Chrome

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to break out of the browser's renderer sandbox by serving a crafted video file processed by Chrome's media codec stack. The flaw stems from insufficient validation of untrusted input in the Codecs component and requires the victim to load attacker-controlled video content, but successful exploitation yields cross-origin impact (Scope: Changed) with high confidentiality, integrity, and availability impact. No public exploit identified at time of analysis and EPSS exploitation probability is low (0.05%, 15th percentile), though the 9.6 CVSS rating and sandbox-escape primitive make this a high-priority browser patch.

Same-origin policy bypass in Google Chrome's Workers subsystem (versions prior to 149.0.7827.53) permits a remote attacker who has already compromised the renderer process to circumvent cross-origin restrictions via a crafted HTML page, resulting in high-severity integrity impact (CVSS I:H). The flaw, rooted in insufficient policy enforcement (CWE-284), functions as a second-stage chained exploit rather than an initial access vector, requiring renderer compromise as a prerequisite. No active exploitation has been identified (SSVC: exploitation none; EPSS 0.02%), and a vendor-released patch is available as of Chrome 149.0.7827.53.

Sandbox escape in Google Chrome for Android before 149.0.7827.53 lets a remote attacker exploit a use-after-free in the USB component by luring a victim to a crafted HTML page, potentially breaking out of the renderer sandbox. CVSS 8.8 reflects the high impact across confidentiality, integrity, and availability, though successful attack requires user interaction (visiting the page). No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Navigation restriction bypass in Google Chrome's Glic component (versions prior to 149.0.7827.53) enables remote attackers to circumvent browser navigation controls by delivering a crafted HTML page that the victim must open. The vulnerability is rooted in an inappropriate implementation (CWE-284, Improper Access Control) within the Glic subsystem and yields limited but multi-dimensional impact across confidentiality, integrity, and availability (C:L/I:L/A:L). No public exploit identified at time of analysis and this CVE does not appear in CISA KEV; Google has assigned a 'Medium' severity rating consistent with the CVSS 6.3 score.

Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 149.0.7827.53 allows remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page, requiring only user interaction. The Scope:Changed CVSS component (S:C) confirms this bypasses Chrome's Same-Origin Policy, enabling access to content from other origins in the victim's browser session. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, UXSS classes in major browsers are historically targeted by threat actors for session hijacking and credential theft.

Arbitrary code execution within the Chrome renderer sandbox is possible in Google Chrome versions prior to 149.0.7827.53 due to a use-after-free defect in the V8 JavaScript engine. Exploitation requires social engineering a user into installing a malicious Chrome Extension, after which a crafted extension can trigger the memory corruption and run attacker-controlled code inside the sandboxed process. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Navigation restriction bypass in Google Chrome prior to 149.0.7827.53 allows a remote, unauthenticated attacker to circumvent policy enforcement in the browser's Actor component by delivering a crafted HTML page to a target user. The flaw (CWE-602) enables unauthorized navigation actions that could expose users to cross-origin manipulation or redirects with low but non-trivial confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and EPSS of 0.02% combined with SSVC exploitation status of none indicates limited active threat, though the broad attack surface of any Chrome desktop user visiting a malicious page warrants timely patching.

Out-of-bounds read in Chrome's GWP-ASan memory safety subsystem (versions prior to 149.0.7827.53) enables a local attacker to disclose potentially sensitive contents from process memory by delivering a malicious file to the target. The vulnerability carries a CVSS 6.5 Medium score with high confidentiality impact but no integrity or availability impact, consistent with a pure information-disclosure class. No public exploit code has been identified at time of analysis, EPSS exploitation probability is extremely low at 0.01% (1st percentile), and SSVC assessment confirms no known active exploitation, collectively indicating a low near-term threat priority despite the notable confidentiality impact rating.

Cross-origin data leakage via Google Chrome's SVG implementation (all versions prior to 149.0.7827.53) enables remote unauthenticated attackers to exfiltrate sensitive information from foreign origins by luring a victim to a crafted HTML page. The flaw reflects an inappropriate SVG rendering implementation that fails to enforce cross-origin isolation boundaries, producing a high confidentiality impact with no integrity or availability consequences. EPSS is very low at 0.03% (11th percentile), no public exploit code has been identified, and no CISA KEV listing exists at time of analysis, suggesting limited observed exploitation despite the medium-severity CVSS score.

Site isolation bypass in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to circumvent a core browser security boundary via a crafted HTML page. The flaw resides in the Opaque Response Blocking (ORB) implementation and requires user interaction (visiting a malicious page), with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating low near-term exploitation likelihood.

