Chromium
Monthly
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
Use-after-free in the Workers component of Google Chrome allows an unauthenticated remote attacker to execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page in any build prior to 153.0.8010.47, including default desktop installations on Windows, macOS and Linux. The only prerequisite is user interaction - opening or being lured to the malicious page (UI:R) - with no special configuration or prior access needed, and because the flaw yields a scope change the compromise extends to the host rather than remaining confined to the renderer. Google rates the issue Critical and has shipped a fixed build; exploitation is not currently observed, CISA's SSVC assessment classifies the flaw as not automatable, and no public exploit identified at time of analysis, though the combination of network reachability, low attack complexity and total technical impact makes it a genuine high-priority vulnerability for prompt patching.
Remote code execution inside the renderer sandbox can be triggered in unpatched Google Chrome builds by a use-after-free in the browser's built-in PDF rendering component. Exploitation is unauthenticated (CVSS PR:N) but requires the victim to open a crafted HTML page that embeds malicious PDF content (UI:R), and any resulting code execution is confined to Chrome's renderer sandbox - meaning this bug alone does not compromise the host and would typically need to be chained with a separate sandbox-escape flaw for full system compromise. A vendor patch is available in Chrome 153.0.8010.47; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the 8.8 CVSS score and the ubiquity of Chrome make timely patching a priority.
Use-after-free in Google Chrome's WebAppInstalls component allows a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page on any build prior to 153.0.8010.47. Exploitation requires user interaction (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6), and the scope-changed rating reflects that a successful attack escapes the renderer sandbox and reaches the host rather than staying contained in the browser process. At time of analysis there is no indication of active exploitation and no public exploit code identified; the vendor has shipped a fixed build (153.0.8010.47) and the primary exposure is unpatched consumer and enterprise Chrome installations.
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pages; the same flaw affects other Chromium- and WebKit-based browsers, including Apple Safari/WebKit, webkitgtk, wpewebkit, and Qt WebEngine before 6.9.1-r3 on Alpine Linux. Exploitation requires only user interaction (victim views malicious web content) and no authentication; it has been confirmed actively exploited (CISA KEV), though EPSS probability is currently low (0.25%, 49th percentile).
Out-of-bounds memory access in Google Chrome's video codec handling - fixed in the 147.0.7727.55 desktop release - can be triggered when a victim loads a crafted video file, resulting in a bounded memory over-read that leaks limited process data rather than enabling code execution. The issue is network-reachable without authentication (CVSS PR:N) but strictly requires the user to load attacker-controlled media (UI:R), and CISA's SSVC assessment classifies it as non-automatable with only partial technical impact; no public exploit code identified at time of analysis and it is not listed in CISA KEV. With a CVSS base of 4.3 and Chromium's own rating of 'Low', this is a low-priority, routine-patching issue, notable mainly because Chrome's ubiquity makes even low-severity memory-safety defects worth closing promptly.
Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Fonts implementation in Google Chrome before 40.0.2214.91 does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation in Google Chrome before 40.0.2214.91 uses an incorrect data type for a certain length value, which. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
Use-after-free in the Workers component of Google Chrome allows an unauthenticated remote attacker to execute arbitrary code outside the browser sandbox when a victim renders a crafted HTML page in any build prior to 153.0.8010.47, including default desktop installations on Windows, macOS and Linux. The only prerequisite is user interaction - opening or being lured to the malicious page (UI:R) - with no special configuration or prior access needed, and because the flaw yields a scope change the compromise extends to the host rather than remaining confined to the renderer. Google rates the issue Critical and has shipped a fixed build; exploitation is not currently observed, CISA's SSVC assessment classifies the flaw as not automatable, and no public exploit identified at time of analysis, though the combination of network reachability, low attack complexity and total technical impact makes it a genuine high-priority vulnerability for prompt patching.
Remote code execution inside the renderer sandbox can be triggered in unpatched Google Chrome builds by a use-after-free in the browser's built-in PDF rendering component. Exploitation is unauthenticated (CVSS PR:N) but requires the victim to open a crafted HTML page that embeds malicious PDF content (UI:R), and any resulting code execution is confined to Chrome's renderer sandbox - meaning this bug alone does not compromise the host and would typically need to be chained with a separate sandbox-escape flaw for full system compromise. A vendor patch is available in Chrome 153.0.8010.47; no public exploit code has been identified at time of analysis and there is no CISA KEV listing, though the 8.8 CVSS score and the ubiquity of Chrome make timely patching a priority.
Use-after-free in Google Chrome's WebAppInstalls component allows a remote, unauthenticated attacker to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page on any build prior to 153.0.8010.47. Exploitation requires user interaction (CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, score 9.6), and the scope-changed rating reflects that a successful attack escapes the renderer sandbox and reaches the host rather than staying contained in the browser process. At time of analysis there is no indication of active exploitation and no public exploit code identified; the vendor has shipped a fixed build (153.0.8010.47) and the primary exposure is unpatched consumer and enterprise Chrome installations.
Remote code execution in Google Chrome's ANGLE graphics layer allows attackers to compromise systems via crafted HTML pages; the same flaw affects other Chromium- and WebKit-based browsers, including Apple Safari/WebKit, webkitgtk, wpewebkit, and Qt WebEngine before 6.9.1-r3 on Alpine Linux. Exploitation requires only user interaction (victim views malicious web content) and no authentication; it has been confirmed actively exploited (CISA KEV), though EPSS probability is currently low (0.25%, 49th percentile).
Out-of-bounds memory access in Google Chrome's video codec handling - fixed in the 147.0.7727.55 desktop release - can be triggered when a victim loads a crafted video file, resulting in a bounded memory over-read that leaks limited process data rather than enabling code execution. The issue is network-reachable without authentication (CVSS PR:N) but strictly requires the user to load attacker-controlled media (UI:R), and CISA's SSVC assessment classifies it as non-automatable with only partial technical impact; no public exploit code identified at time of analysis and it is not listed in CISA KEV. With a CVSS base of 4.3 and Chromium's own rating of 'Low', this is a low-priority, routine-patching issue, notable mainly because Chrome's ubiquity makes even low-severity memory-safety defects worth closing promptly.
Use after free in ANGLE in Google Chrome prior to 111.0.5563.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
Multiple unspecified vulnerabilities in Google V8 before 3.30.33.15, as used in Google Chrome before 40.0.2214.91, allow attackers to cause a denial of service or possibly have other impact via. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Multiple unspecified vulnerabilities in Google Chrome before 40.0.2214.91 allow attackers to cause a denial of service or possibly have other impact via unknown vectors. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Skia, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service (out-of-bounds read) via unspecified vectors. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Fonts implementation in Google Chrome before 40.0.2214.91 does not initialize memory for a data structure, which allows remote attackers to cause a denial of service or possibly have unspecified. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The SelectionOwner::ProcessTarget function in ui/base/x/selection_owner.cc in the UI implementation in Google Chrome before 40.0.2214.91 uses an incorrect data type for a certain length value, which. Rated medium severity (CVSS 5.0), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Google Chrome before 40.0.2214.91, when the Harmony proxy in Google V8 is enabled, allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code with Proxy.create and. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable. No vendor patch available.