0.8037.92. Per the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), no credentials or special browser configuration are required - default installations are affected - but exploitation depends on user interaction with attacker-controlled content and on overcoming the difficulty of turning a use-after-free into a reliable sandbox escape, so a working exploit is not trivial. No public exploit code has been identified at time of analysis and the issue is not confirmed actively exploited; a vendor patch (154.0.8037.92) is available, which makes rapid update the decisive control.
Type confusion in the V8 JavaScript engine in Google Chrome prior to 154.0.8037.92 lets remote attackers execute arbitrary code inside the renderer sandbox by luring a victim into opening a crafted HTML page. Exploitation is unauthenticated (CVSS:3.1/AV:N/AC:L/PR:N/UI:R) but requires user interaction - the victim must render the attacker's page - and because V8 runs JavaScript on essentially every page, default desktop configurations are exposed. Impact is scored 8.8 High (C:H/I:H/A:H) with the important caveat that code execution is confined to the sandbox, so full host compromise requires chaining a separate sandbox-escape bug; no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available as Chrome 154.0.8037.92.
Type confusion in Chrome's V8 JavaScript engine lets a remote attacker execute arbitrary code inside the V8 sandbox when a victim loads a crafted HTML page in any Chrome build prior to 154.0.8037.92. Exploitation requires user interaction (the victim must browse to the malicious or compromised page) but no authentication or special configuration, since default JavaScript execution is sufficient; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Google has released a vendor patch in 154.0.8037.92, and at time of analysis no public exploit code or confirmed active exploitation (CISA KEV) has been identified. Because the flaw is contained by the V8 sandbox, full host compromise would require chaining a separate sandbox-escape vulnerability.
Remote code execution outside the browser sandbox can potentially be achieved by an unauthenticated attacker in Google Chrome versions prior to 154.0.8037.92 by exploiting a use-after-free in the Bluetooth subsystem. The victim must navigate to a crafted HTML page that exercises the Web Bluetooth code path (UI:R), and successful exploitation can lead to arbitrary code execution with a scope change (S:C), meaning a sandbox escape. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in Chrome 154.0.8037.92.
Type confusion in the V8 JavaScript engine allows remote code execution inside the Chrome renderer sandbox on any unpatched build prior to 154.0.8037.92. Because the flaw is triggered by a crafted HTML page, the attacker needs only to convince a victim to visit it - no credentials or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8, Chromium severity High) - and exploitation works against default configurations with JavaScript enabled. Successful exploitation yields arbitrary code execution confined to the renderer sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape bug; exploitability is high but not trivially mass-exploitable. No public exploit was identified at time of analysis, and our assessment rates this as a genuinely high-priority browser vulnerability rather than an inflated-CVSS artifact. Vendor-released patch: 154.0.8037.92.
Sandbox escape in Google Chrome on Windows prior to 154.0.8037.92 allows a local attacker to execute arbitrary code outside the browser sandbox through improper privilege management in the Mojo IPC layer. Exploitation requires local access to a Windows host and some user interaction (UI:R) but no authentication (PR:N), and it functions as a second-stage capability: an attacker who already holds a sandboxed foothold, such as a compromised renderer, can leverage the flaw to reach the full privileges of the browser process, yielding high confidentiality, integrity, and availability impact with a scope change. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the EPSS-style risk signal is low; non-Windows Chrome builds are unaffected because the defect is Windows-specific. A vendor patch is available in Chrome 154.0.8037.92.
Remote code execution is possible in Google Chrome on Android builds prior to 154.0.8037.92, where a heap-based buffer overflow in the ANGLE graphics layer can be triggered when a user renders a crafted HTML page. Successful exploitation corrupts memory out of bounds and, per Google's Critical severity rating and the scope-changed CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), can potentially execute arbitrary code outside the browser sandbox. The issue is remotely deliverable without authentication but hinges on user interaction, and no public exploit code or active exploitation has been identified at time of analysis; CISA's SSVC assessment likewise records no observed exploitation and rates the flaw non-automatable, while a vendor patch (154.0.8037.92) is available.
Use-after-free in Google Chrome desktop versions prior to the September 2026 stable channel update allows remote attackers to cause information disclosure and memory corruption when a victim loads attacker-controlled web content. Exploitation requires user interaction (UI:R) and a high-complexity timing or heap-state precondition (AC:H), but no authentication (PR:N); the assessed CVSS vector is AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, yielding a base score of 8.3. A vendor patch is available in the September 2026 stable channel update, and no public exploit code or active exploitation has been identified in the provided intelligence.
Type confusion (CWE-843) in Google Chrome before 154.0.8037.57 lets remote attackers corrupt memory and potentially disclose information or execute code inside the renderer by having a victim load attacker-controlled web content. The bug is unauthenticated and network-delivered (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base score 8.8 High), but requires the user to visit or render a malicious page, and the assessed scope is unchanged (S:U), so renderer-scoped compromise would need a separate sandbox escape to reach full system impact; no public exploit identified at time of analysis, and no CISA KEV entry is associated with this CVE. Chrome ships on an aggressive release cadence, so the fix is already available in the stable channel and risk is concentrated in unpatched or auto-update-disabled fleets.
Google Chrome stable builds earlier than 154.0.8037.57 contain a race condition (CWE-362) that a remote attacker can trigger by getting a victim to load attacker-controlled web content, yielding high confidentiality, integrity, and availability impact within the browser's renderer sandbox. No authentication or special browser configuration is required (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), though user interaction - visiting or rendering hostile content - is the primary exploitation prerequisite, and a separate sandbox escape would be needed to reach the host. Exploitation status: no public exploit identified at time of analysis, and there is no CISA KEV listing; the vendor has shipped a fixed release.