Cross-origin data leakage in Google Chrome's WebView component on Android allows an unauthenticated remote attacker to read data from origins outside the attacker's own domain by enticing a user to visit a crafted HTML page. Affected are all Android Chrome versions prior to 149.0.7827.53. No public exploit exists and SSVC classifies exploitation as none, but the network-accessible, low-complexity attack vector warrants patching for Android-heavy enterprise environments handling sensitive cross-origin content.

Heap corruption in Google Chrome's Omnibox component prior to version 149.0.7827.53 allows remote attackers to potentially execute arbitrary code via a use-after-free condition triggered by a crafted HTML page combined with specific user interface gestures. The flaw carries a CVSS 8.8 (High) rating, though Chromium's internal triage assigned only Medium severity, and EPSS estimates exploitation probability at just 0.03%. No public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Cross-origin data leakage in Google Chrome's Media subsystem (all versions prior to 149.0.7827.53) enables a remote attacker to read sensitive data from other web origins by inducing a user to visit a specially crafted HTML page. The flaw stems from an inappropriate implementation in Media that fails to correctly enforce origin boundaries (CWE-346), resulting in high confidentiality impact per CVSS (C:H) with no integrity or availability consequence. No active exploitation is confirmed - CISA KEV is absent and EPSS sits at 0.03% (11th percentile) - but the confidentiality vector is significant for users accessing sensitive cross-origin content concurrently.

UI spoofing in Google Chrome for Android prior to 149.0.7827.53 allows remote attackers to deceive users via crafted HTML pages that abuse the Messages component's security UI. Exploitation requires user interaction with a malicious page, and no public exploit has been identified at time of analysis. Despite a CVSS score of 8.8, EPSS exploitation probability is very low (0.03%, 11th percentile) and the issue is rated Medium by Chromium's own severity scale.

Site Isolation bypass in Google Chrome prior to 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to escape cross-origin protections via a crafted HTML page, exposing high-confidentiality data from other origins loaded in the browser. This is a chained, second-stage exploit component: it does not function standalone but amplifies the impact of a separate renderer compromise by breaking Chrome's primary cross-site data isolation boundary. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects low current exploitation probability despite the high confidentiality impact rating.

Out-of-bounds write in the V8 JavaScript engine of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to execute arbitrary code within the sandbox via a crafted HTML page. The flaw requires user interaction (visiting a malicious page) and prior renderer compromise, and no public exploit identified at time of analysis. CVSS 8.8 reflects high impact across confidentiality, integrity, and availability, though Google classifies the Chromium severity as Medium.

UI spoofing in Google Chrome on Android prior to 149.0.7827.53 allows remote attackers to misrepresent the Contact Picker security UI via a crafted HTML page, potentially tricking users into disclosing contact information. Chromium rates the underlying severity as Medium, and no public exploit has been identified at time of analysis. EPSS probability is very low (0.03%), and the issue is not listed in CISA KEV.

Remote code execution in Google Chrome's Blink rendering engine prior to 149.0.7827.53 allows remote attackers to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page. The flaw stems from an integer overflow (CWE-472) in Blink and carries a CVSS 3.1 score of 8.8; no public exploit identified at time of analysis, though a vendor patch has been released through the Chrome Stable channel update.

OS-level privilege escalation in Google Chrome on Linux prior to 149.0.7827.53 allows remote attackers to escalate privileges via malicious network traffic targeting the Chromoting (Chrome Remote Desktop) component. Google has released a patched stable channel update, and while no public exploit has been identified at time of analysis, the network-based attack vector and high impact across confidentiality, integrity, and availability warrant prompt patching. EPSS probability is very low (0.03%), and the issue is not listed in CISA KEV.

Universal cross-site scripting (UXSS) in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to inject arbitrary scripts or HTML into the context of other origins via a crafted XML file. The flaw stems from an inappropriate implementation in Chrome's XML handling (CWE-91, XML Injection), enabling same-origin policy bypass when a user is lured into loading attacker-controlled content. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low at 0.06% (18th percentile).

Information disclosure in Google Chrome's Extensions subsystem prior to version 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page. This is a second-stage vulnerability requiring a pre-existing renderer compromise as a hard prerequisite, making it a chained attack component rather than a standalone exploit. No public exploit code exists and CISA has not added this to the KEV catalog; the EPSS score of 0.03% and SSVC exploitation-status of 'none' are mutually consistent with no observed active exploitation.

