Chrome
Monthly
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 47.6%.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.4%.
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.6%.
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.1%.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.8%.
Memory corruption in Google Chrome's CacheStorage subsystem, affecting versions prior to 156.0.8078.79, allows a remote attacker who convinces a victim to render a crafted HTML page to read memory contents; the issue is rated moderate (CVSS 4.3) because exploitation requires user interaction and the confirmed impact is limited to confidentiality. No public exploit has been identified at time of analysis, EPSS is 0.20% (9th percentile), and CISA SSVC records no known exploitation with partial technical impact. Authentication is not required per the CVSS vector (PR:N), but the crafted page must be visited and rendered (UI:R), and no code execution or availability impact is confirmed from this issue alone.
Memory corruption in ANGLE, the graphics abstraction layer bundled with Google Chrome, allows a remote attacker to read memory inside the renderer sandbox on Chrome builds prior to 156.0.8078.73. Exploitation requires the victim to load a crafted HTML page (CVSS UI:R) and no credentials are needed; impact is bounded to confidentiality (C:L) with no integrity, availability, or sandbox-escape effect stated. Google rates the flaw High severity within Chromium, but externally it scores 4.3, EPSS is 0.18% (8th percentile), there is no CISA KEV entry, and no public exploit has been identified at time of analysis; a vendor patch is available.
Memory corruption in Google Chrome's Extensions component before version 156.0.8078.47 can let a remote attacker read memory inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction - the victim must visit or be redirected to the malicious page - and the assessed impact is confidentiality-only, with no code execution, data modification, or crash from this bug alone, making it most relevant as a chaining primitive. No public exploit code was identified at time of analysis, EPSS is low at 0.23%, and Google rates the Chromium security severity as Medium.
Memory disclosure inside the Chrome renderer sandbox affects Google Chrome versions prior to 156.0.8078.47; a remote attacker can trigger it only when the victim loads a crafted HTML page, yielding read access to sandboxed process memory with no integrity or availability impact. No public exploit identified at time of analysis, and EPSS is low at 0.22% (11th percentile). Google has released Chrome 156.0.8078.47 as the fixed version.
Memory corruption in Google Chrome's CacheStorage implementation, present in versions prior to 156.0.8078.47, allows a remote attacker to potentially read memory inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is unauthenticated from the target's perspective (PR:N) and needs no non-default configuration, but it hinges on user interaction (UI:R) and is scoped to the renderer (S:U), with confidentiality-only impact and no demonstrated sandbox escape. Google's Chromium severity rating is High, EPSS is low at 0.22% (12th percentile), no public exploit code has been identified at time of analysis, and this is a moderate-priority issue rather than a top-tier emergency; a vendor patch is available in 156.0.8078.47.
Information disclosure in Google Chrome's font handling allows a remote, unauthenticated attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page containing a malformed font. All desktop Chrome builds prior to 156.0.8078.47 are affected, and because font parsing is part of normal page rendering, no special configuration is required beyond the victim visiting the attacker's page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). There is no public exploit code identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.22% (12th percentile), consistent with a low-urgency, sandbox-confined memory leak that Google itself rated Low severity.
Memory corruption within Chrome's CSS engine lets a remote attacker read memory that is otherwise confined to the renderer sandbox by convincing a user to open a crafted HTML page in any Chrome build prior to 156.0.8078.47. The CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials are needed, but the attack is not drive-by-silent: it depends on the victim navigating to attacker-controlled content, so it is a social-engineering or malicious-page delivery problem rather than a wormable one. Impact is bounded to information disclosure inside the sandbox - there is no sandbox escape, no code execution and no data modification - and our independent assessment rates confidentiality impact as Low rather than the vendor-published High, giving a moderate-risk browser flaw that does not warrant emergency prioritization. EPSS is just 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though Google has shipped a fix in 156.0.8078.47.
Cross-origin information leakage in Google Chrome's Media component affects desktop builds prior to 155.0.8059.79, allowing an unauthenticated remote attacker to observe a discrepancy (CWE-203) and infer small amounts of data belonging to another origin. Exploitation requires the victim to be lured into loading a crafted HTML page in a vulnerable browser, and the HIGH attack complexity / LOW confidentiality impact combination means only low-volume disclosure is possible with no integrity or availability effect. No confirmed active exploitation and no public exploit code were identified at time of analysis, and EPSS is very low at 0.17% (6th percentile); a vendor-released fix is available in Chrome 155.0.8059.79.
Use-after-release in Google Chrome's FontAccess (Local Font Access API) lets an attacker who has already compromised the renderer process bypass web origin policy by luring a victim to a crafted HTML page in Chrome versions prior to 155.0.8059.39. Successful exploitation yields no confidentiality loss but a high integrity impact, as the attacker can subvert origin boundaries from inside an already-broken renderer; the required renderer compromise is a hard prerequisite and makes this a defense-in-depth, medium-severity issue rather than a standalone remote entry point. No public exploit identified at time of analysis, EPSS is low at 0.31% (22nd percentile), and Google has released a fixed build. The CVSS vector shows PR:N/UI:R, meaning unauthenticated attackers are relevant but victim interaction (loading the page) is mandatory; our own assessment rates attack complexity as High rather than Low given the prerequisite renderer foothold.
UI spoofing in Google Chrome (all versions prior to 155.0.8059.39) lets an attacker who has already compromised the renderer process fake browser interface elements - such as dialogs, permission prompts or address-bar style chrome - in front of the user via a crafted HTML page. The weakness is a use-after-free of a released resource (CWE-672) in UI code: unauthenticated from a network standpoint (PR:N), but gated behind a prior renderer compromise, mandatory user interaction (UI:R) and non-trivial timing/state conditions (AC:H). Independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - strictly a user-interface integrity issue with no confidentiality or availability impact - and Chromium rated it Low. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39.
Missing authorization in Google Chrome before 155.0.8059.39 allows a remote attacker to bypass system access restrictions by luring a victim to a crafted HTML page, with only partial confidentiality and integrity impact. No public exploit identified at time of analysis, the EPSS score is 0.19% (8th percentile), and CISA's SSVC assessment records no exploitation; the vendor has released a patched version.
Incorrect authorization in Google Chrome's PermissionElement component, affecting desktop builds prior to 155.0.8059.39, allows a remote attacker to bypass system access restrictions by enticing a user to load a crafted HTML page. The attacker needs no credentials and no prior access (CVSS:3.1/AV:N/AC:L/PR:N), but successful exploitation depends on the victim actively visiting or rendering the malicious page (UI:R) and on reaching the specific permission-handling code path, so impact is confined to partial confidentiality and integrity loss with no availability impact. Risk is low in practice: EPSS is 0.18% (7th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and Chromium itself rates the issue Low severity despite the 5.4 base score; vendor-released patches are available in version 155.0.8059.39.
UI spoofing in Google Chrome's Web Authentication (Passkeys & Security Keys) component allows remote attackers to render deceptive interface elements to users who open a crafted HTML page, because the browser fails to enforce an authorization check before displaying WebAuthn-related UI. The flaw affects Google Chrome on all platforms prior to 155.0.8059.39 and carries a moderate 5.4 CVSS score, although Chromium's own security severity rating is Low and the outcome is limited to user-interface deception rather than code execution or credential exfiltration. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the attack is only reachable through mandatory user interaction (CVSS UI:R) with no authentication or privileges required (PR:N). Google has released a patched build, and all exploitation signals converge on a low real-world priority.
Google Chrome releases earlier than 155.0.8059.39 ship an API whose authorization checks are incorrect, letting a remote attacker bypass web origin policy by getting a victim to open a crafted HTML page. No authentication or non-default setting is required (PR:N), but this is not drive-by exploitation - the target must navigate to the attacker's page (UI:R), and the assessed impact is a single low-severity confidentiality/integrity metric with no availability loss, matching Chromium's own 'Low' severity rating and the modest 4.3 base score. There is no public exploit identified at time of analysis, EPSS is only 0.19% (8th percentile), and a vendor patch is available, so this is a routine patch-cycle item rather than an urgent one.
Incorrect authorization in Google Chrome's Scheduling component prior to version 155.0.8059.39 allows a remote attacker to bypass the browser's web origin policy by convincing a victim to load a crafted HTML page. Exploitation requires user interaction - the target must actively navigate to the attacker-controlled page (UI:R per the assessed CVSS vector) - but needs no authentication or privileges (PR:N), and the resulting impact is limited to integrity (I:L) with no confidentiality or availability effect. There is no public exploit code identified and no evidence of active exploitation at time of analysis, and the EPSS score of 0.19% (8th percentile) confirms a low likelihood of imminent exploitation; a vendor patch is available.
An origin-policy bypass in Chrome's DeviceBoundSessionCredentials component allows remote attackers to make the browser act as a confused deputy for an untrusted site via a crafted HTML page, affecting Chrome builds prior to 155.0.8059.39 (Chromium security severity: Low, CVSS 4.3). Exploitation is network-reachable and requires no attacker authentication (PR:N), but it depends entirely on the victim navigating to an attacker-controlled page (UI:R) and is limited to an integrity impact on web origin rules (C:N/I:L/A:N). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.24% (13th percentile), which is consistent with the low-priority assessment of this defect.
Memory disclosure in Google Chrome versions prior to 155.0.8059.39 lets a remote, unauthenticated attacker read contents of process memory inside the renderer sandbox by convincing a victim to open a crafted HTML page that exercises the WebAudio API. Exploitation is bounded by the required user interaction (CVSS UI:R) and does not escape the Chrome sandbox, so there is no integrity or availability impact, only confidentiality loss (C:H) scored at CVSS 6.5. Publicly available exploit code exists per the SSVC assessment, but the issue is not confirmed as actively exploited (not in CISA KEV) and EPSS is low at 0.19% (8th percentile), making this a moderate-priority patching item rather than an emergency.