Google Chrome desktop builds earlier than 154.0.8037.57 are affected by an improper input validation flaw (CWE-20) rated CVSS 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), in which an unauthenticated remote attacker who persuades a user to load attacker-controlled web content can potentially achieve high confidentiality, integrity and availability impact that crosses a browser security boundary. Although the public tagging labels this issue as information disclosure, the assessed vector indicates broader high impact across all three CIA dimensions combined with a scope change (S:C), consistent with escaping the Chrome renderer sandbox. Exploitation is constrained by mandatory user interaction and high attack complexity, no public exploit has been identified at time of analysis, and Google has already shipped the fix in the stable channel, so auto-updating installations are remediated on restart.
Type confusion in Google Chrome's core rendering code allows remote attackers to corrupt memory and execute arbitrary code inside the browser renderer, affecting Chrome builds prior to 154.0.8037.57 on all platforms. Exploitation requires the victim to load attacker-controlled web content (a malicious or compromised page), matching the CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H profile - no credentials are needed, and default configurations are exposed because the flaw sits in normal rendering rather than an optional feature. At the time of analysis there is no CISA KEV listing and no public exploit identified at time of analysis; the impact is contained to the sandboxed renderer (S:U), so full host compromise would require a separate sandbox escape not described in this record, but the integrity and confidentiality impact within the renderer is high and the issue is rated 8.8.
Memory corruption via use-after-free in Google Chrome allows remote code execution or sensitive data disclosure in the renderer when a victim loads attacker-controlled web content in any version earlier than 154.0.8037.57. The flaw is network-reachable, low-complexity and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8 High), but it does require the user to open a malicious page, ad or iframe, and because the scope is Unchanged the immediate impact stays inside the sandboxed renderer, so full host compromise realistically needs a second, chained sandbox-escape bug. There is no public exploit identified at time of analysis and no confirmed active exploitation (CISA KEV); a vendor patch is available in Chrome 154.0.8037.57.
Authentication bypass in Google Chrome prior to 154.0.8037.57 allows an attacker with local access to the machine to slip past an authorization check in a browser component, yielding high confidentiality, integrity, and availability impact. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:N/UI:N) means no privileges and no user interaction are needed once local access exists, so the realistic prerequisite is the ability to execute or otherwise interact with the vulnerable Chrome component on the host rather than reaching it over the network; a purely remote, unauthenticated web-based attack is not supported by the available data. Exploitation signals are currently weak and non-urgent: EPSS is only 0.22% (12th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, while the vendor has shipped a fixed build. Note that the affected feature or component is not named in the available data because no vendor description was published, so the exact local precondition should be confirmed against the Chrome release advisory.
An authorization-bypass flaw in Google Chrome desktop builds prior to 154.0.8037.57 lets remote attackers escape a security boundary by having the victim load crafted web content in the browser. Successful exploitation crosses a sandbox boundary (S:C) and can compromise confidentiality, integrity and availability of the affected system, but the CVSS vector (AC:H, UI:R) means the attacker must satisfy specific timing or memory-state conditions and the user must actively visit or interact with the malicious page. No confirmed active exploitation (not in CISA KEV), no public exploit code identified at time of analysis, and a vendor patch is available, so prioritization should reflect a high-severity but hard-to-trigger client-side issue rather than an imminent mass-exploitation event.
Use-after-free memory corruption in Google Chrome desktop (Stable channel below 154.0.8037.57) allows remote attackers to corrupt browser memory and reach code-execution-class impact when a victim browses an attacker-controlled page. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) and carries high attack complexity (AC:H) because reliable reuse of the freed object depends on heap grooming or an allocation/timing race; the S:C scope change with C:H/I:H/A:H indicates the compromise can extend beyond the browser's original security context toward a sandbox escape. CVSS 3.1 base score is 8.3 (HIGH); no public exploit code was identified at time of analysis, and a vendor fix is available as Chrome 154.0.8037.57.
Type confusion in Google Chrome builds prior to 154.0.8037.57 lets a remote attacker who convinces a victim to load attacker-controlled web content corrupt memory inside the renderer and potentially achieve code execution in that process. The flaw is rated CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-843), meaning no authentication or privileges are required but exploitation is not zero-click: the victim must render a malicious page, and because scope is unchanged the initial compromise is confined to the renderer sandbox unless chained with a separate sandbox escape. No public exploit code has been identified at time of analysis and the issue is not listed as confirmed actively exploited (CISA KEV); a vendor-released patch is available in Chrome 154.0.8037.57.
Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 allows a remote, unauthenticated attacker to trigger heap memory corruption in the browser by convincing a victim to load attacker-controlled web content - a single page navigation is sufficient (UI:R, PR:N, AV:N). The flaw is rated CVSS 9.6 with a scope change (S:C), indicating the corruption can affect resources beyond the initially vulnerable component; no authentication, prior privileges, or non-default configuration is required, though exploitation hinges entirely on user interaction with a malicious or compromised page. Google has already shipped a fixed build (154.0.8037.57) on the stable channel, and no public exploit code or confirmed active exploitation was identified at time of analysis, making this a genuine high-priority patch-and-update item rather than an emergency zero-day response.
Improper input validation in Google Chrome before 154.0.8037.57 can be triggered when a victim loads attacker-controlled web content, yielding a scope-changed impact rated high for confidentiality, integrity, and availability (CVSS 8.3). Exploitation is network-reachable without credentials (PR:N) but demands victim interaction (UI:R) plus non-trivial preconditions such as specific memory state, heap grooming, or timing windows (AC:H), and the affected component is undisclosed because chromium issue 517730821 is access-restricted. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available in the Chrome stable channel at 154.0.8037.57.