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the WebView sandbox via a crafted HTML page. The flaw stems from an inappropriate implementation in WebView and is chained behind a prior renderer compromise, requiring user interaction. No public exploit identified at time of analysis, and EPSS sits at 0.03% (10th percentile), indicating no current evidence of widespread exploitation despite the high CVSS score of 9.6.

Universal Cross-Site Scripting (UXSS) in Google Chrome's SVG implementation prior to version 149.0.7827.53 allows remote unauthenticated attackers to bypass same-origin policy by injecting arbitrary scripts or HTML across origins via a crafted HTML page. Exploitation requires user interaction and high attack complexity (CVSS AC:H/UI:R), and EPSS at 0.06% (18th percentile) reflects limited real-world exploitation activity. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified at time of analysis.

Remote code execution in Google Chrome's Blink rendering engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free memory corruption issue (CWE-416) tagged for RCE and DoS impact, and no public exploit has been identified at time of analysis. CISA SSVC currently lists exploitation as 'none' despite the high CVSS 8.8 score, indicating significant theoretical impact but no observed in-the-wild activity yet.

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows remote attackers to break out of the browser's renderer sandbox via a use-after-free in the Messages component triggered by a crafted HTML page. The CVSS vector indicates a scope-changing impact requiring only user interaction (visiting a malicious page), and a vendor patch is available. No public exploit identified at time of analysis and EPSS is low (0.03%), but the sandbox-escape primitive makes this a high-priority browser update.

Cross-origin data leakage in Google Chrome's CSS implementation exposes sensitive information from other origins when a user visits a crafted HTML page. Affected are all Chrome versions prior to 149.0.7827.53 on desktop platforms. An unauthenticated remote attacker can exploit this to read data from cross-origin contexts, violating the browser's Same-Origin Policy via a CSS-based side channel or direct information disclosure path. No public exploit identified at time of analysis, and EPSS at 0.03% (11th percentile) signals low current exploitation activity.

Cross-origin data leakage in Google Chrome's DataTransfer API allows unauthenticated remote attackers to read data across origins by directing a victim to a crafted HTML page, affecting all Chrome desktop versions prior to 149.0.7827.53. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:L) confirms network accessibility without attacker authentication, but requires user interaction and yields only limited confidentiality impact with no integrity or availability consequences. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.03% (11th percentile) consistently signals low current exploitation probability.

Out-of-bounds read in the Input component of Google Chrome on Linux (all versions prior to 149.0.7827.53) exposes potentially sensitive process memory to remote attackers. Exploitation requires delivering a crafted HTML page and inducing a Linux user to visit it (CVSS UI:R), after which the browser's Input handler reads beyond allocated buffer bounds, leaking in-memory data. No public exploit has been identified at time of analysis, EPSS sits at 0.03% (11th percentile) indicating low current exploitation probability, and there is no CISA KEV listing - though the High confidentiality impact (C:H) warrants timely patching given Chrome's broad deployment on Linux.

Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 149.0.7827.53, exploitable via a crafted HTML page requiring only a single user visit. The root cause (CWE-457: use of uninitialized memory) in Chrome's Skia rendering backend allows residual memory contents to be exposed across origin boundaries, violating the browser's same-origin policy. No public exploit identified at time of analysis; EPSS at 0.03% (11th percentile) and absence from CISA KEV indicate low real-world exploitation probability at this time.

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 allows a local attacker to break out of the browser sandbox via a crafted AppleScript command targeting the Downloads component. The flaw stems from insufficient input validation (CWE-20) and is rated CVSS 8.6 due to scope change and high impact across confidentiality, integrity, and availability. No public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.02% (4th percentile).

Script injection via Chrome's Accessibility component allows a remote attacker who convinces a victim to install a malicious extension to perform Universal Cross-Site Scripting (UXSS), injecting arbitrary scripts or HTML into web page contexts the user visits. Affected are all Chrome desktop versions prior to 149.0.7827.53. EPSS is 0.01% (2nd percentile) and this vulnerability is not in CISA KEV, indicating very low real-world exploitation probability at time of analysis; however, the social-engineering prerequisite (malicious extension installation) remains a credible threat vector in targeted campaigns.

Cross-origin data leakage in Google Chrome prior to 149.0.7827.53 allows a remote unauthenticated attacker to read sensitive cross-origin data by luring a user to a crafted HTML page that exploits an inappropriate CSS implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-exploitable, no-privilege-required exploitation with a single user interaction as the only barrier. No public exploit has been identified and EPSS sits at 0.03% (11th percentile), indicating low current exploitation interest despite the low attack complexity.