Incorrect authorization in Google Chrome's FontAccess implementation lets an attacker who has already compromised the renderer process bypass system access restrictions by getting the victim to load a crafted HTML page. Desktop Chrome builds prior to 155.0.8059.39 are affected; the flaw is a second-stage restriction/sandbox bypass rather than an entry point, since a separate renderer compromise and user interaction are both prerequisites. No public exploit has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.18% (7th percentile), consistent with an independent assessment that this is a genuine but secondary-chain issue rather than a standalone high-priority threat.
Google Chrome versions prior to 155.0.8059.39 are affected by an incorrect authorization weakness in the Media component that enables a remote, unauthenticated attacker to leak limited cross-origin data when a victim loads a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3) confirms that exploitation hinges on user interaction and results only in confidentiality impact, with no integrity or availability effects; CISA's SSVC assessment rates exploitation as 'none' and technical impact as 'partial', and no public exploit code has been identified at time of analysis. Vendor patches are available in the Chrome 155.0.8059.39 stable channel release.
Incorrect authorization in Google Chrome's Network component lets a remote attacker who has already compromised the renderer process bypass system access restrictions by having the victim load a crafted HTML page, with all desktop builds prior to 155.0.8059.39 affected. The flaw is reachable without authentication (AV:N/PR:N) but requires user interaction (UI:R) and, critically, a pre-existing renderer compromise, which is why our assessment raises attack complexity to AC:H and treats this as a second-stage bypass rather than an initial-access vector. Impact is confined to integrity (C:N/I:H/A:N) with no direct data disclosure or denial of service; no public exploit code has been identified at time of analysis, Chrome is not on CISA KEV, and EPSS is only 0.18% (7th percentile), so real-world risk is moderate rather than urgent despite the 6.5 vendor base score.
UI spoofing in Google Chrome versions prior to 155.0.8059.39 allows remote attackers to deceive users with fabricated browser interface elements rendered by a crafted HTML page. The flaw is an incorrect authorization check (CWE-863) in Chromium's Input component; exploitation requires the victim to open the attacker's page and be successfully socially engineered into trusting the spoofed UI (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R), with the independently assessed impact limited to integrity only (C:N/I:L/A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor remains user interaction rather than any technical prerequisite. A vendor patch is available in Chrome 155.0.8059.39, so this is a medium-risk, low-priority hardening item rather than an urgent emergency.
Clickjacking in the EVP component of Google Chrome allows a remote, unauthenticated attacker to overlay and spoof UI elements by tricking a victim into visiting a crafted HTML page and clicking on concealed controls. The attack is purely a UI-redressing/deception issue - the independent assessment scores it as no confidentiality, no availability, and low integrity impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) despite the vendor's 5.4 'Medium' rating - and it succeeds only where social engineering works, with no code execution or data exfiltration. Google shipped a fix in Chrome 155.0.8059.39; no KEV listing and no public exploit code identified at time of analysis.
Uninitialized memory disclosure in Google Chrome's Video component (all versions prior to 155.0.8059.39) lets a remote attacker read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (UI:R) with no authentication (PR:N), and the resulting leak is confined to the sandboxed renderer, so it would realistically need to be chained with a separate sandbox-escape to reach host data. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.24% (13th percentile); vendor-released patch 155.0.8059.39 resolves the issue, and CISA SSVC rates exploitation as 'none' with partial technical impact.
Missing authorization in Google Chrome's Google Lens component (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker read cross-origin data when a victim loads a crafted HTML page - but only after that attacker has already compromised the browser's renderer process, which is the gating precondition and makes this a chained, secondary flaw rather than a standalone entry point. Exploitation additionally requires user interaction (UI:R) and yields only low-severity confidentiality impact with no integrity or availability effect, so the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N for a base score of 3.1, rated Medium by Chromium. Vendor-released patch: 155.0.8059.39; no public exploit identified at time of analysis, and no CISA KEV status or EPSS signal indicates active exploitation.
Missing authorization in a Chrome API allows an attacker-crafted extension to leak sensitive information from Google Chrome installations running versions prior to 155.0.8059.39. Exploitation requires the victim to install and run the malicious extension, so it depends on successful social engineering and mandatory user interaction (CVSS 6.1, AV:L/PR:N/UI:R) rather than direct network reachability, with confidentiality rated High and a limited integrity impact. No public exploit code or active exploitation has been identified at time of analysis, EPSS is low at 0.19% (8th percentile), and Google has released a patched build, so auto-updated browsers at 155.0.8059.39 or later are not affected.
UI spoofing in Google Chrome on iOS versions prior to 154.0.8037.92 allows a remote attacker to impersonate sign-in interface elements by luring the victim to a crafted HTML page, potentially deceiving the user into trusting and interacting with fake prompts. Exploitation requires user interaction (the victim must open the page and engage with the spoofed UI) and no authentication or special privileges; the impact is limited to UI misrepresentation and low-confidentiality disclosure, with no code execution or memory corruption demonstrated. No public exploit code or confirmed active exploitation has been identified at time of analysis, Chromium rates the issue security severity Low, and CISA's SSVC assessment records exploitation as none and automatable as no, so this should be treated as a low-priority hardening item rather than an urgent patch. A vendor patch is available in Chrome 154.0.8037.92, and Google has published a stable channel advisory plus a Chromium issue tracker entry.
UI misrepresentation in the TabStrip component of Google Chrome prior to 154.0.8037.92 lets a remote attacker spoof browser UI elements by luring a victim to a crafted HTML page, rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) and Chromium security severity Low. No authentication or special privileges are required, but the victim must open the malicious page and be deceived by the spoofed chrome, and the outcome is limited to UI deception - no code execution, memory corruption, or direct data exfiltration has been demonstrated. There is no CISA KEV listing and no public exploit code identified at time of analysis, and auto-updated installations at or above 154.0.8037.92 are not affected.
Incorrect authorization in Chrome's Site Isolation component (versions prior to 154.0.8037.92) allows an attacker who has already compromised a renderer process to bypass web-origin policy using a crafted HTML page, producing cross-origin integrity violations without direct confidentiality or availability impact. This is a chained, second-stage bug rather than an initial access vector: exploitation presupposes a prior renderer compromise and also requires user interaction to load the attacker's content, which is why Chromium rates it Low security severity despite an NVD base score of 6.5. Google has shipped a patched build and no public exploit code was identified at time of analysis; there is no indication of confirmed active exploitation (no CISA KEV listing).
Missing authorization checks in Google Chrome's Payments component (desktop builds prior to 154.0.8037.92) let a remote attacker who has already compromised the browser's renderer process use a crafted HTML page to bypass web origin policy and perform cross-origin payment-related actions. The attacker is a remote, unauthenticated party per the CVSS vector (PR:N), but exploitation carries two hard preconditions: the renderer must first be compromised, and the victim must interact with the crafted page (UI:R). There is no public exploit identified at time of analysis, CISA's SSVC assessment records no exploitation and no automatable path, and only integrity is impacted (C:N/I:H/A:N), so despite the 6.5 base score this is a genuinely low-priority issue whose main risk driver is the prior renderer compromise rather than the origin-policy bypass itself.
Origin policy bypass in Google Chrome builds prior to 154.0.8037.92 lets a remote attacker who has already compromised the renderer process escape web origin restrictions via a crafted HTML page, producing a high integrity impact while confidentiality is unaffected. The defect is a missing authorization check in the browser's CORS handling (CWE-862), and it is not independently exploitable - a separate renderer-compromise vulnerability must be chained first, and the victim must load attacker-controlled content (UI:R). No public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as none and the issue as non-automatable with partial technical impact, and the vendor fix is Chrome 154.0.8037.92.
Memory disclosure across the Chrome sandbox boundary affects Google Chrome on Windows prior to 154.0.8037.92, where an uninitialized resource in the Media component lets content read memory it should not be able to reach. Exploitation is not self-contained: the attacker must already have compromised the renderer process through a separate, earlier vulnerability, and then have the victim load crafted HTML that exercises the Media code path (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N, base 3.4). Impact is limited to low-confidentiality readout with no integrity or availability effect, making this realistically an exploit-chain building block, and there is no public exploit identified at time of analysis; a vendor patch is available in 154.0.8037.92.
Cross-site scripting in Chrome's WebUI layer allows a remote, unauthenticated attacker to escape the normal web origin boundary and inject script into a privileged chrome:// internal page when a victim loads a crafted HTML page in Chrome versions prior to 154.0.8037.92. Because the vulnerable surface is Chrome's own WebUI (CWE-79) rather than ordinary web content, successful exploitation crosses a trust boundary (CVSS scope change S:C), giving the attacker low-level read and write influence over the privileged page; the vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) confirms no authentication is required but user interaction is mandatory, and no availability impact is assessed. There is no public exploit identified at time of analysis and no CISA KEV listing; Google has released a fixed build, 154.0.8037.92, so risk is concentrated in unpatched installations. This issue is tracked as EUVD-2026-89395 and documented in the September 2026 Chrome stable channel release notes.