Use-after-free memory corruption in Google Chrome desktop builds earlier than 154.0.8037.57 (CWE-416) allows remote attackers to corrupt memory and potentially achieve code execution inside the renderer process when a victim opens a malicious or compromised web page. The flaw is remotely reachable with low attack complexity and no privileges required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but it hinges on user interaction and, because scope is unchanged, exploitation is contained to the sandboxed renderer; full host compromise realistically requires chaining a separate sandbox-escape bug. There is no confirmed active exploitation and no public exploit identified at time of analysis, so the elevated priority is driven by Chrome's ubiquity and the reliability of memory-safety bugs in this class rather than by observed attacks; vendor patches are already available.
Use-after-free memory corruption in Google Chrome before 154.0.8037.57 allows a remote, unauthenticated attacker to potentially escape the browser's renderer sandbox by persuading a victim to visit attacker-controlled web content. Exploitation requires mandatory user interaction (UI:R) and a high-complexity precondition such as precise heap grooming or a timing race (AC:H), and no public exploit has been identified at time of analysis. Google has issued a vendor-released patch in version 154.0.8037.57 that removes the vulnerable code path.
Use-after-free memory corruption in Google Chrome builds prior to 154.0.8037.57 allows a remote, unauthenticated attacker to corrupt memory and potentially execute code within the browser renderer by persuading a victim to load attacker-controlled web content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). No public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV. Exploitation requires the victim to open a malicious page or attacker-embedded content in a trusted site, and because the assessed scope is unchanged (S:U) the impact is initially confined to the renderer sandbox, so full host takeover would require a separate sandbox escape; Google has shipped a fixed build that is distributed through Chrome auto-update, shrinking the exposure window on kept-current fleets.
Google Chrome versions prior to 154.0.8037.57 contain an incorrectly-resolved name or reference flaw (CWE-706) that remote, unauthenticated attackers can trigger by convincing a user to load attacker-controlled web content; the issue is rated CVSS 3.1 8.3 High with scope change (S:C) and high confidentiality, integrity and availability impact. Exploitation is gated by mandatory user interaction (UI:R) and high attack complexity (AC:H), requiring non-trivial prerequisites such as specific timing, memory grooming or a race condition, and no public exploit code has been identified at time of analysis. Google has already shipped a stable-channel fix in Chrome 154.0.8037.57, so patched or auto-updated browsers are not exposed.
Improper output encoding in Google Chrome before the 154.0.8037.57 stable release allows a remote attacker to break out of the intended data context when a victim opens or interacts with an attacker-controlled web page, resulting in cross-boundary confidentiality and integrity impact according to the assessed CVSS vector (S:C/C:H/I:H/A:H). No authentication or pre-existing privileges are required (PR:N), but exploitation demands user interaction (UI:R) and non-trivial attacker-controlled preconditions (AC:H), which materially limits reliable, high-volume exploitation; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV. Google has shipped a vendor patch, so upgrading the browser is a direct and effective fix rather than a mitigation-only situation.
A use-after-free in Google Chrome desktop can be triggered when a victim renders attacker-controlled web content, allowing memory corruption that may lead to code execution or disclosure of sensitive in-process data. Affected are Chrome desktop builds on Windows, macOS, and Linux prior to the September 2026 stable channel update; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) requires no authentication or privileges but does require the victim to open or load a malicious or compromised page, and the S:C metric indicates the attack can affect a component beyond the one that is corrupted. Vendor-released patch available; no public exploit identified at time of analysis, and the reporting originator is Ubuntu.
Use-after-free in Google Chrome affects desktop installations older than the 154.0.8037.57 stable channel release (September 2026), allowing an attacker who can get a victim to interact with crafted content to corrupt browser memory and potentially achieve code execution, data theft, or an information leak. The flaw is unauthenticated (PR:N) with low attack complexity but requires user interaction (UI:R), and the CVSS 3.1 vector scores it 7.8 with high confidentiality, integrity, and availability impact; note that the vector is AV:L, so the trigger is reached locally rather than as a pure remote drive-by. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), though CWE-416 use-after-free flaws in browsers are historically attractive targets; a vendor fix is available in Chrome 154.0.8037.57.
Out-of-bounds write (CWE-787) in Google Chrome permits a remote, unauthenticated attacker to corrupt memory in the browser when a victim opens or is redirected to attacker-controlled web content (UI:R), with high confidentiality and integrity impact and a scope change (S:C) that the independent assessment reads as the corruption crossing the renderer sandbox boundary. Exploitation is not turnkey: the high attack complexity (AC:H) reflects a precondition the attacker must satisfy - typically heap grooming, a race, or a specific object/memory state - before the write is reachable, which constrains reliability and mass exploitation. No public exploit identified at time of analysis, and the fixed build 154.0.8037.57 is already shipping, so exposure is limited to un-updated Chrome clients, making this a genuine high-priority browser issue rather than a top-tier emergency.
Use-after-free memory corruption in Google Chrome builds earlier than 154.0.8037.57 allows a remote, unauthenticated attacker to corrupt memory in the browser by having a victim load attacker-controlled web content, yielding code execution with high confidentiality, integrity, and availability impact (CVSS 3.1 base 8.8, CWE-416). Exploitation is network-reachable with low complexity and requires no credentials, but is gated on user interaction (UI:R) - the victim must visit a malicious page or view attacker-controlled content such as a malicious ad or iframe. Because scope is unchanged (S:U), the primitive is contained within the renderer process, so full host compromise realistically requires chaining an additional sandbox-escape vulnerability; a fixed build is already available and there is no public exploit identified at time of analysis (no CISA KEV listing, no confirmed in-the-wild activity reported in the supplied intelligence).