Cross-origin data leakage in Google Chrome prior to 149.0.7827.53 allows remote unauthenticated attackers to read sensitive cross-origin information by directing a victim to a crafted HTML page that exploits an inappropriate CSS implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no privilege requirement, limited only by the need for user interaction. EPSS is 0.03% (11th percentile) and no public exploit has been identified at time of analysis; however, Google has issued a confirmed patch in the stable channel release, and the CWE-352/CSRF tag alongside the data-leakage description suggests a novel or hybrid attack class that security teams should monitor for further clarification.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free in the Dawn WebGPU implementation, enabling a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. No public exploit identified at time of analysis, and EPSS probability is very low (0.03%), though Google has released a stable channel update addressing the flaw.

Cross-origin information disclosure in Google Chrome's Forms component prior to version 149.0.7827.53 allows a remote attacker to leak sensitive data from other origins through a crafted HTML page. The flaw is rated CVSS 9.1 due to high confidentiality and integrity impact over the network without authentication, though Google's Chromium team internally rated it Medium severity. No public exploit identified at time of analysis and EPSS exploitation probability is very low (0.03%, 11th percentile).

Sandbox escape in Google Chrome's Dawn (WebGPU) component prior to version 149.0.7827.53 allows a remote attacker to break out of the renderer sandbox by luring a user to a crafted HTML page. The flaw is a use-after-free (CWE-416) object lifecycle bug; no public exploit identified at time of analysis, and EPSS exploitation probability is very low at 0.03% (11th percentile). Google rates the underlying Chromium severity as Medium, but the CVSS 3.1 score of 9.6 reflects the scope change inherent to a sandbox escape.

Sandbox escape in Google Chrome prior to 149.0.7827.53 allows remote attackers who have already compromised the renderer process to break out of the browser sandbox via a crafted HTML page targeting the Password Manager component. The flaw is rated CVSS 7.5 (High) with EPSS at 0.05% (15th percentile) and no public exploit identified at time of analysis, though Google has shipped a patched stable channel release.

Universal Cross-Site Scripting (UXSS) in Google Chrome's XML processing component allows remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. All Chrome versions prior to 149.0.7827.53 are affected, with the Scope:Changed (S:C) CVSS vector confirming this vulnerability can bypass the Same-Origin Policy - the defining characteristic of UXSS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.06% (18th percentile) reflects low observed exploitation probability, though UXSS primitives are historically attractive to threat actors targeting session data and credential theft at scale.

Privilege escalation in Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that abuses insufficient input validation in the Extensions component. Google rates the Chromium severity as Medium while NVD assigns CVSS 7.5 (High); no public exploit identified at time of analysis and CISA SSVC reports no observed exploitation.

Cross-origin data leakage via an inappropriate CSRF-class implementation in Google Chrome's Payments component on Android prior to 149.0.7827.53 allows network-delivered exploitation when a victim visits a crafted HTML page. The confidentiality impact is rated High by CVSS (C:H), as sensitive payment-related data from one origin can be exposed to an attacker-controlled page. No public exploit has been identified at time of analysis and the EPSS score of 0.01% (1st percentile) indicates a low probability of in-the-wild exploitation, making this a medium-priority patch rather than an emergency response item.

Remote code execution in Google Chrome on Windows prior to 149.0.7827.53 allows attackers to run arbitrary code within the browser sandbox by enticing a user to visit a crafted HTML page that triggers a use-after-free in the WebML component. Although Chromium rates the severity as Medium, the CVSS 3.1 base score is 8.8 (High), reflecting high impact across confidentiality, integrity, and availability with low attack complexity. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.

Sandbox escape in Google Chrome's Chromoting component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) and carries a CVSS 9.6 due to scope change, though Chromium itself rated the severity Medium and EPSS shows only 0.05% exploitation probability with no public exploit identified at time of analysis.

Cross-origin data leakage in Google Chrome for Android (versions prior to 149.0.7827.53) is enabled by a race condition in the Geolocation subsystem, exploitable by a remote unauthenticated attacker who tricks a victim into visiting a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no required privileges, though user interaction is mandatory. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.03% (10th percentile), indicating very low real-world exploitation probability despite the High confidentiality impact rating.

Remote code execution in Google Chrome's Media component prior to version 149.0.7827.53 allows a remote attacker to trigger a use-after-free via a crafted video file, achieving arbitrary code execution within the renderer sandbox. The flaw requires user interaction (UI:R) such as visiting a malicious page or opening a hostile video, and no public exploit identified at time of analysis. EPSS is very low (0.04%, 12th percentile), but the network-reachable RCE primitive and broad Chrome install base make timely patching essential.