An out-of-bounds read in Chrome's WebGL implementation allows a remote attacker to disclose a limited amount of memory beyond the renderer/sandbox boundary in Google Chrome builds prior to 154.0.8037.92. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled HTML that exercises the WebGL rendering path (UI:R), and the confirmed impact is limited to a partial information disclosure with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical value to an attacker is low because the quantity and controllability of the leaked data are constrained and unpredictable. Chromium rated the issue High severity, and Google has published a stable-channel fix, but the assessed CVSS of 4.7 keeps this in low-priority territory relative to memory-corruption bugs that grant code execution.
An uninitialized-memory flaw in Chrome's GPU component (CVE-2026-102319, CWE-908) lets an attacker who has already compromised the renderer process read memory outside the browser sandbox by loading a crafted HTML page, providing a sandbox-weakening information-disclosure primitive rather than direct code execution. Affected are Google Chrome builds prior to 154.0.8037.92 on all platforms (CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*); the independent assessment scores this CVSS 3.1 at 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), classifying it as a genuine but low-priority issue despite Chromium's internal 'High' label, because it requires a prior renderer compromise, high attack complexity, and user interaction, and yields only partial confidentiality impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor-released patch Chrome 154.0.8037.92 is available.
Uninitialized-memory handling in Skia, Chrome's 2D graphics rendering library, allows a remote attacker to leak cross-origin data when a victim loads a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation is bounded by the mandatory user interaction (UI:R) - the target must open or render attacker-controlled content - and by the impact, which is limited to a partial confidentiality breach (C:L) with no integrity or availability effect, no code execution, and no authentication requirement (PR:N) on default builds. Google rates the underlying Chromium issue as High severity, though the assessed CVSS of 4.3 reflects the narrow cross-origin information-disclosure outcome; no public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA SSVC scoring aligns (Exploitation: none, Automatable: no, Technical Impact: partial). A vendor patch is available in Chrome 154.0.8037.92.
Uninitialized memory in Google Chrome's WebGPU implementation, in builds prior to 154.0.8037.92, can be read back by a remote attacker as cross-origin data when a victim loads a crafted HTML page. The flaw is unauthenticated and remote (CVSS:3.1/AV:N/AC:L/PR:N) but demands that the victim visit the attacker-controlled page (UI:R) and that WebGPU is reachable on the target platform; the outcome is a limited information disclosure with no code execution, no write primitive, and no availability impact, which is why the CVSS 3.1 base score is only 4.3 despite Chromium's internal 'High' severity label. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), so this is a genuinely low real-world priority even given Chrome's ubiquity.
Information disclosure in Google Chrome on Android before version 154.0.8037.92 allows an attacker who has already compromised the renderer process to read memory outside the browser sandbox by getting the victim to load a crafted HTML page. The flaw is an uninitialized-resource bug (CWE-908) in the GPU component, so it leaks memory rather than executing code or modifying state, and the practical exploitability is sharply limited by the precondition that the attacker must first hold a compromised renderer - a requirement the scored vector does not capture despite PR:N. Scored CVSS is only 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) is associated with this CVE; a vendor-released fix exists in Chrome 154.0.8037.92, making this a low-priority patch-and-move-on item despite Chromium's 'High' security severity label.
Information disclosure in Google Chrome on Android prior to 154.0.8037.92 lets a remote attacker read cross-origin data by delivering a crafted HTML page that drives GPU rendering and reads back uninitialized GPU memory. The flaw is unauthenticated (CVSS PR:N) but gated by required user interaction (UI:R) - the victim must open the malicious page - and its impact is confined to low confidentiality loss (C:L), with no code execution, data modification, or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment rates the bug non-automatable with only partial technical impact, so real-world risk remains low despite Chromium's 'High' severity label.
Uninitialized-resource handling in Dawn, Chromium's WebGPU implementation, exposes Chrome for Android builds prior to 154.0.8037.92 to out-of-bounds memory reads triggered by a crafted HTML page (CWE-908). A remote attacker who convinces a victim to load the malicious content can leak limited graphics-process memory that may fall outside the browser sandbox boundary, although the CVSS 3.1 score of 4.7 with C:L/I:N/A:N indicates the payoff is a low-confidence information disclosure rather than code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fixed build.
Uninitialized resource handling in ANGLE, the GPU translation layer bundled with Google Chrome on Windows, lets a remote attacker who gets a victim to load a crafted HTML page trigger a memory read that crosses the browser's sandbox boundary, although the leak is limited to low-severity confidentiality impact (CVSS 4.7, C:L, S:C with no integrity or availability effect). Only Chrome builds on Windows prior to 154.0.8037.92 are affected; the attack is unauthenticated per the CVSS vector but requires user interaction (UI:R) - the victim must open or be redirected to attacker-controlled content that exercises the WebGL/GPU-accelerated path. No public exploit code identified at time of analysis, no confirmed active exploitation (CISA KEV), and Google has already published a fixed build, so the practical risk is low.
Out-of-bounds memory access in Google Chrome's video codec handling - fixed in the 147.0.7727.55 desktop release - can be triggered when a victim loads a crafted video file, resulting in a bounded memory over-read that leaks limited process data rather than enabling code execution. The issue is network-reachable without authentication (CVSS PR:N) but strictly requires the user to load attacker-controlled media (UI:R), and CISA's SSVC assessment classifies it as non-automatable with only partial technical impact; no public exploit code identified at time of analysis and it is not listed in CISA KEV. With a CVSS base of 4.3 and Chromium's own rating of 'Low', this is a low-priority, routine-patching issue, notable mainly because Chrome's ubiquity makes even low-severity memory-safety defects worth closing promptly.
Cross-origin information disclosure in Google Chrome (through the bundled Skia graphics library) affects versions prior to 153.0.8010.52, where improper state validation lets a crafted HTML page cause the renderer to expose data belonging to another origin. Exploitation requires the victim to load an attacker-controlled page (UI:R) and yields only partial confidentiality impact - no code execution, data modification, or denial of service - which is why the CVSS base score is a modest 4.3. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and the vendor has released a fixed build, so this should be treated as a low-priority, patch-routinely item rather than an emergency.
UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 153.0.8010.52) lets a remote, unauthenticated attacker misrepresent interface elements to a user who visits a crafted HTML page, but only if the victim is successfully socially engineered into trusting the falsified prompt. Exploitation requires mandatory user interaction (CVSS UI:R) and produces only a limited integrity impact - no code execution, no data exfiltration, and no availability loss - which is why Chromium rates it Low severity. No public exploit code has been identified at time of analysis, CISA SSVC records no exploitation and rates the issue non-automatable with partial technical impact, and the vendor has released a patch in Chrome 153.0.8010.52.
Information disclosure in the Paint component of Google Chrome desktop allows unauthenticated remote attackers to obtain sensitive information when a victim renders a crafted HTML page, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (6.5). Exploitation is gated by mandatory user interaction (UI:R), keeping it out of the automatable category under CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial), and no public exploit code has been identified at time of analysis. The confidentiality-only impact - no integrity or availability effect, no code execution or sandbox escape reported - makes this a genuine but modest issue rather than an urgent priority; Google has released a fixed build, so exposure ends once Chrome is updated to 153.0.8010.52 or later.
Server-side request forgery in the Omnibox of Google Chrome on Android prior to 153.0.8010.52 allows an unauthenticated remote attacker to bypass system access restrictions by combining social engineering with crafted network traffic, producing only a limited integrity impact (CVSS 3.7, AC:H, C:N/I:L/A:N) with no confidentiality or availability loss and no code execution. The bug is Android-scoped, rated Medium by Chromium, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no'. In short, this is a low-priority, low-real-risk issue despite being a network-vector SSRF in a ubiquitous browser.
Cross-origin information disclosure in Google Chrome's Permissions implementation allows a remote attacker to leak data across origin boundaries when a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.52. Exploitation requires user interaction (the victim must load the page) but no authentication or special privileges, and the impact is limited to low-sensitivity data exposure (CVSS 4.3, Chromium severity Medium). No public exploit code or confirmed active exploitation was identified at time of analysis, and the auto-updating Stable channel sharply narrows the exposure window once 153.0.8010.52 propagates.
Access-restriction bypass in Google Chrome's FileSystem component affects all builds prior to 153.0.8010.52 and is only reachable by an attacker who has ALREADY compromised the browser's renderer process through a separate vulnerability, then convinces the victim via social engineering to open a crafted HTML page and finally wins a timing-dependent race condition (CWE-367 TOCTOU). Impact is deliberately narrow: CVSS 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects no confidentiality or availability loss and only low-integrity impact, with high attack complexity and mandatory user interaction. There is no public exploit identified at time of analysis and no indication of active exploitation; patched builds (153.0.8010.52 and later) are not exploitable, and this is assessed as a low-real-risk browser flaw rather than a standalone attack path.
Incorrect authorization in Google Chrome's Opaque Response Blocking (ORB) implementation lets remote attackers bypass site isolation by luring a victim into loading a crafted HTML page, exposing limited cross-site data on unpatched builds below 153.0.8010.52. The assessed impact is a low-confidentiality read (CVSS 4.3, C:L) rather than code execution or a full same-origin-policy break, and the attacker needs no credentials although user interaction is mandatory (PR:N / UI:R). There is no public exploit identified at time of analysis, and Google has shipped a fixed build, 153.0.8010.52, making this a routine update rather than an emergency patch.
Google Chrome builds prior to 153.0.8010.52 contain a missing-authorization flaw (CWE-862) in the Storage component that lets a crafted PDF file bypass Chrome's site isolation boundary. The practical impact is narrow: an attacker must already have compromised the Chrome renderer process through a separate, independent vulnerability before this flaw can be leveraged, making it a defense-in-depth boundary bypass rather than a standalone initial-access vector. Per the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, base 3.1) the attack is remote and unauthenticated but requires user interaction and yields only low-confidentiality impact; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). Google has released a patched build, and ENISA EUVD tracks the issue as EUVD-2026-82488. Overall this is a low real-world priority despite affecting a ubiquitous product.