Improper input validation in Google Chrome before 154.0.8037.57 allows unauthenticated remote attackers to achieve high confidentiality, integrity, and availability impact with a scope change, though exploitation requires the victim to visit attacker-controlled web content and overcome high attack complexity. The flaw, tracked as CVE-2026-95341 with a CVSS 8.3 base score, affects default installations of Chrome on all platforms and could permit renderer-level code execution or sandbox escape; no public exploit identified at time of analysis. Vendor-released patch 154.0.8037.57 addresses the issue.
Use-after-free memory corruption in Google Chrome desktop builds prior to 154.0.8037.57 lets an attacker who convinces a user to open or interact with crafted content trigger the reclamation and subsequent dereference of a freed object, yielding high confidentiality, integrity, and availability impact within the affected process (CVSS 3.1 base 7.8). The assessed vector (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates no authentication is required but that user interaction is mandatory and that the scored attack path is local rather than a pure remote drive-by; if the underlying bug proves remotely web-reachable, real-world exposure would be higher than the AV:L score implies. Vendor-released patched builds exist (154.0.8037.57 and later, stable-channel desktop update tracked as EUVD-2026-89226), and no public exploit code or confirmed active exploitation has been identified at time of analysis.
Out-of-bounds memory write in Google Chrome (desktop builds) lets remote, unauthenticated attackers corrupt browser memory when a victim loads attacker-controlled web content. The vendor CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:R/S:U with C:H/I:H/A:H (base 8.8), so the only prerequisite is that a user navigates to or renders a malicious page, and because the vector is scope-unchanged the memory corruption is expected to remain within the renderer/browser process rather than granting an inherent sandbox escape. The underlying flaw is an out-of-bounds write (CWE-787) in Chrome builds predating the vendor's September 2026 stable channel fix; patched builds are not affected, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Heap-based buffer overflow (CWE-122) in Google Chrome's stable channel, addressed in the September 2026 desktop stable-channel update, lets remote, unauthenticated attackers corrupt heap memory in a vulnerable build and potentially escape the browser's renderer sandbox for full confidentiality, integrity, and availability impact (CVSS 3.1 base 9.6, S:C). Exploitation requires the victim to interact with attacker-controlled web content - typically visiting a malicious page or rendering a hostile ad - so the practical window depends on how quickly users and Linux distributions apply the update. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV; details remain limited because the referenced Chromium issue tracker entry is access-restricted.
Use-after-free memory corruption in Google Chrome's desktop stable channel lets remote, unauthenticated attackers achieve high-integrity/high-availability impact against a victim who simply renders attacker-controlled web content - the attacker must first convince the user to visit a malicious or compromised page (or load a malicious ad/iframe), which is why the assessed vector carries UI:R despite PR:N. Per our independent assessment, a practical exploit must win a heap-grooming race to reclaim the freed object and, because of the scope change (S:C), chain a further sandbox escape to fully realize the 9.6 severity, so exploitation is possible but not trivial. A vendor fix is available in the referenced Chrome stable channel update, and no public exploit code has been identified at time of analysis; the specific vulnerable component and exact fixed build are not disclosed in the available data.
Type confusion in Google Chrome's renderer allows remote attackers to corrupt memory and potentially achieve code execution inside the browser by convincing a victim to open a crafted web page; the attack is network-delivered, requires no authentication (PR:N), and has low complexity, with the only meaningful barrier being that the user must interact with attacker-controlled content (UI:R). A vendor patch is available per the September 2026 stable-channel update, and no public exploit code or confirmed active exploitation was identified at time of analysis, so the high priority here is driven mainly by Chrome's ubiquity rather than observed attacks. Because the CVSS scope is unchanged (S:U), full-system compromise as scored would likely require chaining this bug with a separate sandbox-escape vulnerability, while on its own the flaw is expected to yield renderer-level memory corruption, information disclosure, and potential arbitrary code within the sandboxed process.
Use-after-free in Google Chrome builds prior to 154.0.8037.57 allows remote, unauthenticated attackers to corrupt memory when a victim loads attacker-controlled web content, with potential for information disclosure and code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8) indicates low-complexity, network-reachable exploitation that is gated only by user interaction, and because scope is unchanged (S:U) any initial code execution is confined to the renderer sandbox, so full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and a vendor patch in Chrome 154.0.8037.57 is available.
Out-of-bounds memory write in Google Chrome allows remote attackers to corrupt memory in a victim's browser by having them load attacker-controlled web content, rated CVSS 3.1 base 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). No authentication or non-default configuration is required, but exploitation depends on user interaction (the victim must visit or load the malicious page) and on running an unpatched build predating the September 2026 stable-channel fix; exact affected versions are not confirmed in the available data. The scope-change component suggests impact extending beyond the initially affected component - the classic profile of a renderer-process compromise crossing Chrome's process boundary - and while a vendor patch is available, no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis.
Heap-based buffer overflow in Google Chrome desktop (stable channel) allows a remote, unauthenticated attacker to corrupt heap memory when a victim renders attacker-controlled web content such as a malicious page, iframe, or ad, yielding high impact to confidentiality, integrity, and availability with a changed scope that suggests effects can extend beyond the initially affected component. Exploitation requires user interaction (UI:R) - the victim must load the hostile content - but needs no credentials (PR:N), is network-reachable (AV:N) and low complexity (AC:L), making actively browsing, unpatched endpoints the realistic exposure. No public exploit has been identified at time of analysis; the referenced Chrome stable channel advisory and Chromium issue 551573368 confirm a vendor fix, and the independent assessment rates this a genuine high priority at CVSS 9.6.