Out-of-bounds heap read in Google Chrome's Extensions component on Linux exposes sensitive process memory to a malicious extension author. Affected versions are Chrome on Linux prior to 149.0.7827.53; Windows and macOS are not listed as affected. Exploitation requires convincing a target user to install a crafted malicious extension, limiting exposure compared to the CVSS 6.5 score implies - no public exploit identified at time of analysis, and EPSS of 0.01% (1st percentile) reflects low current exploitation probability.

Same-origin policy bypass in Google Chrome's Paint component prior to version 149.0.7827.53 allows a remote, unauthenticated attacker to violate cross-origin integrity protections by inducing a user to visit a crafted HTML page. The flaw stems from insufficient policy enforcement in the Paint subsystem (CWE-639), enabling an attacker to write or manipulate content across origin boundaries, resulting in high integrity impact with no confidentiality or availability loss per the CVSS vector. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) indicates very low current exploitation probability.

Uninitialized memory use in Google Chrome's Audio subsystem (versions prior to 149.0.7827.53) enables an attacker who has already compromised the renderer process to read potentially sensitive data from process memory via a crafted HTML page. This is a chained-exploit component - it does not grant initial access but can assist post-renderer-compromise data leakage or ASLR bypass. No KEV listing and an EPSS of 0.03% (11th percentile) indicate no observed widespread exploitation; no public exploit has been identified at time of analysis.

Out-of-bounds read in the Chromecast component of Google Chrome prior to version 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to leak potentially sensitive data from process memory by delivering a crafted HTML page. This is a chained vulnerability: exploitation is conditional on a prior renderer compromise, making it a second-stage information-disclosure step rather than a standalone attack. No public exploit code has been identified and EPSS probability stands at 0.05% (15th percentile), consistent with a medium-severity, constrained attack path. Google has released a fix in stable channel 149.0.7827.53.

Cross-origin data leakage in Google Chrome's Paint component (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read sensitive cross-origin data by tricking a user into visiting a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's rendering Paint subsystem that fails to properly enforce cross-origin isolation boundaries. EPSS is low at 0.03% and no active exploitation is confirmed in CISA KEV, but the high confidentiality impact (C:H) combined with low attack complexity and no required privileges makes this a meaningful data-exfiltration risk for browser users visiting untrusted web content.

Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 149.0.7827.53) allows an unauthenticated remote attacker to read sensitive data belonging to other web origins by enticing a user to visit a specially crafted HTML page. The root cause is an uninitialized variable use (CWE-457) within ANGLE - Chrome's OpenGL ES translation layer - which can expose heap or stack memory contents across origin boundaries. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.03% (11th percentile) indicates low observed exploitation probability at time of analysis.

Uninitialized memory exposure in Google Chrome's ANGLE graphics library prior to version 149.0.7827.53 enables remote unauthenticated attackers to read potentially sensitive data from browser process memory by luring a victim to a crafted HTML page. The CVSS vector (PR:N/UI:R/C:H) confirms no attacker privileges are required but victim interaction is mandatory - the attack is entirely browser-side and exploits how ANGLE handles graphics state without zeroing memory first. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating low observed exploitation interest despite the High confidentiality impact rating.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows attackers to execute arbitrary code within the renderer sandbox through a use-after-free flaw in the Canvas component. Exploitation requires a victim to visit a crafted HTML page, and no public exploit has been identified at time of analysis. Google rates this as Medium severity internally despite the CVSS 8.8 score, reflecting the sandbox containment limit.

Insufficient policy enforcement in Google Chrome's Autofill subsystem (versions prior to 149.0.7827.53) enables remote unauthenticated attackers to bypass discretionary access control, resulting in high-integrity impact when a victim visits a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/I:H) confirms the attack is network-delivered, low-complexity, and requires no privileges, though user interaction is a prerequisite. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects low observed exploitation pressure.

Cross-origin data leakage in Google Chrome's Media component (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive data from cross-origin resources by luring victims to a crafted HTML page. The flaw is rooted in an inappropriate implementation in Chrome's Media subsystem, tagged with CSRF characteristics, allowing an attacker-controlled page to read content from origins the victim is authenticated to. EPSS is low at 0.03% and no public exploit or CISA KEV listing has been identified at time of analysis.

Insufficient same-origin policy enforcement in Google Chrome's Paint rendering component (prior to 149.0.7827.53) allows unauthenticated remote attackers to bypass SOP boundaries via a crafted HTML page, resulting in high integrity impact against the victim's browser context. The attack requires user interaction (visiting a malicious page) but no authentication or elevated privileges. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; EPSS is extremely low at 0.02% (4th percentile), indicating limited observed exploitation activity in the wild.