Memory disclosure in Google Chrome prior to 153.0.8010.52 allows a local attacker to read out-of-bounds data through the browser's DataTransfer implementation, with the sandbox-crossing scope change (S:C) in the CVSS vector indicating the leaked memory can originate outside the renderer process rather than from within the attacker's own context. Per the assessed vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, base 6.3) exploitation requires the attacker to already be running a local program on the victim's machine and to use social engineering to obtain user interaction, and it produces only confidentiality impact with no integrity or availability effect, so this is an information-disclosure bug rather than a sandbox escape or code-execution primitive. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (it is not in CISA KEV); Google has shipped version 153.0.8010.52, which resolves the flaw.
Confused-deputy handling in the PriceTracking component of Google Chrome on iOS lets a remote, unauthenticated attacker reach a privileged in-browser page and bypass system access restrictions on versions prior to 153.0.8010.47. Exploitation is not straightforward - it requires the attacker to pair crafted network traffic with successful social engineering of the user (the independent assessment scores AC:H and UI:R, even though the published NVD vector lists UI:N), and the resulting impact is confined to Low confidentiality and Low integrity inside the browser context with no availability loss and no code execution outside Chrome. There is no evidence of active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; EPSS is only 0.22% (12th percentile), and a vendor fix is already available, making this a genuinely low-priority issue despite the 'Authentication Bypass' tag.
Cross-origin data disclosure in Google Chrome versions prior to 153.0.8010.47 occurs when an attacker who has already compromised the renderer process lures a victim to a crafted HTML page. The weakness lives in the GetUserMedia media-capture code path, where incomplete cleanup (CWE-459) leaves cross-origin data recoverable, as captured by the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N (score 3.1) - unauthenticated network reach but high attack complexity, mandatory user interaction, and confidentiality-only, low-magnitude impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped the fix in Chrome 153.0.8010.47.
UI spoofing in Google Chrome's WebAppInstalls subsystem - all builds prior to 153.0.8010.47 - lets a remote, unauthenticated attacker mislead a user with falsified interface elements (for example, a convincing install or permission prompt) rendered from a crafted HTML page. Per the assessed vector (AV:N/AC:H/PR:N/UI:R, C:N/I:L/A:N), exploitation depends on the victim actively visiting the attacker's page and on the attacker winning a timing race, which makes reliable abuse difficult and confines real-world impact to low-integrity visual deception rather than code execution, data disclosure, or denial of service; there is no public exploit identified at time of analysis, EPSS is a negligible 0.17% (7th percentile), and the issue is not in CISA KEV. Google has shipped a fix in Chrome 153.0.8010.47, so this is a low-priority, patch-and-move-on item with low risk across every signal.
Open WebUI versions up to 0.8.8 expose admin-configured system prompts to authenticated regular (non-admin) users through the /api/models API endpoint, allowing information disclosure of sensitive model instructions and internal configuration details. The vulnerability requires valid user authentication but no administrative privileges, enabling any authenticated user to retrieve confidential system prompts via a simple HTTP GET request. This is confirmed actively exploited in production deployments with a publicly available proof-of-concept.
Site Isolation bypass in Google Chrome prior to 148.0.7778.168 allows remote attackers who have already compromised the renderer process to access cross-site data via crafted HTML pages. The vulnerability affects Chrome's AI policy enforcement, enabling a second-stage attack after initial renderer compromise. Attack complexity is high, requiring both initial renderer compromise and user interaction. EPSS score of 0.02% indicates very low exploitation probability, and no active exploitation or public POC has been identified. Vendor patch is available in Chrome 148.0.7778.168.
Cross-origin source code exposure in webpack-dev-server up to 5.2.3 allows attackers controlling a malicious website to steal bundled application source code when a developer runs the dev server over non-trustworthy HTTP origins. The vulnerability exploits the omission of Sec-Fetch-Mode and Sec-Fetch-Site headers on non-HTTPS connections, enabling script injection and cross-origin code exfiltration. Chromium-based browsers Chrome 142+ are exempt due to local network access restrictions. CVSS 5.3 (AC:H due to user requirement to visit attacker site; High confidentiality impact). Fix: upgrade to webpack-dev-server 5.2.4 or later.
Out-of-bounds memory read in Google Chrome's V8 JavaScript engine allows remote attackers to disclose sensitive information via a crafted HTML page. Affects Chrome versions prior to 148.0.7778.96. The vulnerability requires user interaction (opening a malicious page) but operates over the network with no authentication required. While classified as medium severity by Chromium, the impact is limited to information disclosure without code execution capability.
Raindrop.io Bookmark Manager Web App version 5.6.76.0 allows remote unauthenticated attackers to obtain sensitive user data through insufficient validation of Chrome extension identifiers in crafted requests. The vulnerability exploits improper input validation (CWE-20) to bypass security controls, enabling information disclosure with low integrity impact. No active exploitation has been confirmed in CISA KEV, but publicly available vulnerability research exists on GitHub.
A command injection vulnerability (CVSS 6.7). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability (CWE-1188) that allows local attackers with low privileges to execute arbitrary code on the host system by exploiting disabled OS-level sandbox protections in the Chromium browser container. The vulnerability does not require a sandbox escape, making exploitation straightforward for local users. A patch is available from the vendor, and the issue was reported by VulnCheck with references to GitHub security advisories and patch commits.
Cross-origin data leakage in Google Chrome's Dawn component on macOS versions prior to 146.0.7680.153 results from an integer overflow vulnerability that can be triggered through a malicious HTML page. An unauthenticated attacker can exploit this to access sensitive information from other origins without user interaction beyond viewing the crafted page. Patches are available for Chrome, Ubuntu, and Debian.
PinchTab contains a Server-Side Request Forgery (SSRF) vulnerability in its /download endpoint that allows unauthenticated attackers to bypass URL validation and cause the embedded Chromium browser to make requests to internal network services. The vulnerability affects PinchTab versions 0.7.x and 0.8.x when the security.allowDownload setting is enabled (disabled by default), and exploits a validation gap where only the initial user-supplied URL is checked while subsequent browser-initiated requests (redirects, JavaScript navigations, resource fetches) bypass this protection entirely. Although the attacker cannot receive response bodies from internal services (blind SSRF), they can trigger state-changing endpoints on localhost or private network addresses reachable from the PinchTab host, with a proof-of-concept publicly available demonstrating counter increments on internal services.
OpenClaw Gateway versions prior to 2026.2.22 leak authentication tokens through Chrome DevTools Protocol (CDP) probe traffic on loopback interfaces, allowing local attackers to intercept the x-OpenClaw-relay-token header and reuse it for unauthorized Gateway access. An attacker with local network access or control of a loopback port can capture reachability probes to the /json/version endpoint and escalate privileges by replaying the stolen token as bearer authentication. A vendor patch is available, and this vulnerability has been documented by VulnCheck with references to the official GitHub security advisory and patch commit.
Incorrect security UI in PictureInPicture in Google Chrome versions up to 146.0.7680.71 is affected by user interface (ui) misrepresentation of critical information (CVSS 4.3).
Data race in audio in Google Chrome prior to 89.0.4389.72 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Heap buffer overflow in V8 in Google Chrome prior to 88.0.4324.150 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Heap buffer overflow in UI in Google Chrome on Android prior to 86.0.4240.185 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Heap buffer overflow in Freetype in Google Chrome prior to 86.0.4240.111 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated critical severity (CVSS 9.6), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Type confusion in V8 in Google Chrome prior to 80.0.3987.122 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Out of bounds write in JavaScript in Google Chrome prior to 73.0.3683.86 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Use after free in WebAudio in Google Chrome prior to 78.0.3904.87 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Object lifetime issue in Blink in Google Chrome prior to 72.0.3626.121 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Execution of user supplied Javascript during array deserialization leading to an out of bounds write in V8 in Google Chrome prior to 71.0.3578.80 allowed a remote attacker to execute arbitrary code. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Integer overflow in computing the required allocation size when instantiating a new javascript object in V8 in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to potentially exploit. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Incorrect side effect annotation in V8 in Google Chrome prior to 70.0.3538.64 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.2987.108 for Android allowed a remote attacker to execute arbitrary code via a. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Container before 106 on Mozilla Firefox, the GpcContainer Class ActiveX control. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac included incorrect optimisation assumptions, which allowed a remote attacker to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, does not properly consider element data types, which allows remote attackers to. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on Windows. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and EPSS exploitation probability 47.6%.
Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.302 on Windows and OS X, 14.x through 18.0.0.203 on. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Actively exploited in the wild (cisa kev) and public exploit code available.
Mozilla Firefox before 37.0, Firefox ESR 31.x before 31.6, and Thunderbird before 31.6 do not properly restrict resource: URLs, which makes it easier for remote attackers to execute arbitrary. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 85.4%.
Mozilla Firefox before 37.0 relies on docshell type information instead of page principal information for Window.webidl access control, which might allow remote attackers to execute arbitrary. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 80.4%.
The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with a DOM object that has a named getter, which might allow remote attackers to. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and EPSS exploitation probability 83.6%.
The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and SeaMonkey before 2.25 allows remote attackers to execute arbitrary JavaScript. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and EPSS exploitation probability 71.1%.
Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 10.x before 10.0.12 and 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 87.4%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 74.6%.