Use-after-free in Google Chrome before 154.0.8037.57 can be triggered when a victim visits attacker-controlled web content, potentially allowing a remote unauthenticated attacker to corrupt memory and escape the renderer sandbox to execute code or disclose information. The vendor-assigned CVSS 3.1 score is 8.3 (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H), reflecting mandatory user interaction and high attack complexity. Vendor-released patch: 154.0.8037.57; no public exploit was identified at time of analysis.
Use-after-free code execution in PDFium, Chrome's bundled PDF rendering engine, allows a remote attacker who lures a victim into opening a crafted HTML page to run arbitrary code inside Chrome's renderer sandbox on any build prior to 153.0.8010.52. The bug is network-reachable and low-complexity with no authentication required, but it does require user interaction (the victim must navigate to the attacker-supplied page), and because the CVSS scope is unchanged (S:U) the compromise is contained within the renderer - full system takeover would require chaining a separate sandbox-escape flaw. Google has released a fixed build and there is no public exploit identified at time of analysis, though the CVSS 8.8 score and memory-corruption tag make timely patching advisable.
Heap buffer overflow in PDFium, the PDF rendering engine built into Google Chrome, allows a remote attacker to potentially execute arbitrary code inside the Chrome renderer sandbox on Windows systems running versions prior to 153.0.8010.52. Exploitation requires the victim to open an attacker-supplied crafted PDF (UI:R), so the attack is delivered via social engineering rather than direct network exploitation; no credentials are needed (PR:N) and default Chrome installations render PDFs without any special configuration. The vendor rates this High severity with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and although a vendor patch is available, no public exploit code has been identified at time of analysis and there is no confirmed active exploitation (not in CISA KEV). Because code execution is confined to the renderer sandbox, full host compromise would additionally require a separate sandbox-escape vulnerability not covered by this advisory.
Type confusion in the V8 JavaScript engine of Google Chrome prior to 153.0.8010.52 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim is socially engineered into loading a crafted HTML page (CVSS 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Exploitation is not automatic: it requires user interaction, and because the resulting code execution is confined to the renderer sandbox, turning it into host-level compromise would require chaining a separate sandbox-escape vulnerability. There is no public exploit code identified at time of analysis and the flaw is not listed in CISA KEV, but a vendor patch (Chrome 153.0.8010.52) is available and this is a patch-now item for a ubiquitous product.
Local sandbox escape in Google Chrome on Windows (versions prior to 153.0.8010.52) lets an attacker who can already execute a program on the target host run arbitrary code outside the browser sandbox by abusing incorrect reference resolution in Chrome's Tracing component (CWE-706). The vendor rates it High with a CVSS of 8.1 (AV:L/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), meaning exploitation is local-only, requires no user interaction, but is gated by high attack complexity - consistent with a race or timing-dependent condition that is not reliably repeatable. No public exploit code has been identified at time of analysis, and because a local foothold is a prerequisite, this is realistically a chained sandbox-escape stage rather than a standalone initial-access vulnerability.
Use-after-free in the Dawn (WebGPU) component of Google Chrome on Android before 153.0.8010.52 allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page. Exploitation requires the user to load attacker-controlled content (CVSS 9.6, AV:N/AC:L/PR:N/UI:R), and Google rates the bug Chromium security severity Critical; the only affected configuration is Chrome on Android below the fixed 153.0.8010.52 build, and devices already updated are not exposed. There is no CISA KEV listing and no public exploit identified at time of analysis, so the practical risk is driven by the size of the unpatched Android install base rather than by observed attacks.
Use-after-free in Google Chrome's Extensions component allows a remote attacker to execute arbitrary code outside the browser sandbox on any desktop build prior to 153.0.8010.52, provided the victim loads a crafted, attacker-controlled extension. The flaw carries a 9.6 CVSS score (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning no prior authentication to the target is needed, but the attacker must still persuade the user to install or load a malicious extension, which is the real-world limiting factor; the sandbox-scope change (S:C) reflects code execution escaping Chrome's renderer/extensions sandbox. A vendor patch shipping in 153.0.8010.52 is available, and no public exploit code or confirmed active exploitation has been identified at time of analysis. Because Chrome auto-updates aggressively, the exposed population shrinks quickly once the fixed build propagates.
Improper input validation in ANGLE, Google Chrome's graphics abstraction layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox by convincing a user to open a crafted HTML page in Chrome builds prior to 153.0.8010.47. Exploitation requires no authentication (PR:N) but does require user interaction (UI:R) - the victim must navigate to attacker-controlled or compromised content - and the scope-change metric (S:C) reflects that successful exploitation implies code execution escaping the renderer sandbox onto the host OS. The issue carries a Critical 9.6 CVSS rating and a vendor patch is available in Chrome 153.0.8010.47; there is no public exploit identified at time of analysis, and Chromium rates the underlying security severity as Medium.
Use-after-free in Google Chrome's DigitalCredentials component lets a remote, unauthenticated attacker execute arbitrary code outside the browser sandbox when a victim is socially engineered into loading a crafted HTML page, affecting all Chrome builds prior to 153.0.8010.47. Exploitation requires no credentials or elevated privileges (CVSS PR:N) but does require the user to navigate to the attacker-controlled page (UI:R), and the resulting scope change (S:C) means impact extends beyond the browser's sandbox boundary to full confidentiality, integrity, and availability loss. Google rates the issue High and has shipped a fix in the stable channel; no public exploit code has been identified at time of analysis and the flaw is not listed in CISA KEV, so the current risk is driven by the ease of phishing/malvertising delivery rather than confirmed active exploitation.