Same-origin policy bypass in Google Chrome's Paint component (all versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin integrity protections by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/I:H) confirms network-based, low-complexity exploitation with no privilege requirement, though victim interaction - visiting the attacker's page - is mandatory. No public exploit has been identified at time of analysis, and an EPSS score of 0.02% (4th percentile) indicates minimal observed exploitation activity; this is not listed in CISA KEV.

Sandbox escape in Google Chrome on Android versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free bug in the Autofill component. Exploitation requires a victim to load a crafted HTML page and the attacker to already control the renderer, making this a second-stage primitive rather than a single-shot RCE. No public exploit identified at time of analysis and EPSS is very low (0.03%, 11th percentile), but the high CVSS reflects the impact of full sandbox escape on a mobile platform.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the Media component, allowing a remote attacker who can lure a victim to a crafted HTML page to execute arbitrary code within the renderer sandbox. The high CVSS score of 8.8 reflects the severe impact triad (C:H/I:H/A:H), though exploitation requires user interaction (UI:R) and code execution is contained within Chrome's sandbox boundary. There is no public exploit identified at time of analysis, and SSVC indicates no observed exploitation.

Cross-origin data leakage in Google Chrome's Extensions subsystem (versions prior to 149.0.7827.53) enables a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. The flaw is classified under CWE-352 (Cross-Site Request Forgery), indicating the Extensions implementation incorrectly handles cross-origin request validation in a way that bypasses same-origin isolation boundaries. No public exploit has been identified at time of analysis, and an EPSS score of 0.03% (11th percentile) signals low current exploitation probability despite the High confidentiality impact rating.

Cross-origin data leakage in Google Chrome's Web Share API prior to version 149.0.7827.53 allows a remote attacker to extract sensitive cross-origin information by convincing a user to perform specific UI gestures on a crafted HTML page, violating browser same-origin policy guarantees. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) reflects high confidentiality impact with no authentication required on the attacker's side, though mandatory user interaction reduces realistic exploitation probability significantly. No public exploit has been identified at time of analysis, and an EPSS score of 0.04% (13th percentile) corroborates low current exploitation activity.

Domain spoofing via crafted WebAPK in Google Chrome on Android prior to 149.0.7827.53 enables remote unauthenticated attackers to deceive users about the web origin of installed Progressive Web Apps, with high integrity impact as confirmed by the CVSS I:H rating. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-accessible and requires no privileges, though user interaction is a necessary precondition. No public exploits have been identified and EPSS sits at 0.03% (10th percentile), indicating minimal observed exploitation pressure; however, the trust-abuse potential for phishing campaigns makes timely patching advisable.

Cross-origin data leakage in Google Chrome DevTools affects all versions prior to 149.0.7827.53, exploitable through a crafted malicious Chrome Extension. The inappropriate DevTools implementation allows an attacker who successfully social-engineers a victim into installing the extension to read data from cross-origin contexts - violating the browser's same-origin isolation guarantees at the DevTools layer. No public exploit code exists and no CISA KEV listing is present; EPSS at 0.02% (4th percentile) confirms low exploitation probability in the wild, making this a routine patch-cycle priority rather than an emergency response item.

Remote code execution in Google Chrome prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code within the renderer sandbox by enticing a user to visit a crafted HTML page that triggers a use-after-free in the Compositing component. The flaw carries a CVSS 8.8 rating and is tagged as RCE/DoS/memory corruption, though no public exploit identified at time of analysis and Google rates the security severity as Medium. Exploitation is constrained to in-sandbox code execution and requires user interaction (visiting the malicious page).

Heap corruption in Google Chrome versions prior to 149.0.7827.53 stems from an integer overflow in the Skia graphics library that can be triggered by a crafted HTML page. Remote attackers can lure a victim to a malicious web page to potentially achieve arbitrary code execution within the renderer process. No public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.03% (11th percentile), though Chrome rendering bugs historically attract exploit development.

Uninitialized memory read in Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows remote attackers to obtain sensitive process memory contents through a crafted HTML page, with no authentication required but mandatory user interaction. The vulnerability carries a CVSS Confidentiality impact of High (C:H), indicating potentially significant data exposure despite the Medium overall score of 6.5. EPSS is low at 0.03% (11th percentile) and no CISA KEV listing exists, meaning no public exploit or confirmed widespread exploitation has been identified at time of analysis.