The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbird before 16.0, Thunderbird ESR 10.x before 10.0.8, and SeaMonkey before 2.13. Rated critical severity (CVSS 9.3), this vulnerability is remotely exploitable. Public exploit code available and EPSS exploitation probability 80.8%.
Memory corruption in Google Chrome's CacheStorage subsystem, affecting versions prior to 156.0.8078.79, allows a remote attacker who convinces a victim to render a crafted HTML page to read memory contents; the issue is rated moderate (CVSS 4.3) because exploitation requires user interaction and the confirmed impact is limited to confidentiality. No public exploit has been identified at time of analysis, EPSS is 0.20% (9th percentile), and CISA SSVC records no known exploitation with partial technical impact. Authentication is not required per the CVSS vector (PR:N), but the crafted page must be visited and rendered (UI:R), and no code execution or availability impact is confirmed from this issue alone.
Memory corruption in ANGLE, the graphics abstraction layer bundled with Google Chrome, allows a remote attacker to read memory inside the renderer sandbox on Chrome builds prior to 156.0.8078.73. Exploitation requires the victim to load a crafted HTML page (CVSS UI:R) and no credentials are needed; impact is bounded to confidentiality (C:L) with no integrity, availability, or sandbox-escape effect stated. Google rates the flaw High severity within Chromium, but externally it scores 4.3, EPSS is 0.18% (8th percentile), there is no CISA KEV entry, and no public exploit has been identified at time of analysis; a vendor patch is available.
Memory corruption in Google Chrome's Extensions component before version 156.0.8078.47 can let a remote attacker read memory inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction - the victim must visit or be redirected to the malicious page - and the assessed impact is confidentiality-only, with no code execution, data modification, or crash from this bug alone, making it most relevant as a chaining primitive. No public exploit code was identified at time of analysis, EPSS is low at 0.23%, and Google rates the Chromium security severity as Medium.
Memory disclosure inside the Chrome renderer sandbox affects Google Chrome versions prior to 156.0.8078.47; a remote attacker can trigger it only when the victim loads a crafted HTML page, yielding read access to sandboxed process memory with no integrity or availability impact. No public exploit identified at time of analysis, and EPSS is low at 0.22% (11th percentile). Google has released Chrome 156.0.8078.47 as the fixed version.
Memory corruption in Google Chrome's CacheStorage implementation, present in versions prior to 156.0.8078.47, allows a remote attacker to potentially read memory inside the renderer sandbox when a victim loads a crafted HTML page. The flaw is unauthenticated from the target's perspective (PR:N) and needs no non-default configuration, but it hinges on user interaction (UI:R) and is scoped to the renderer (S:U), with confidentiality-only impact and no demonstrated sandbox escape. Google's Chromium severity rating is High, EPSS is low at 0.22% (12th percentile), no public exploit code has been identified at time of analysis, and this is a moderate-priority issue rather than a top-tier emergency; a vendor patch is available in 156.0.8078.47.
Information disclosure in Google Chrome's font handling allows a remote, unauthenticated attacker to read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page containing a malformed font. All desktop Chrome builds prior to 156.0.8078.47 are affected, and because font parsing is part of normal page rendering, no special configuration is required beyond the victim visiting the attacker's page (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N). There is no public exploit code identified at time of analysis and the flaw is not in CISA KEV; EPSS is 0.22% (12th percentile), consistent with a low-urgency, sandbox-confined memory leak that Google itself rated Low severity.
Memory corruption within Chrome's CSS engine lets a remote attacker read memory that is otherwise confined to the renderer sandbox by convincing a user to open a crafted HTML page in any Chrome build prior to 156.0.8078.47. The CVSS vector (AV:N/AC:L/PR:N/UI:R) means no credentials are needed, but the attack is not drive-by-silent: it depends on the victim navigating to attacker-controlled content, so it is a social-engineering or malicious-page delivery problem rather than a wormable one. Impact is bounded to information disclosure inside the sandbox - there is no sandbox escape, no code execution and no data modification - and our independent assessment rates confidentiality impact as Low rather than the vendor-published High, giving a moderate-risk browser flaw that does not warrant emergency prioritization. EPSS is just 0.18% (8th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis, though Google has shipped a fix in 156.0.8078.47.
Cross-origin information leakage in Google Chrome's Media component affects desktop builds prior to 155.0.8059.79, allowing an unauthenticated remote attacker to observe a discrepancy (CWE-203) and infer small amounts of data belonging to another origin. Exploitation requires the victim to be lured into loading a crafted HTML page in a vulnerable browser, and the HIGH attack complexity / LOW confidentiality impact combination means only low-volume disclosure is possible with no integrity or availability effect. No confirmed active exploitation and no public exploit code were identified at time of analysis, and EPSS is very low at 0.17% (6th percentile); a vendor-released fix is available in Chrome 155.0.8059.79.
Use-after-release in Google Chrome's FontAccess (Local Font Access API) lets an attacker who has already compromised the renderer process bypass web origin policy by luring a victim to a crafted HTML page in Chrome versions prior to 155.0.8059.39. Successful exploitation yields no confidentiality loss but a high integrity impact, as the attacker can subvert origin boundaries from inside an already-broken renderer; the required renderer compromise is a hard prerequisite and makes this a defense-in-depth, medium-severity issue rather than a standalone remote entry point. No public exploit identified at time of analysis, EPSS is low at 0.31% (22nd percentile), and Google has released a fixed build. The CVSS vector shows PR:N/UI:R, meaning unauthenticated attackers are relevant but victim interaction (loading the page) is mandatory; our own assessment rates attack complexity as High rather than Low given the prerequisite renderer foothold.
UI spoofing in Google Chrome (all versions prior to 155.0.8059.39) lets an attacker who has already compromised the renderer process fake browser interface elements - such as dialogs, permission prompts or address-bar style chrome - in front of the user via a crafted HTML page. The weakness is a use-after-free of a released resource (CWE-672) in UI code: unauthenticated from a network standpoint (PR:N), but gated behind a prior renderer compromise, mandatory user interaction (UI:R) and non-trivial timing/state conditions (AC:H). Independent assessment scores it CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N - strictly a user-interface integrity issue with no confidentiality or availability impact - and Chromium rated it Low. No public exploit code and no confirmed active exploitation were identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39.
Missing authorization in Google Chrome before 155.0.8059.39 allows a remote attacker to bypass system access restrictions by luring a victim to a crafted HTML page, with only partial confidentiality and integrity impact. No public exploit identified at time of analysis, the EPSS score is 0.19% (8th percentile), and CISA's SSVC assessment records no exploitation; the vendor has released a patched version.
Incorrect authorization in Google Chrome's PermissionElement component, affecting desktop builds prior to 155.0.8059.39, allows a remote attacker to bypass system access restrictions by enticing a user to load a crafted HTML page. The attacker needs no credentials and no prior access (CVSS:3.1/AV:N/AC:L/PR:N), but successful exploitation depends on the victim actively visiting or rendering the malicious page (UI:R) and on reaching the specific permission-handling code path, so impact is confined to partial confidentiality and integrity loss with no availability impact. Risk is low in practice: EPSS is 0.18% (7th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, CISA's SSVC rates exploitation as none and automatable as no, and Chromium itself rates the issue Low severity despite the 5.4 base score; vendor-released patches are available in version 155.0.8059.39.
UI spoofing in Google Chrome's Web Authentication (Passkeys & Security Keys) component allows remote attackers to render deceptive interface elements to users who open a crafted HTML page, because the browser fails to enforce an authorization check before displaying WebAuthn-related UI. The flaw affects Google Chrome on all platforms prior to 155.0.8059.39 and carries a moderate 5.4 CVSS score, although Chromium's own security severity rating is Low and the outcome is limited to user-interface deception rather than code execution or credential exfiltration. No public exploit code has been identified at time of analysis, there is no CISA KEV listing, and the attack is only reachable through mandatory user interaction (CVSS UI:R) with no authentication or privileges required (PR:N). Google has released a patched build, and all exploitation signals converge on a low real-world priority.
Google Chrome releases earlier than 155.0.8059.39 ship an API whose authorization checks are incorrect, letting a remote attacker bypass web origin policy by getting a victim to open a crafted HTML page. No authentication or non-default setting is required (PR:N), but this is not drive-by exploitation - the target must navigate to the attacker's page (UI:R), and the assessed impact is a single low-severity confidentiality/integrity metric with no availability loss, matching Chromium's own 'Low' severity rating and the modest 4.3 base score. There is no public exploit identified at time of analysis, EPSS is only 0.19% (8th percentile), and a vendor patch is available, so this is a routine patch-cycle item rather than an urgent one.
Incorrect authorization in Google Chrome's Scheduling component prior to version 155.0.8059.39 allows a remote attacker to bypass the browser's web origin policy by convincing a victim to load a crafted HTML page. Exploitation requires user interaction - the target must actively navigate to the attacker-controlled page (UI:R per the assessed CVSS vector) - but needs no authentication or privileges (PR:N), and the resulting impact is limited to integrity (I:L) with no confidentiality or availability effect. There is no public exploit code identified and no evidence of active exploitation at time of analysis, and the EPSS score of 0.19% (8th percentile) confirms a low likelihood of imminent exploitation; a vendor patch is available.
An origin-policy bypass in Chrome's DeviceBoundSessionCredentials component allows remote attackers to make the browser act as a confused deputy for an untrusted site via a crafted HTML page, affecting Chrome builds prior to 155.0.8059.39 (Chromium security severity: Low, CVSS 4.3). Exploitation is network-reachable and requires no attacker authentication (PR:N), but it depends entirely on the victim navigating to an attacker-controlled page (UI:R) and is limited to an integrity impact on web origin rules (C:N/I:L/A:N). No public exploit code has been identified at time of analysis, the issue is not in CISA KEV, and EPSS is low at 0.24% (13th percentile), which is consistent with the low-priority assessment of this defect.