Integer overflow in V8, Chrome's JavaScript engine, allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Chrome builds prior to 153.0.8010.47; the bug carries a high CVSS (9.6 as published, scored 8.8 under our scope-unchanged reassessment) because memory corruption in V8 can be leveraged for code execution, though impact is confined to the renderer process and full host compromise would require chaining a separate sandbox-escape flaw. Chrome ships on a rapid auto-update cadence and a vendor patch is available (153.0.8010.47), which limits mass exposure; EPSS is a modest 0.36% (30th percentile), CISA SSVC records no observed exploitation, and no public exploit code has been identified at time of analysis, so this is a high-severity memory-safety defect to prioritize for unpatched or update-delayed enterprise fleets rather than an active-emergency. No authentication is required (PR:N), but exploitation depends on user interaction: the victim must load attacker-controlled JavaScript with scripting enabled in the default configuration.
Use-after-free in Google Chrome's Auth component allows a remote attacker to achieve code execution outside the browser sandbox when a victim simply loads a crafted HTML page in any desktop Chrome build prior to 153.0.8010.47. Exploitation is unauthenticated and requires no special configuration - the only prerequisite is the user interaction of visiting or rendering the attacker-controlled page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6), and because the flaw is not confined to the renderer, no separate sandbox-escape bug is needed to reach the host. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; Google has released a fixed build (153.0.8010.47), and details remain restricted in the Chromium tracker until most users have updated.
Type confusion in Chrome's ServiceWorker implementation allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by enticing a victim to load a crafted HTML page in any Chrome build prior to 153.0.8010.47. Exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) - the victim must visit or be redirected to attacker-controlled content - and the resulting code execution is confined to the sandbox (S:U), so full host compromise would require chaining a separate sandbox-escape flaw. There is no public exploit identified at time of analysis, and a vendor-released patch (153.0.8010.47) is available, making this a high-priority but practically bounded patching task rather than an urgent zero-day response.
Remote code execution in SiYuan's Electron renderer occurs when users hover over search results, file tree items, or attribute view elements containing URL-encoded XSS payloads in document titles or metadata. The vulnerability chains a URL-decoding step (decodeURIComponent) with unsafe innerHTML assignment in tooltip rendering, bypassing the escapeAriaLabel sanitizer that only handles HTML entities but ignores %XX URL escapes. Because SiYuan's renderer runs with nodeIntegration:true and contextIsolation:false, the XSS escalates to arbitrary code execution via require('child_process'). Exploitation requires user interaction (hovering) but no authentication, and malicious payloads survive .sy.zip export/import and sync replication, enabling supply-chain and shared-workspace attacks. No public exploit code identified at time of analysis, though detailed proof-of-concept is published in the GitHub advisory.
Remote code execution in SiYuan's Electron desktop application allows authenticated attackers (or browser extensions on localhost) to inject malicious JavaScript through unescaped Attribute View names, escalating from stored XSS to arbitrary system command execution. The Go kernel backend stores AV names without HTML escaping, then embeds them via string replacement into HTML templates pushed over WebSocket. Three TypeScript renderer paths (render.ts, Title.ts, transaction.ts) consume this data using innerHTML/outerHTML without sanitization. Because the Electron main window runs with nodeIntegration:true and contextIsolation:false, script injection grants full Node.js API access—enabling attackers to spawn child processes (calc.exe/xcalc demonstrated in PoC), exfiltrate SSH keys, install backdoors, or pivot to cloud credentials. Payloads persist in JSON files under data/storage/av/, replicate across all sync transports (S3/WebDAV/cloud), survive .sy.zip export-import, and trigger for any user role (Administrator/Editor/Reader/Visitor) opening a document bound to the poisoned database view. CVSS 9.4 (Network/Low/None/High Confidentiality-Integrity-Availability + Scope Changed) reflects worst-case remote network vector, though the primary realistic attack path is via installed browser extensions (chrome-extension:// Origin explicitly allowlisted in session.go:277) calling the /api/transactions endpoint as an auto-granted admin on default installations with no Access Authorization Code. GitHub advisory GHSA-2h64-c999-c9r6 confirms patch available in kernel commit 0.0.0-20260512140701-d7b77d945e0d. No public exploit code identified at time of analysis, but detailed reproduction steps with curl payloads and Electron DevTools inspection are published in the advisory.
Chrome DevTools Protocol exposure in OpenClaw sandbox browser allows adjacent network attackers to remotely control sandboxed Chrome instances and access sensitive data. The CDP relay binds to 0.0.0.0 without source IP restrictions in versions before 2026.4.10, enabling attackers on the same Docker network to bypass sandbox isolation and execute arbitrary JavaScript in browser contexts. Vendor-released patch available (v2026.4.10); no public exploit identified at time of analysis. CVSS 9.0 reflects adjacent network attack vector with high confidentiality, integrity, and availability impact across virtual and system scopes.
Privilege escalation in Google Chrome versions prior to 148.0.7778.96 enables remote attackers to elevate privileges through malicious HTML pages exploiting improper cookie validation. The vulnerability requires user interaction (clicking a link or visiting a malicious site) but no authentication, making it viable for phishing or watering-hole attacks. CVSS score of 8.8 indicates high severity across confidentiality, integrity, and availability. Vendor-released patch available in Chrome 148.0.7778.96 per Google's stable channel update. EPSS and KEV data not provided; exploitation status unknown at time of analysis.
Heap corruption via malicious Chrome extension exploits use-after-free flaw in V8 JavaScript engine, affecting Chrome versions prior to 147.0.7727.55. Attacker must convince user to install a crafted extension to achieve potential remote code execution with high confidentiality, integrity, and availability impact. EPSS score of 0.01% (1st percentile) indicates minimal observed exploitation activity; no CISA KEV listing or public exploit code identified at time of analysis. Despite high CVSS 8.8
Remote code execution in Google Chrome's Federated Credential Management (FedCM) prior to version 146.0.7680.165 enables unauthenticated attackers to execute arbitrary code within the browser sandbox through a malicious HTML page. This use-after-free vulnerability in memory management affects Chrome on all supported platforms and requires only user interaction to trigger. A patch is available in Chrome 146.0.7680.165 and later.
Out-of-bounds memory write in Google Chrome's font handling prior to version 146.0.7680.165 enables remote code execution when users visit malicious HTML pages. An unauthenticated attacker can exploit an integer overflow vulnerability to achieve complete system compromise with high integrity and confidentiality impact. Patches are available for Chrome and affected Debian systems.
Sandboxed code execution in Google Chrome's WebGPU implementation (prior to 146.0.7680.165) stems from a use-after-free memory vulnerability that can be triggered via malicious HTML pages. An unauthenticated remote attacker can exploit this to execute arbitrary code within the Chrome sandbox without user interaction beyond viewing a crafted webpage. A patch is available for affected users.
This vulnerability is an out-of-bounds memory read flaw in the WebAudio API implementation within Google Chrome prior to version 146.0.7680.165. A remote attacker can craft a malicious HTML page to trigger the vulnerability and read sensitive memory contents, leading to information disclosure. Although no CVSS score or EPSS data is provided, the Chromium security severity is rated as High, and the vulnerability affects all users of vulnerable Chrome versions until patching.
Sandbox escape in Google Chrome prior to version 146.0.7680.165 via a use-after-free vulnerability in the Dawn graphics component enables remote attackers to execute arbitrary code when users visit malicious HTML pages. The vulnerability affects multiple platforms including Debian systems and requires only user interaction to trigger, bypassing Chrome's sandbox isolation. A patch is available to remediate this high-severity memory corruption flaw.
Google Chrome's WebGL implementation contains a heap buffer overflow that enables remote attackers to read arbitrary memory by serving a specially crafted HTML page to users prior to version 146.0.7680.165. This network-based vulnerability requires only user interaction and affects Chrome on all platforms, granting attackers access to sensitive data in the browser's memory. A patch is available and should be applied immediately given the high severity and potential for exploitation.
Out of bounds memory read in Google Chrome's CSS parser prior to version 146.0.7680.165 allows remote attackers to access sensitive memory contents through a malicious HTML page. The vulnerability requires user interaction and affects Chrome on multiple platforms including Debian systems, enabling attackers to potentially leak confidential data with high impact on confidentiality and integrity.
Unauthenticated remote attackers can exploit a heap buffer overflow in Google Chrome's WebAudio component (versions prior to 146.0.7680.165) by hosting malicious HTML pages that trigger out-of-bounds memory writes. This vulnerability enables arbitrary code execution with full system compromise potential. A patch is available from Google and Debian.
An arbitrary file-write vulnerability exists in Pega Browser Extension (PBE) affecting Pega Robot Studio developers using versions 22.1 or R25 who automate Google Chrome and Microsoft Edge browsers. A threat actor can craft a malicious website that, when visited by a developer during interrogation mode in Robot Studio, executes arbitrary file-write operations on the developer's system. This vulnerability does not affect end-user Robot Runtime deployments, limiting its blast radius to development environments.
Heap corruption in Google Chrome's ANGLE graphics library prior to version 146.0.7680.153 can be triggered remotely through a malicious HTML page, potentially enabling arbitrary code execution on affected systems. The vulnerability stems from an integer overflow condition that requires only user interaction with a crafted webpage, affecting Chrome users across Windows, macOS, and Linux platforms. A patch is available and security professionals should prioritize updating to the latest Chrome version to mitigate this high-severity risk.
Heap buffer overflow in Google Chrome's WebRTC component (versions prior to 146.0.7680.153) enables remote code execution when users visit a malicious webpage, requiring only user interaction to trigger the vulnerability. An attacker can exploit this heap corruption to execute arbitrary code with the privileges of the affected browser process. A patch is available for Chrome and affected Linux distributions including Ubuntu and Debian.
An out of bounds read vulnerability exists in the Blink rendering engine of Google Chrome prior to version 146.0.7680.153, allowing remote attackers to read memory outside intended buffer boundaries via a specially crafted HTML page. This vulnerability (CWE-125) has been classified as High severity by the Chromium security team and enables information disclosure attacks without requiring user interaction beyond visiting a malicious webpage. A vendor patch is available, and the vulnerability affects 9 Debian releases, indicating widespread downstream impact across Linux distributions.
Heap corruption in Google Chrome's V8 engine prior to version 146.0.7680.153 enables remote code execution when users visit malicious websites, affecting Chrome, Ubuntu, and Debian systems. An unauthenticated attacker can craft a specially designed HTML page to trigger memory corruption and achieve complete system compromise without user interaction beyond visiting the page. A patch is available for immediate deployment.
Memory disclosure in Google Chrome's Skia rendering engine prior to version 146.0.7680.153 enables unauthenticated attackers to read out-of-bounds memory contents by tricking users into visiting malicious web pages. Affected users across Chrome, Ubuntu, and Debian distributions face potential information leakage including sensitive data from process memory. A patch is available for immediate deployment.
Heap corruption in Google Chrome's WebAudio component (versions prior to 146.0.7680.153) can be triggered through out-of-bounds memory access when processing malicious HTML pages, enabling remote attackers to achieve arbitrary code execution without user interaction beyond viewing the page. The vulnerability affects Chrome, Ubuntu, and Debian systems, with patches now available across all platforms.
Heap memory corruption in Google Chrome prior to version 146.0.7680.153 can be triggered through malicious browser extensions, affecting Chrome users on Google, Ubuntu, and Debian systems. An attacker must convince a user to install a compromised extension to exploit this use-after-free vulnerability and potentially achieve code execution. A patch is available.
Heap memory corruption in Google Chrome's V8 engine (versions prior to 146.0.7680.153) stems from type confusion vulnerabilities that can be triggered through malicious HTML pages without user privileges. An unauthenticated remote attacker can exploit this to achieve arbitrary code execution or crash the browser. The vulnerability affects Chrome, Ubuntu, and Debian systems, with patches now available.
A use-after-free vulnerability in Google Chrome's Digital Credentials API prior to version 146.0.7680.153 enables attackers with a compromised renderer process to escape the sandbox and potentially achieve code execution through a specially crafted HTML page. The vulnerability affects Chrome on multiple platforms including Ubuntu and Debian systems, requiring user interaction to trigger but presenting high impact across confidentiality, integrity, and availability. A patch is available in Chrome 146.0.7680.153 and later versions.
Heap buffer overflow in PDFium within Google Chrome versions prior to 146.0.7680.153 enables remote attackers to corrupt heap memory and potentially achieve code execution by delivering a malicious PDF file. The vulnerability requires user interaction to open the crafted PDF but no authentication or special privileges. Patches are available for affected Google Chrome, Ubuntu, and Debian systems.
Heap memory corruption in Google Chrome versions prior to 146.0.7680.153 can be triggered through a use-after-free vulnerability in the Network component when a user visits a malicious HTML page. An unauthenticated remote attacker can exploit this to achieve arbitrary code execution with high integrity and confidentiality impact. A patch is available for Chrome, Ubuntu, and Debian users.
Heap corruption in Google Chrome's ANGLE graphics library on Windows versions prior to 146.0.7680.153 can be triggered through integer overflow when processing maliciously crafted HTML pages. An unauthenticated remote attacker can exploit this vulnerability by deceiving users into visiting a malicious website, potentially achieving arbitrary code execution. A patch is available across affected platforms including Google Chrome, Microsoft Edge, and various Linux distributions.
A renderer process sandbox escape vulnerability exists in Google Chrome prior to version 146.0.7680.153 due to insufficient input validation in the Navigation component. An attacker who has already compromised the renderer process can exploit this via a crafted HTML page to escape the sandbox and gain elevated privileges on the host system. A patch is available from Google, and the vulnerability is tracked in the EUVD database with High severity classification.
Heap corruption in Google Chrome's V8 engine prior to version 146.0.7680.153 can be triggered through out-of-bounds memory writes when a user visits a malicious webpage. An unauthenticated remote attacker can exploit this vulnerability to achieve arbitrary code execution with high integrity and confidentiality impact. A security patch is available for affected users on Chrome, Ubuntu, and Debian systems.
Heap memory corruption in Google Chrome's Blink rendering engine prior to version 146.0.7680.153 can be triggered through a malicious HTML page, potentially enabling remote code execution. An unauthenticated attacker requires only user interaction to exploit this use-after-free vulnerability across network boundaries. A patch is available for affected Chrome, Ubuntu, and Debian users.
Heap buffer overflow in Google Chrome's ANGLE graphics library (versions prior to 146.0.7680.153) enables remote attackers to corrupt heap memory and potentially achieve arbitrary code execution through malicious HTML pages requiring only user interaction. The vulnerability affects Chrome on multiple platforms including Ubuntu and Debian systems. A patch is available and should be applied immediately given the high severity and attack accessibility.
Heap corruption via use-after-free in Google Chrome's WebRTC implementation (versions prior to 146.0.7680.153) enables remote attackers to achieve arbitrary code execution through malicious HTML pages, requiring only user interaction. The vulnerability affects Chrome, Ubuntu, and Debian systems with a CVSS score of 8.8, though a patch is available.
Heap memory corruption in Google Chrome's WebRTC implementation prior to version 146.0.7680.153 enables remote attackers to execute arbitrary code by tricking users into visiting malicious websites. The use-after-free vulnerability requires only user interaction and affects Chrome on multiple platforms including Ubuntu and Debian systems. A patch is available to address this high-severity flaw.
Stack buffer overflow in Google Chrome's WebRTC implementation prior to version 146.0.7680.153 enables remote attackers to corrupt stack memory and achieve code execution through maliciously crafted HTML pages. The vulnerability affects Chrome, and potentially downstream products including Chromium-based browsers, requiring only user interaction and no authentication. A patch is available across affected platforms including Ubuntu and Debian.
Sandboxed arbitrary code execution in Google Chrome's WebAudio component (versions prior to 146.0.7680.153) can be triggered remotely through malicious HTML, requiring only user interaction. An attacker can craft a weaponized webpage to break out of the Chrome sandbox and execute arbitrary code on affected systems. This high-severity vulnerability impacts Chrome, Ubuntu, and Debian users, with patches now available.
Google Chrome versions prior to 146.0.7680.153 contain a heap buffer overflow in CSS parsing that enables remote code execution when users visit malicious HTML pages. An unauthenticated attacker can trigger heap memory corruption through a crafted webpage, potentially achieving arbitrary code execution with user privileges. A patch is available and should be applied immediately to all affected systems.
Heap corruption in Google Chrome versions before 146.0.7680.153 results from a use-after-free vulnerability in the Base component, enabling remote attackers to execute arbitrary code through malicious HTML pages. The attack requires user interaction but no authentication, affecting Chrome on multiple platforms including Linux distributions. A patch is available to remediate this critical-severity vulnerability.