Universal Cross-Site Scripting (UXSS) in Google Chrome's Keyboard implementation prior to version 149.0.7827.53 enables remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. The Scope:Changed CVSS vector reflects the fundamental nature of this class: successful exploitation bypasses the Same-Origin Policy, potentially granting script access to sessions, cookies, and DOM content across all origins open in the browser. No public exploit has been identified at time of analysis, and the EPSS score of 0.06% (18th percentile) indicates low current exploitation probability, though UXSS primitives are historically high-value for targeted attacks.

Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 149.0.7827.53, exploitable by a remote attacker who has already compromised the renderer process. Via a crafted HTML page, the attacker can abuse insufficient input validation in Skia to extract sensitive cross-origin data, bypassing browser isolation boundaries. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (15th percentile) reflects low observed exploitation activity.

Sandbox escape in Google Chrome's Enterprise Reporting component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) and carries a CVSS 9.6 due to scope change, though no public exploit is identified at time of analysis and EPSS sits at 0.05% (15th percentile).

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that abuses an inappropriate implementation in the GPU component. The flaw requires user interaction (visiting a malicious page) and presupposes a prior renderer compromise, but a successful chain yields full sandbox escape on the mobile platform. No public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.05%, 15th percentile).

Remote code execution in Google Chrome's WebRTC component prior to 149.0.7827.53 allows remote attackers to execute arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free memory corruption issue rated CVSS 8.8 with high impact across confidentiality, integrity, and availability, though execution remains confined to the sandbox and no public exploit identified at time of analysis.

Remote code execution in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker to exploit a use-after-free condition in the Views component via a crafted HTML page. The flaw carries a CVSS 3.1 score of 8.8 with network attack vector and requires user interaction (visiting a malicious page), and no public exploit has been identified at time of analysis despite Google's vendor patch being released.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 is possible through a use-after-free flaw in the Chromoting (Chrome Remote Desktop) component, triggered by malicious network traffic targeting a victim's session. The CVSS 8.8 score reflects high impact across confidentiality, integrity, and availability, though successful exploitation requires user interaction. No public exploit has been identified at time of analysis and EPSS exploitation probability is very low at 0.04%.

Local privilege escalation in Google Chrome on Windows prior to 149.0.7827.53 stems from a use-after-free condition in the Updater component, allowing a local attacker who can place a malicious file to elevate to OS-level privileges. The flaw was reported by Google's Chrome security team with no public exploit identified at time of analysis, and EPSS scoring is very low at 0.01% reflecting minimal predicted exploitation activity. Chromium rates the severity as Medium while the CVSS base score of 7.3 reflects the high impact of OS-level privilege escalation.

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a use-after-free in the Device Trust component. The flaw carries a CVSS 9.6 due to scope change and full CIA impact, though Chromium rates the underlying severity as Medium and EPSS is very low (0.03%, 11th percentile); no public exploit identified at time of analysis.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The CVSS 9.6 score reflects the scope-changing impact (S:C) from renderer to host context, though Chromium itself rates this Medium severity and no public exploit identified at time of analysis. EPSS is very low at 0.05%, suggesting limited near-term mass exploitation despite the high CVSS.

Sandbox escape in Google Chrome on Linux versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox via a crafted Chrome Extension targeting the Chromoting (Chrome Remote Desktop) component. The flaw is rated CVSS 9.6 due to scope change and full CIA impact, though EPSS exploitation probability is very low (0.05%, 15th percentile) and no public exploit identified at time of analysis. Google has shipped a patch in the stable channel update for desktop.

Out-of-bounds memory read in the ANGLE graphics translation layer of Google Chrome before 149.0.7827.53 allows a remote attacker to leak adjacent memory contents when a victim visits a crafted HTML page. No public exploit identified at time of analysis, and EPSS rates exploitation probability at just 0.03%, but the CVSS 8.1 score reflects the user-interaction-only barrier combined with high confidentiality and availability impact. Google has shipped a stable-channel fix and Chromium rates the underlying severity as Medium.

Cross-origin data leakage in Google Chrome's ANGLE graphics subsystem (prior to 149.0.7827.53) allows a remote unauthenticated attacker to read sensitive data from other web origins by enticing a user to visit a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) within ANGLE, Chrome's graphics translation layer, which may expose stale memory contents - potentially including data from other browser contexts or origins. No public exploit code or CISA KEV listing has been identified; EPSS probability of 0.03% (11th percentile) indicates low real-world exploitation pressure at time of analysis.

Cross-origin data leakage in Google Chrome's ANGLE graphics library affects all versions prior to 149.0.7827.53, allowing unauthenticated remote attackers to read sensitive cross-origin browser data by enticing a user to visit a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within ANGLE, Chrome's graphics abstraction layer, where residual memory contents from other origins can be exposed through the GPU pipeline. No public exploit identified at time of analysis, and the EPSS score of 0.03% (11th percentile) indicates low current exploitation probability; however, Chrome's broad install base makes any confirmed cross-origin data disclosure notable from a privacy and session-data standpoint.