Memory disclosure in Google Chrome versions prior to 155.0.8059.39 lets a remote, unauthenticated attacker read contents of process memory inside the renderer sandbox by convincing a victim to open a crafted HTML page that exercises the WebAudio API. Exploitation is bounded by the required user interaction (CVSS UI:R) and does not escape the Chrome sandbox, so there is no integrity or availability impact, only confidentiality loss (C:H) scored at CVSS 6.5. Publicly available exploit code exists per the SSVC assessment, but the issue is not confirmed as actively exploited (not in CISA KEV) and EPSS is low at 0.19% (8th percentile), making this a moderate-priority patching item rather than an emergency.
Incorrect authorization in Google Chrome's FontAccess implementation lets an attacker who has already compromised the renderer process bypass system access restrictions by getting the victim to load a crafted HTML page. Desktop Chrome builds prior to 155.0.8059.39 are affected; the flaw is a second-stage restriction/sandbox bypass rather than an entry point, since a separate renderer compromise and user interaction are both prerequisites. No public exploit has been identified at time of analysis, there is no CISA KEV listing, and EPSS is low at 0.18% (7th percentile), consistent with an independent assessment that this is a genuine but secondary-chain issue rather than a standalone high-priority threat.
Google Chrome versions prior to 155.0.8059.39 are affected by an incorrect authorization weakness in the Media component that enables a remote, unauthenticated attacker to leak limited cross-origin data when a victim loads a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, score 4.3) confirms that exploitation hinges on user interaction and results only in confidentiality impact, with no integrity or availability effects; CISA's SSVC assessment rates exploitation as 'none' and technical impact as 'partial', and no public exploit code has been identified at time of analysis. Vendor patches are available in the Chrome 155.0.8059.39 stable channel release.
Incorrect authorization in Google Chrome's Network component lets a remote attacker who has already compromised the renderer process bypass system access restrictions by having the victim load a crafted HTML page, with all desktop builds prior to 155.0.8059.39 affected. The flaw is reachable without authentication (AV:N/PR:N) but requires user interaction (UI:R) and, critically, a pre-existing renderer compromise, which is why our assessment raises attack complexity to AC:H and treats this as a second-stage bypass rather than an initial-access vector. Impact is confined to integrity (C:N/I:H/A:N) with no direct data disclosure or denial of service; no public exploit code has been identified at time of analysis, Chrome is not on CISA KEV, and EPSS is only 0.18% (7th percentile), so real-world risk is moderate rather than urgent despite the 6.5 vendor base score.
UI spoofing in Google Chrome versions prior to 155.0.8059.39 allows remote attackers to deceive users with fabricated browser interface elements rendered by a crafted HTML page. The flaw is an incorrect authorization check (CWE-863) in Chromium's Input component; exploitation requires the victim to open the attacker's page and be successfully socially engineered into trusting the spoofed UI (CVSS 3.1 base 5.4, AV:N/AC:L/PR:N/UI:R), with the independently assessed impact limited to integrity only (C:N/I:L/A:N). No public exploit code and no confirmed active exploitation were identified at time of analysis, and the primary limiting factor remains user interaction rather than any technical prerequisite. A vendor patch is available in Chrome 155.0.8059.39, so this is a medium-risk, low-priority hardening item rather than an urgent emergency.
Clickjacking in the EVP component of Google Chrome allows a remote, unauthenticated attacker to overlay and spoof UI elements by tricking a victim into visiting a crafted HTML page and clicking on concealed controls. The attack is purely a UI-redressing/deception issue - the independent assessment scores it as no confidentiality, no availability, and low integrity impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) despite the vendor's 5.4 'Medium' rating - and it succeeds only where social engineering works, with no code execution or data exfiltration. Google shipped a fix in Chrome 155.0.8059.39; no KEV listing and no public exploit code identified at time of analysis.
Uninitialized memory disclosure in Google Chrome's Video component (all versions prior to 155.0.8059.39) lets a remote attacker read memory inside the renderer sandbox by convincing a victim to load a crafted HTML page. Exploitation requires user interaction (UI:R) with no authentication (PR:N), and the resulting leak is confined to the sandboxed renderer, so it would realistically need to be chained with a separate sandbox-escape to reach host data. There is no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.24% (13th percentile); vendor-released patch 155.0.8059.39 resolves the issue, and CISA SSVC rates exploitation as 'none' with partial technical impact.
Missing authorization in Google Chrome's Google Lens component (versions prior to 155.0.8059.39) lets a remote, unauthenticated attacker read cross-origin data when a victim loads a crafted HTML page - but only after that attacker has already compromised the browser's renderer process, which is the gating precondition and makes this a chained, secondary flaw rather than a standalone entry point. Exploitation additionally requires user interaction (UI:R) and yields only low-severity confidentiality impact with no integrity or availability effect, so the assessed vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N for a base score of 3.1, rated Medium by Chromium. Vendor-released patch: 155.0.8059.39; no public exploit identified at time of analysis, and no CISA KEV status or EPSS signal indicates active exploitation.
Missing authorization in a Chrome API allows an attacker-crafted extension to leak sensitive information from Google Chrome installations running versions prior to 155.0.8059.39. Exploitation requires the victim to install and run the malicious extension, so it depends on successful social engineering and mandatory user interaction (CVSS 6.1, AV:L/PR:N/UI:R) rather than direct network reachability, with confidentiality rated High and a limited integrity impact. No public exploit code or active exploitation has been identified at time of analysis, EPSS is low at 0.19% (8th percentile), and Google has released a patched build, so auto-updated browsers at 155.0.8059.39 or later are not affected.
UI spoofing in Google Chrome on iOS versions prior to 154.0.8037.92 allows a remote attacker to impersonate sign-in interface elements by luring the victim to a crafted HTML page, potentially deceiving the user into trusting and interacting with fake prompts. Exploitation requires user interaction (the victim must open the page and engage with the spoofed UI) and no authentication or special privileges; the impact is limited to UI misrepresentation and low-confidentiality disclosure, with no code execution or memory corruption demonstrated. No public exploit code or confirmed active exploitation has been identified at time of analysis, Chromium rates the issue security severity Low, and CISA's SSVC assessment records exploitation as none and automatable as no, so this should be treated as a low-priority hardening item rather than an urgent patch. A vendor patch is available in Chrome 154.0.8037.92, and Google has published a stable channel advisory plus a Chromium issue tracker entry.
UI misrepresentation in the TabStrip component of Google Chrome prior to 154.0.8037.92 lets a remote attacker spoof browser UI elements by luring a victim to a crafted HTML page, rated CVSS 5.4 (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) and Chromium security severity Low. No authentication or special privileges are required, but the victim must open the malicious page and be deceived by the spoofed chrome, and the outcome is limited to UI deception - no code execution, memory corruption, or direct data exfiltration has been demonstrated. There is no CISA KEV listing and no public exploit code identified at time of analysis, and auto-updated installations at or above 154.0.8037.92 are not affected.
Incorrect authorization in Chrome's Site Isolation component (versions prior to 154.0.8037.92) allows an attacker who has already compromised a renderer process to bypass web-origin policy using a crafted HTML page, producing cross-origin integrity violations without direct confidentiality or availability impact. This is a chained, second-stage bug rather than an initial access vector: exploitation presupposes a prior renderer compromise and also requires user interaction to load the attacker's content, which is why Chromium rates it Low security severity despite an NVD base score of 6.5. Google has shipped a patched build and no public exploit code was identified at time of analysis; there is no indication of confirmed active exploitation (no CISA KEV listing).
Missing authorization checks in Google Chrome's Payments component (desktop builds prior to 154.0.8037.92) let a remote attacker who has already compromised the browser's renderer process use a crafted HTML page to bypass web origin policy and perform cross-origin payment-related actions. The attacker is a remote, unauthenticated party per the CVSS vector (PR:N), but exploitation carries two hard preconditions: the renderer must first be compromised, and the victim must interact with the crafted page (UI:R). There is no public exploit identified at time of analysis, CISA's SSVC assessment records no exploitation and no automatable path, and only integrity is impacted (C:N/I:H/A:N), so despite the 6.5 base score this is a genuinely low-priority issue whose main risk driver is the prior renderer compromise rather than the origin-policy bypass itself.
Origin policy bypass in Google Chrome builds prior to 154.0.8037.92 lets a remote attacker who has already compromised the renderer process escape web origin restrictions via a crafted HTML page, producing a high integrity impact while confidentiality is unaffected. The defect is a missing authorization check in the browser's CORS handling (CWE-862), and it is not independently exploitable - a separate renderer-compromise vulnerability must be chained first, and the victim must load attacker-controlled content (UI:R). No public exploit code has been identified at time of analysis, CISA's SSVC rates exploitation as none and the issue as non-automatable with partial technical impact, and the vendor fix is Chrome 154.0.8037.92.
Memory disclosure across the Chrome sandbox boundary affects Google Chrome on Windows prior to 154.0.8037.92, where an uninitialized resource in the Media component lets content read memory it should not be able to reach. Exploitation is not self-contained: the attacker must already have compromised the renderer process through a separate, earlier vulnerability, and then have the victim load crafted HTML that exercises the Media code path (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N, base 3.4). Impact is limited to low-confidentiality readout with no integrity or availability effect, making this realistically an exploit-chain building block, and there is no public exploit identified at time of analysis; a vendor patch is available in 154.0.8037.92.
Cross-site scripting in Chrome's WebUI layer allows a remote, unauthenticated attacker to escape the normal web origin boundary and inject script into a privileged chrome:// internal page when a victim loads a crafted HTML page in Chrome versions prior to 154.0.8037.92. Because the vulnerable surface is Chrome's own WebUI (CWE-79) rather than ordinary web content, successful exploitation crosses a trust boundary (CVSS scope change S:C), giving the attacker low-level read and write influence over the privileged page; the vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, base 6.1) confirms no authentication is required but user interaction is mandatory, and no availability impact is assessed. There is no public exploit identified at time of analysis and no CISA KEV listing; Google has released a fixed build, 154.0.8037.92, so risk is concentrated in unpatched installations. This issue is tracked as EUVD-2026-89395 and documented in the September 2026 Chrome stable channel release notes.
An out-of-bounds read in Chrome's WebGL implementation allows a remote attacker to disclose a limited amount of memory beyond the renderer/sandbox boundary in Google Chrome builds prior to 154.0.8037.92. Exploitation is unauthenticated (PR:N) but requires the victim to load attacker-controlled HTML that exercises the WebGL rendering path (UI:R), and the confirmed impact is limited to a partial information disclosure with no integrity or availability effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the practical value to an attacker is low because the quantity and controllability of the leaked data are constrained and unpredictable. Chromium rated the issue High severity, and Google has published a stable-channel fix, but the assessed CVSS of 4.7 keeps this in low-priority territory relative to memory-corruption bugs that grant code execution.
An uninitialized-memory flaw in Chrome's GPU component (CVE-2026-102319, CWE-908) lets an attacker who has already compromised the renderer process read memory outside the browser sandbox by loading a crafted HTML page, providing a sandbox-weakening information-disclosure primitive rather than direct code execution. Affected are Google Chrome builds prior to 154.0.8037.92 on all platforms (CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*); the independent assessment scores this CVSS 3.1 at 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), classifying it as a genuine but low-priority issue despite Chromium's internal 'High' label, because it requires a prior renderer compromise, high attack complexity, and user interaction, and yields only partial confidentiality impact. No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis, and vendor-released patch Chrome 154.0.8037.92 is available.
Uninitialized-memory handling in Skia, Chrome's 2D graphics rendering library, allows a remote attacker to leak cross-origin data when a victim loads a crafted HTML page in Google Chrome versions prior to 154.0.8037.92. Exploitation is bounded by the mandatory user interaction (UI:R) - the target must open or render attacker-controlled content - and by the impact, which is limited to a partial confidentiality breach (C:L) with no integrity or availability effect, no code execution, and no authentication requirement (PR:N) on default builds. Google rates the underlying Chromium issue as High severity, though the assessed CVSS of 4.3 reflects the narrow cross-origin information-disclosure outcome; no public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA SSVC scoring aligns (Exploitation: none, Automatable: no, Technical Impact: partial). A vendor patch is available in Chrome 154.0.8037.92.
Uninitialized memory in Google Chrome's WebGPU implementation, in builds prior to 154.0.8037.92, can be read back by a remote attacker as cross-origin data when a victim loads a crafted HTML page. The flaw is unauthenticated and remote (CVSS:3.1/AV:N/AC:L/PR:N) but demands that the victim visit the attacker-controlled page (UI:R) and that WebGPU is reachable on the target platform; the outcome is a limited information disclosure with no code execution, no write primitive, and no availability impact, which is why the CVSS 3.1 base score is only 4.3 despite Chromium's internal 'High' severity label. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV), so this is a genuinely low real-world priority even given Chrome's ubiquity.
Information disclosure in Google Chrome on Android before version 154.0.8037.92 allows an attacker who has already compromised the renderer process to read memory outside the browser sandbox by getting the victim to load a crafted HTML page. The flaw is an uninitialized-resource bug (CWE-908) in the GPU component, so it leaks memory rather than executing code or modifying state, and the practical exploitability is sharply limited by the precondition that the attacker must first hold a compromised renderer - a requirement the scored vector does not capture despite PR:N. Scored CVSS is only 3.4 (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:N/A:N), no public exploit code was identified at time of analysis, and no confirmed active exploitation (CISA KEV) is associated with this CVE; a vendor-released fix exists in Chrome 154.0.8037.92, making this a low-priority patch-and-move-on item despite Chromium's 'High' security severity label.
Information disclosure in Google Chrome on Android prior to 154.0.8037.92 lets a remote attacker read cross-origin data by delivering a crafted HTML page that drives GPU rendering and reads back uninitialized GPU memory. The flaw is unauthenticated (CVSS PR:N) but gated by required user interaction (UI:R) - the victim must open the malicious page - and its impact is confined to low confidentiality loss (C:L), with no code execution, data modification, or denial of service. No public exploit code and no confirmed active exploitation were identified at time of analysis, and CISA's SSVC assessment rates the bug non-automatable with only partial technical impact, so real-world risk remains low despite Chromium's 'High' severity label.
Uninitialized-resource handling in Dawn, Chromium's WebGPU implementation, exposes Chrome for Android builds prior to 154.0.8037.92 to out-of-bounds memory reads triggered by a crafted HTML page (CWE-908). A remote attacker who convinces a victim to load the malicious content can leak limited graphics-process memory that may fall outside the browser sandbox boundary, although the CVSS 3.1 score of 4.7 with C:L/I:N/A:N indicates the payoff is a low-confidence information disclosure rather than code execution. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor has released a fixed build.
Uninitialized resource handling in ANGLE, the GPU translation layer bundled with Google Chrome on Windows, lets a remote attacker who gets a victim to load a crafted HTML page trigger a memory read that crosses the browser's sandbox boundary, although the leak is limited to low-severity confidentiality impact (CVSS 4.7, C:L, S:C with no integrity or availability effect). Only Chrome builds on Windows prior to 154.0.8037.92 are affected; the attack is unauthenticated per the CVSS vector but requires user interaction (UI:R) - the victim must open or be redirected to attacker-controlled content that exercises the WebGL/GPU-accelerated path. No public exploit code identified at time of analysis, no confirmed active exploitation (CISA KEV), and Google has already published a fixed build, so the practical risk is low.
Out-of-bounds memory access in Google Chrome's video codec handling - fixed in the 147.0.7727.55 desktop release - can be triggered when a victim loads a crafted video file, resulting in a bounded memory over-read that leaks limited process data rather than enabling code execution. The issue is network-reachable without authentication (CVSS PR:N) but strictly requires the user to load attacker-controlled media (UI:R), and CISA's SSVC assessment classifies it as non-automatable with only partial technical impact; no public exploit code identified at time of analysis and it is not listed in CISA KEV. With a CVSS base of 4.3 and Chromium's own rating of 'Low', this is a low-priority, routine-patching issue, notable mainly because Chrome's ubiquity makes even low-severity memory-safety defects worth closing promptly.
Cross-origin information disclosure in Google Chrome (through the bundled Skia graphics library) affects versions prior to 153.0.8010.52, where improper state validation lets a crafted HTML page cause the renderer to expose data belonging to another origin. Exploitation requires the victim to load an attacker-controlled page (UI:R) and yields only partial confidentiality impact - no code execution, data modification, or denial of service - which is why the CVSS base score is a modest 4.3. No public exploit code has been identified at time of analysis, CISA SSVC rates exploitation as none and automatable as no, and the vendor has released a fixed build, so this should be treated as a low-priority, patch-routinely item rather than an emergency.
UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 153.0.8010.52) lets a remote, unauthenticated attacker misrepresent interface elements to a user who visits a crafted HTML page, but only if the victim is successfully socially engineered into trusting the falsified prompt. Exploitation requires mandatory user interaction (CVSS UI:R) and produces only a limited integrity impact - no code execution, no data exfiltration, and no availability loss - which is why Chromium rates it Low severity. No public exploit code has been identified at time of analysis, CISA SSVC records no exploitation and rates the issue non-automatable with partial technical impact, and the vendor has released a patch in Chrome 153.0.8010.52.
Information disclosure in the Paint component of Google Chrome desktop allows unauthenticated remote attackers to obtain sensitive information when a victim renders a crafted HTML page, per CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N (6.5). Exploitation is gated by mandatory user interaction (UI:R), keeping it out of the automatable category under CISA's SSVC assessment (Exploitation: none, Automatable: no, Technical Impact: partial), and no public exploit code has been identified at time of analysis. The confidentiality-only impact - no integrity or availability effect, no code execution or sandbox escape reported - makes this a genuine but modest issue rather than an urgent priority; Google has released a fixed build, so exposure ends once Chrome is updated to 153.0.8010.52 or later.
Server-side request forgery in the Omnibox of Google Chrome on Android prior to 153.0.8010.52 allows an unauthenticated remote attacker to bypass system access restrictions by combining social engineering with crafted network traffic, producing only a limited integrity impact (CVSS 3.7, AC:H, C:N/I:L/A:N) with no confidentiality or availability loss and no code execution. The bug is Android-scoped, rated Medium by Chromium, and no public exploit code has been identified at time of analysis; CISA's SSVC assessment records exploitation as 'none' and automatable as 'no'. In short, this is a low-priority, low-real-risk issue despite being a network-vector SSRF in a ubiquitous browser.
Cross-origin information disclosure in Google Chrome's Permissions implementation allows a remote attacker to leak data across origin boundaries when a victim opens a crafted HTML page in Chrome versions prior to 153.0.8010.52. Exploitation requires user interaction (the victim must load the page) but no authentication or special privileges, and the impact is limited to low-sensitivity data exposure (CVSS 4.3, Chromium severity Medium). No public exploit code or confirmed active exploitation was identified at time of analysis, and the auto-updating Stable channel sharply narrows the exposure window once 153.0.8010.52 propagates.
Access-restriction bypass in Google Chrome's FileSystem component affects all builds prior to 153.0.8010.52 and is only reachable by an attacker who has ALREADY compromised the browser's renderer process through a separate vulnerability, then convinces the victim via social engineering to open a crafted HTML page and finally wins a timing-dependent race condition (CWE-367 TOCTOU). Impact is deliberately narrow: CVSS 3.1 (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N) reflects no confidentiality or availability loss and only low-integrity impact, with high attack complexity and mandatory user interaction. There is no public exploit identified at time of analysis and no indication of active exploitation; patched builds (153.0.8010.52 and later) are not exploitable, and this is assessed as a low-real-risk browser flaw rather than a standalone attack path.
Incorrect authorization in Google Chrome's Opaque Response Blocking (ORB) implementation lets remote attackers bypass site isolation by luring a victim into loading a crafted HTML page, exposing limited cross-site data on unpatched builds below 153.0.8010.52. The assessed impact is a low-confidentiality read (CVSS 4.3, C:L) rather than code execution or a full same-origin-policy break, and the attacker needs no credentials although user interaction is mandatory (PR:N / UI:R). There is no public exploit identified at time of analysis, and Google has shipped a fixed build, 153.0.8010.52, making this a routine update rather than an emergency patch.
Google Chrome builds prior to 153.0.8010.52 contain a missing-authorization flaw (CWE-862) in the Storage component that lets a crafted PDF file bypass Chrome's site isolation boundary. The practical impact is narrow: an attacker must already have compromised the Chrome renderer process through a separate, independent vulnerability before this flaw can be leveraged, making it a defense-in-depth boundary bypass rather than a standalone initial-access vector. Per the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, base 3.1) the attack is remote and unauthenticated but requires user interaction and yields only low-confidentiality impact; no public exploit code has been identified at time of analysis, and there is no confirmed active exploitation (CISA KEV). Google has released a patched build, and ENISA EUVD tracks the issue as EUVD-2026-82488. Overall this is a low real-world priority despite affecting a ubiquitous product.
Memory disclosure in Google Chrome prior to 153.0.8010.52 allows a local attacker to read out-of-bounds data through the browser's DataTransfer implementation, with the sandbox-crossing scope change (S:C) in the CVSS vector indicating the leaked memory can originate outside the renderer process rather than from within the attacker's own context. Per the assessed vector (AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N, base 6.3) exploitation requires the attacker to already be running a local program on the victim's machine and to use social engineering to obtain user interaction, and it produces only confidentiality impact with no integrity or availability effect, so this is an information-disclosure bug rather than a sandbox escape or code-execution primitive. There is no public exploit code identified at time of analysis and the issue is not confirmed actively exploited (it is not in CISA KEV); Google has shipped version 153.0.8010.52, which resolves the flaw.
Confused-deputy handling in the PriceTracking component of Google Chrome on iOS lets a remote, unauthenticated attacker reach a privileged in-browser page and bypass system access restrictions on versions prior to 153.0.8010.47. Exploitation is not straightforward - it requires the attacker to pair crafted network traffic with successful social engineering of the user (the independent assessment scores AC:H and UI:R, even though the published NVD vector lists UI:N), and the resulting impact is confined to Low confidentiality and Low integrity inside the browser context with no availability loss and no code execution outside Chrome. There is no evidence of active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis; EPSS is only 0.22% (12th percentile), and a vendor fix is already available, making this a genuinely low-priority issue despite the 'Authentication Bypass' tag.
Cross-origin data disclosure in Google Chrome versions prior to 153.0.8010.47 occurs when an attacker who has already compromised the renderer process lures a victim to a crafted HTML page. The weakness lives in the GetUserMedia media-capture code path, where incomplete cleanup (CWE-459) leaves cross-origin data recoverable, as captured by the CVSS v3.1 vector AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N (score 3.1) - unauthenticated network reach but high attack complexity, mandatory user interaction, and confidentiality-only, low-magnitude impact. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped the fix in Chrome 153.0.8010.47.
UI spoofing in Google Chrome's WebAppInstalls subsystem - all builds prior to 153.0.8010.47 - lets a remote, unauthenticated attacker mislead a user with falsified interface elements (for example, a convincing install or permission prompt) rendered from a crafted HTML page. Per the assessed vector (AV:N/AC:H/PR:N/UI:R, C:N/I:L/A:N), exploitation depends on the victim actively visiting the attacker's page and on the attacker winning a timing race, which makes reliable abuse difficult and confines real-world impact to low-integrity visual deception rather than code execution, data disclosure, or denial of service; there is no public exploit identified at time of analysis, EPSS is a negligible 0.17% (7th percentile), and the issue is not in CISA KEV. Google has shipped a fix in Chrome 153.0.8010.47, so this is a low-priority, patch-and-move-on item with low risk across every signal.
Open WebUI versions up to 0.8.8 expose admin-configured system prompts to authenticated regular (non-admin) users through the /api/models API endpoint, allowing information disclosure of sensitive model instructions and internal configuration details. The vulnerability requires valid user authentication but no administrative privileges, enabling any authenticated user to retrieve confidential system prompts via a simple HTTP GET request. This is confirmed actively exploited in production deployments with a publicly available proof-of-concept.
Site Isolation bypass in Google Chrome prior to 148.0.7778.168 allows remote attackers who have already compromised the renderer process to access cross-site data via crafted HTML pages. The vulnerability affects Chrome's AI policy enforcement, enabling a second-stage attack after initial renderer compromise. Attack complexity is high, requiring both initial renderer compromise and user interaction. EPSS score of 0.02% indicates very low exploitation probability, and no active exploitation or public POC has been identified. Vendor patch is available in Chrome 148.0.7778.168.
Cross-origin source code exposure in webpack-dev-server up to 5.2.3 allows attackers controlling a malicious website to steal bundled application source code when a developer runs the dev server over non-trustworthy HTTP origins. The vulnerability exploits the omission of Sec-Fetch-Mode and Sec-Fetch-Site headers on non-HTTPS connections, enabling script injection and cross-origin code exfiltration. Chromium-based browsers Chrome 142+ are exempt due to local network access restrictions. CVSS 5.3 (AC:H due to user requirement to visit attacker site; High confidentiality impact). Fix: upgrade to webpack-dev-server 5.2.4 or later.
Out-of-bounds memory read in Google Chrome's V8 JavaScript engine allows remote attackers to disclose sensitive information via a crafted HTML page. Affects Chrome versions prior to 148.0.7778.96. The vulnerability requires user interaction (opening a malicious page) but operates over the network with no authentication required. While classified as medium severity by Chromium, the impact is limited to information disclosure without code execution capability.
Raindrop.io Bookmark Manager Web App version 5.6.76.0 allows remote unauthenticated attackers to obtain sensitive user data through insufficient validation of Chrome extension identifiers in crafted requests. The vulnerability exploits improper input validation (CWE-20) to bypass security controls, enabling information disclosure with low integrity impact. No active exploitation has been confirmed in CISA KEV, but publicly available vulnerability research exists on GitHub.
A command injection vulnerability (CVSS 6.7). Remediation should follow standard vulnerability management procedures. Vendor patch is available.
OpenClaw versions prior to 2026.2.21 contain an improper sandbox configuration vulnerability (CWE-1188) that allows local attackers with low privileges to execute arbitrary code on the host system by exploiting disabled OS-level sandbox protections in the Chromium browser container. The vulnerability does not require a sandbox escape, making exploitation straightforward for local users. A patch is available from the vendor, and the issue was reported by VulnCheck with references to GitHub security advisories and patch commits.
Cross-origin data leakage in Google Chrome's Dawn component on macOS versions prior to 146.0.7680.153 results from an integer overflow vulnerability that can be triggered through a malicious HTML page. An unauthenticated attacker can exploit this to access sensitive information from other origins without user interaction beyond viewing the crafted page. Patches are available for Chrome, Ubuntu, and Debian.
PinchTab contains a Server-Side Request Forgery (SSRF) vulnerability in its /download endpoint that allows unauthenticated attackers to bypass URL validation and cause the embedded Chromium browser to make requests to internal network services. The vulnerability affects PinchTab versions 0.7.x and 0.8.x when the security.allowDownload setting is enabled (disabled by default), and exploits a validation gap where only the initial user-supplied URL is checked while subsequent browser-initiated requests (redirects, JavaScript navigations, resource fetches) bypass this protection entirely. Although the attacker cannot receive response bodies from internal services (blind SSRF), they can trigger state-changing endpoints on localhost or private network addresses reachable from the PinchTab host, with a proof-of-concept publicly available demonstrating counter increments on internal services.
OpenClaw Gateway versions prior to 2026.2.22 leak authentication tokens through Chrome DevTools Protocol (CDP) probe traffic on loopback interfaces, allowing local attackers to intercept the x-OpenClaw-relay-token header and reuse it for unauthorized Gateway access. An attacker with local network access or control of a loopback port can capture reachability probes to the /json/version endpoint and escalate privileges by replaying the stolen token as bearer authentication. A vendor patch is available, and this vulnerability has been documented by VulnCheck with references to the official GitHub security advisory and patch commit.
Incorrect security UI in PictureInPicture in Google Chrome versions up to 146.0.7680.71 is affected by user interface (ui) misrepresentation of critical information (CVSS 4.3).