Privilege escalation in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker to escape the browser's normal privilege boundaries by enticing a victim to visit a crafted HTML page that abuses the NFC implementation. The flaw carries a CVSS 8.8 (high) rating with high confidentiality, integrity, and availability impact, though Chromium itself classified its security severity as Medium. EPSS is very low (0.03%, 11th percentile) and there is no public exploit identified at time of analysis.

UI spoofing in Google Chrome's Downloads component prior to version 149.0.7827.53 enables remote attackers to misrepresent download-related interface elements by serving a crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in the Downloads subsystem, allowing an attacker to manipulate what the user sees during a download interaction - potentially masking file names, types, or origin - without any authentication. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating no public exploit identified at time of analysis; however, the no-authentication, low-complexity delivery path warrants prompt patching.

Cross-origin data leakage in Google Chrome's Media component (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive information from cross-origin pages by luring a victim to a crafted HTML page. The CVSS vector confirms unauthenticated network access with high confidentiality impact (C:H), though user interaction is required (UI:R). No public exploit identified at time of analysis, and EPSS at 0.03% (11th percentile) indicates low near-term mass exploitation probability, aligning with the Chromium team's 'Medium' severity rating.

Cross-origin data leakage in Google Chrome's WebUI component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to extract sensitive cross-origin information via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the WebUI layer, which fails to properly sanitize input arriving from a compromised renderer, breaking Chrome's intended process isolation boundary. No active exploitation has been confirmed (not in CISA KEV), and an EPSS score of 0.04% (13th percentile) reflects low widespread exploitation probability, consistent with this being a second-stage technique requiring a chained renderer compromise.

Uninitialized memory exposure in the ANGLE graphics layer of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page. The vulnerability is limited to confidentiality impact - no code execution or integrity compromise is possible through this vector alone. With an EPSS score of 0.03% (11th percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is currently low despite the High confidentiality CVSS sub-score.

Local privilege escalation in Google Chrome on Windows prior to version 149.0.7827.53 allows an attacker with local access to elevate to OS-level privileges by planting a malicious file that the Chrome Installer processes inappropriately. The flaw stems from improper privilege management (CWE-269) in the Installer component and requires user interaction to trigger, with no public exploit identified at time of analysis and an EPSS score of 0.01% indicating very low predicted exploitation likelihood.

Arbitrary code execution within the Chrome sandbox affects Google Chrome desktop builds prior to 149.0.7827.53 due to an inappropriate implementation in the Isolated Web Apps (IWA) component. A remote attacker who convinces a user to open a malicious file can execute code confined to the sandbox process, with no public exploit identified at time of analysis and an EPSS score of only 0.03% (10th percentile) indicating low predicted exploitation likelihood. Google has shipped a fix in the stable channel update for desktop.

Uninitialized memory use in the Dawn WebGPU engine of Google Chrome on Windows (all versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to leak cross-origin data from a victim's browser session. Exploitation requires the victim to visit a crafted HTML page, breaking same-origin isolation by surfacing residual memory contents from other browsing contexts. No public exploit has been identified and EPSS sits at 0.03% (11th percentile), indicating low current exploitation probability; however, the High confidentiality CVSS impact warrants prompt patching in environments handling sensitive cross-origin data.

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 allows remote attackers to break out of the renderer sandbox via a use-after-free in the File Input component when a victim is lured to perform specific UI gestures on a crafted HTML page. Although Google classified the upstream severity as Medium, the CVSS 3.1 score of 9.6 reflects the scope-change impact of sandbox escape; no public exploit identified at time of analysis and EPSS is very low at 0.03%.

Cross-origin data leakage in Google Chrome's GPU component (prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin information by delivering a specially crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns a score of 6.5 Medium, reflecting high confidentiality impact tempered by required user interaction and the critical prerequisite of a pre-compromised renderer. No public exploit has been identified at time of analysis, and EPSS registers at 0.05% (15th percentile), consistent with a multi-stage exploitation barrier.

Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive cross-origin data by directing victims to a specially crafted HTML page. The flaw resides in an inappropriate implementation within WebView (CWE-474), effectively undermining same-origin policy protections that normally isolate web content across origins - an attacker can read data they should not have access to. No public exploit has been identified at time of analysis, and an EPSS score of 0.03% (10th percentile) signals very low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog.