Monthly
Account takeover of Google-linked bbs-go users is possible because the /api/login/google_one_tap endpoint accepts any Google-signed ID token without ever validating its audience (aud) claim, so the login handler trusts tokens minted for OAuth clients other than the site's own. An attacker who operates their own Google OAuth client can get a victim to sign in at an attacker-controlled property, capture the resulting Google-signed ID token, and replay it against bbs-go to obtain an authenticated session tied to the victim's Google-linked account (CWE-287). The flaw affects bbs-go through version 4.4.6 on instances where Google One Tap login is enabled and the target account is Google-linked; no public exploit identified at time of analysis, although a public technical writeup of the audience-confusion technique is referenced, and exploitation requires victim interaction to obtain a valid token.
Memory corruption in Google Chrome's Workers component affects versions prior to 155.0.8059.84 and can allow a remote attacker to execute arbitrary code inside the browser's renderer sandbox when a victim visits a crafted HTML page. The CVSS vector indicates network reachability, no authentication, and required user interaction, with high confidentiality, integrity, and availability impact inside the sandbox; however, Scope is Unchanged, so full host compromise requires a separate sandbox escape. Assessment signals conflict and should be weighed carefully: CVSS is 8.8 while Chromium rated it Medium, SSVC says exploitation is none and automatable is no, and no public exploit identified at time of analysis; a vendor patch is available.
Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.
Improper input validation in Google Chrome Desktop versions prior to 155.0.8059.84 could let a remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector scores 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning no authentication is required but the victim must interact with attacker-supplied content, and the Changed Scope rating implies a security-boundary crossing such as an escape from the renderer sandbox - a non-trivial step that CISA's SSVC rates as not automatable. Despite the critical base score, the practical risk signal is mixed at time of analysis: exploitation status is none per SSVC, no public exploit code has been identified, and EPSS is only 0.21% (11th percentile), while Chromium's own severity classification for this issue is Medium and a vendor patch is available.
Memory corruption in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 lets a remote, unauthenticated attacker achieve arbitrary code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (CVSS UI:R) - the target must navigate to attacker-controlled or compromised web content - and no public exploit code has been identified at time of analysis, with CISA SSVC rating current exploitation as 'none'. Because the code execution is explicitly confined to the sandbox (S:U), full host compromise would require chaining a separate sandbox-escape vulnerability, making this a high-priority patch item rather than an emergency.
Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.
Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).
Memory corruption in Google Chrome's DOM implementation allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 155.0.8059.84 are affected; exploitation is unauthenticated (CVSS PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and the resulting code execution is contained by the sandbox (S:U), so host compromise would require a separate sandbox-escape vulnerability. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, though the vendor's Chrome severity rating is High and technical impact is total for the compromised renderer; a vendor patch is available in Chrome 155.0.8059.84 and the corresponding extended stable update.
Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.
Improper authentication in the SAML SSO identity-linking flow of self-hosted Sentry 26.5.0 through 26.7.1 lets an attacker who controls a SAML identity provider trick an already-authenticated user into opening a crafted URL, link the attacker's federated identity to that user's Sentry account, and achieve full account takeover (CVSS 4.0 base 7.6, High; independent assessment CVSS 3.1 7.6 with C:H/I:H). Exploitation is constrained by two prerequisites: the victim's browser must accept the cross-site cookie context (Firefox sending SameSite=None cookies, or Chromium with third-party cookies explicitly enabled, which is not the Chromium default), and the target deployment must have SAML SSO configured, so the realistically reachable population is narrower than the raw score suggests. Sentry SaaS was remediated on July 27, 2026 and is not affected; self-hosted instances are fixed in 26.7.2, and no public exploit code was identified at time of analysis.
Account pre-hijacking in the Prowler API (5.4.0 up to but not including 5.35.0) lets an unauthenticated remote attacker gain persistent control of a user account that has not yet registered, by self-registering the victim's email address before the real owner ever signs up or links single sign-on. Because social account linking in ProwlerSocialAccountAdapter.pre_social_login() matches a Google or GitHub login to any existing local account with the same email address without requiring the address to be verified by the provider or on the local account, the genuine owner's later social sign-in is silently connected to the attacker's pre-created account, and the attacker's original password remains valid, exposing cloud provider credentials, scan findings and tenant memberships held in that account. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though exploitation requires only open self-registration plus a victim who later authenticates through Google or GitHub (a race condition that closes once the legitimate owner has an account). The source assigns CVSS 4.0 7.6 (HIGH); our independent assessment scores it CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
Privilege escalation in Google Cloud Application Integration (versions prior to 2026-08-27) allows an authenticated low-privilege user within a Google Cloud project to abuse AuthConfig validation and the integration execution runtime to impersonate a higher-privileged service account and gain that account's cloud permissions. The flaw is classified as Incorrect Authorization (CWE-863) with a CVSS v4.0 base score of 7.3; there is no public exploit identified at time of analysis and no CISA KEV listing. Google remediated the issue server-side on 27 August 2026, so current Google Cloud instances are no longer affected and no customer patching action is required.
Multiple Rakuten Mobile Android handsets - Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten Bigs - ship with AOSP default test keys still trusted by Android Verified Boot, so a system image signed with those publicly known keys passes boot integrity verification instead of being rejected. An attacker with physical possession of the handset and the ability to enter its flashing/fastboot mode can therefore install a crafted system image and gain full control of confidentiality, integrity, and availability (VC:H/VI:H/VA:H), which is the basis for the CVSS 4.0 base score of 7.0 (HIGH), gated heavily by the AV:P physical-access prerequisite. There is no public exploit code identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); the risk is concentrated in lost, stolen, seized, or resold devices rather than any remote or network-reachable attack path.
Command injection in the NetBird desktop client (versions 0.60.0 through 0.74.6) lets a malicious or compromised peer inject arbitrary OpenSSH directives - including command-executing ones - into the system-wide drop-in config of other clients' Linux, macOS, Windows and FreeBSD hosts. Exploitation requires the attacker to control an enrolled peer whose crafted FQDN or hostname containing a double quote is distributed to the victim, and the injected command runs only when a local user subsequently invokes ssh, so peer membership plus a local user action are both prerequisites rather than an unauthenticated internet-facing attack. NetBird 0.74.7 fixes the issue by rejecting peer names that are not valid DNS names; no public exploit identified at time of analysis, and the Android and iOS apps are not affected.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.
Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.
In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
Heap-based buffer overflow in Google Chrome's Animation component allows a remote attacker to execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page in any build prior to 155.0.8059.79. The bug carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication or special configuration is required, but exploitation depends on the user rendering attacker-controlled content, and because the scope is unchanged the resulting code execution is confined to the sandboxed renderer process rather than the host OS. No public exploit code and no confirmed active exploitation have been identified at time of analysis - CISA's SSVC evaluation rates Exploitation as 'none' - so this is a patch-promptly item rather than an emergency, with Google rating the issue High severity.
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
Use-after-free in Google Chrome's DOM implementation before 155.0.8059.79 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. The flaw affects desktop stable and extended-stable channels and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with exploitation limited by the requirement for user interaction and by the renderer sandbox preventing direct host compromise without a separate sandbox escape. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape in Google Chrome desktop builds prior to 155.0.8059.79 allows an attacker who can already run a program on the target host to abuse an incorrect authorization check in Chrome's Updater component and execute arbitrary code outside the browser sandbox, with high impact to confidentiality, integrity and availability plus a scope change across the sandbox boundary. The independent assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning a pre-existing low-privileged local foothold and user interaction are both required, and CISA's SSVC rates the issue non-automatable, so opportunistic mass exploitation is unlikely. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped a vendor patch in Chrome 155.0.8059.79.
Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.
Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.
Sandbox escape in Google Chrome on macOS lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by delivering a crafted extension that abuses incorrect reference resolution in the Extensions subsystem, affecting all Mac builds prior to 155.0.8059.79. Google rates the issue High (Chromium severity: High) and has shipped a vendor fix, and there is no public exploit identified at time of analysis, with the CISA SSVC assessment recording exploitation as none. The impact is total once the chain fires (Scope:Changed, C:H/I:H/A:H), but high attack complexity (AC:H), required user interaction (UI:R) and the hard prerequisite of a prior renderer compromise make this a targeted second-stage escalation rather than a standalone remote exploit.
A heap-based buffer overflow in PDFium, the PDF rendering engine embedded in Google Chrome, allows a remote attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to open a crafted HTML page. All desktop Chrome builds prior to 155.0.8059.79 (stable and extended-stable channels) are affected, and exploitation requires user interaction (UI:R), which limits mass or automated abuse. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none; however, CISA assigns a total technical impact once the bug is triggered, and Google rates the Chromium security severity as High. The primary constraint on real-world impact is that code execution is confined to the renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape vulnerability.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.
Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.
Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.
Incorrect authorization in Chrome's Mojo IPC layer on Windows prior to 155.0.8059.79 allows a local attacker - a low-privileged user or code already running inside a Chrome child process - to escape the sandbox and execute arbitrary code with the browser's privileges; the flaw is a privilege boundary failure in the browser process, not a remote code-execution bug reachable by a web page alone. Exploitation requires a foothold on the Windows host: either a malicious local program or, in the more typical Chrome scenario, a compromised sandboxed renderer that chains this bug to break out. There is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available; NVD's 9.6 score (AV:N/UI:R) overstates reachability compared with the independently assessed vector (AV:L/PR:L/UI:N), so the practical risk profile is a post-compromise sandbox escape rather than an unauthenticated network attack.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Use-after-free in Google Chrome's Media component before version 155.0.8059.79 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a user to open a crafted HTML page that drives the vulnerable media-parsing code path. Exploitation requires user interaction (the victim must navigate to or be redirected to attacker-controlled content), and the resulting code execution is confined to the sandbox, meaning host compromise would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, EPSS is low (0.21%, 11th percentile), and Google has released a fixed build, so risk is serious but not emergency-level; priority should follow normal rapid-patching timelines.
Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.
Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Denial of service in Google Guava 4.0 through 33.7.1 can be triggered by remote unauthenticated attackers who can supply crafted Java serialization streams containing CompactHashMap, CompactHashSet, or MapMakerInternalMap objects, causing Guava to allocate an attacker-controlled backing array without throttling and exhaust memory with OutOfMemoryError. This is a genuine but conditional availability-only risk: exploitation requires the target application to perform Java native deserialization (ObjectInputStream.readObject) on attacker-influenced input, and any authentication or authorization in front of the deserializing endpoint further limits reach; no code execution or data disclosure results. A vendor fix is available in Guava 33.7.2, and no public exploit identified at time of analysis.
Code execution inside the gVisor sentry process is achievable by a local attacker holding standard container privileges on any platform running a gVisor build prior to release 20260831.0, due to a use-after-free/double-free of the MemoryFile backing an in-sandbox overlay filesystem in the virtual filesystem (VFS) mount layer. The issue is local-only and requires authenticated in-sandbox access (CVSS 4.0 vector AV:L/PR:L), and the resulting code execution lands in the sentry, which remains confined by host-level Linux seccomp and namespace boundaries rather than directly in the host kernel, so a single exploitation does not automatically yield host-kernel compromise or cross-tenant escape. No public exploit code was identified at time of analysis, but the trigger path is documented in the upstream fix's regression tests.
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticated remote attacker to crash an Elixir decoding process by supplying a deeply nested JSON document through Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 when the target schema contains a self-referential or cyclic message type. Because the embedded-message clause of decode_singular/3 recurses once per nesting level without touching the decoder's depth counter, the recursion_limit option offers no protection and each level consumes a stack frame plus heap objects until the process runs out of memory; confidentiality and integrity are unaffected, only availability. Exploitation is unauthenticated and requires no user interaction, but is limited to applications that decode untrusted JSON into recursive message definitions, and no public exploit code has been identified at time of analysis (EPSS data not provided).
Reflected cross-site scripting in the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' through version 2.0.2 allows remote attackers to inject arbitrary script into a victim's browser session, rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The flaw is unauthenticated from the network perspective but requires a victim to follow a crafted link or otherwise trigger the malicious request (UI:R), with the scope change reflecting that the injected script executes in the context of the victim's browser against the affected site. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied with this report; the vulnerability was disclosed by Patchstack.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Information disclosure in the HPE Networking ClearPass Policy Manager Android client application allows an unauthenticated remote attacker to invoke improperly access-controlled application functionality from an untrusted source, potentially exposing sensitive information held on or accessible to the victim's mobile device. Exploitation requires the ClearPass Android client to be installed plus mandatory victim interaction (UI:R) with attacker-supplied content - for example a malicious co-installed app, crafted intent, deep link, or content - so delivery likely relies on an Android inter-component path rather than direct internet-facing exposure, and no public exploit was identified at time of analysis. Note that the vendor-supplied CVSS 3.1 vector (8.8, C:H/I:H/A:H) overstates the issue relative to the described confidentiality-only impact; our independent assessment limits the score to AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Use-after-free in Google Chrome's CSS handling affects builds prior to 155.0.8059.39 and allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), yet Google assigned it Chromium severity Low because the resulting code execution is confined to the browser sandbox and requires user interaction - full host compromise would require chaining a separate sandbox-escape bug. No public exploit identified at time of analysis, and a vendor patch is available.
Code execution outside the Chrome sandbox is possible in Google Chrome desktop builds prior to 155.0.8059.39, where a use-after-free in the network component (CVE-2026-106234, CWE-416) can be triggered by a crafted Chrome extension that a remote, unauthenticated attacker convinces a victim to install. The UI:R prerequisite - social engineering the user into installing the extension - is the primary limiting factor, which is why the vendor assigned a Chromium security severity of Low even though the assessed CVSS is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and technical impact is rated total in the CISA SSVC framework; the high CVSS and the Low vendor severity are sharply conflicting signals. No public exploit identified at time of analysis (SSVC exploitation: none), and a vendor patch is available.
A low-severity information disclosure exists in the Payments component of Google Chrome, where a remote attacker using a crafted HTML page and social-engineering lures could cause the browser to leak sensitive information handled by the payments/autofill feature in builds prior to 155.0.8059.39. Exploitation is not automatic: the victim must be convinced to open the attacker's page while running a vulnerable build, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confines realistic impact to confidentiality loss with no integrity or availability effect. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39. Note that the supplied CVSS base score of 8.8 (C:H/I:H/A:H) is inconsistent with both the Chromium severity rating of Low and the independent assessment, and should not be used for prioritization without reconciliation.
Incomplete cleanup in the Chromoting (Chrome Remote Desktop) component of Google Chrome on macOS before 155.0.8059.39 lets a remote, unauthenticated attacker bypass system access restrictions using crafted network traffic, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector. Impact is materially constrained: only macOS hosts on an affected build with Chromoting enabled and reachable are in scope, and the realistic outcome is limited information exposure rather than full compromise, which is consistent with the vendor's 'Low' Chromium severity rating. Risk signals conflict sharply - the supplied CVSS score of 9.1 (C:H/I:N/A:H) and the authoritative assessed vector of C:L/I:N/A:N disagree - and must be reconciled before prioritization; EPSS is negligible at 0.17% (6th percentile), there is no KEV listing, and no public exploit identified at time of analysis. Vendor-released patch: Chrome 155.0.8059.39.
Authorization bypass in the Chromoting (Chrome Remote Desktop) host component of Google Chrome on macOS prior to 155.0.8059.39 lets remote attackers circumvent macOS system access restrictions by sending crafted network traffic to the remoting service; the provided CVSS vector is AV:N/PR:N/UI:N so the flaw is treated as network-reachable and unauthenticated. Exploitation is conditional rather than opportunistic: it requires Chrome Remote Desktop (Chromoting) to be installed, enabled and network-reachable on a macOS host, and Google's Chromium team rated the underlying defect only 'Low' severity, which is why our independent assessment reduces impact to C:L/I:L/A:N with AC:H instead of the vendor's 9.1. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.21% (10th percentile), so this should not be triaged as a 9.1-equivalent emergency even though the vendor score is high.
Information disclosure in Google Chrome for Android lets a remote attacker who successfully socially engineers a victim into opening a crafted HTML page expose sensitive data handled by the browser's Passwords component; builds prior to 155.0.8059.39 are affected, and no authentication or non-default configuration is required. The vendor classifies the issue as Low severity (CWE-200) and no public exploit code was identified at time of analysis. Note that the supplied CVSS base score of 8.8 (C:H/I:H/A:H) is inconsistent with the information-disclosure description and the vendor's Low rating; our independent assessment scores it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, i.e. a confidentiality leak that strictly depends on user interaction.
Google Chrome for Android prior to 155.0.8059.39 contains an incorrect-authorization flaw in its Transactions Platform component that lets an unauthenticated remote attacker read sensitive information from the browser by luring the victim into opening a crafted HTML page. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, though the attack is fully remote (AV:N/PR:N) and requires only that a user on a vulnerable Android build load the attacker's page (UI:R). Note that public severity signals conflict: the vendor rates this Chromium security severity 'Low' and limits impact to information disclosure, while a widely replicated CVSS 3.1 base score of 8.8 lists high integrity and availability impact that is not supported by the description - our independent assessment scores it 8.8-adjacent only on confidentiality (C:H/I:N/A:N).
The signals here conflict sharply and must be reconciled before prioritization: the supplied CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and the 'Authentication Bypass' tag imply full compromise, while the authoritative assessed vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N describes only a confidentiality impact with mandatory user interaction. As assessed, an unauthenticated remote attacker can obtain sensitive information from Google Chrome desktop builds prior to 155.0.8059.39 when a victim opens a crafted HTML page, with no integrity or availability impact and no authenticated-session or special-configuration prerequisite in the product itself. There is no CISA KEV listing and no public exploit code identified at time of analysis, Chromium rates the underlying issue Low severity, and the vendor-released patch is Chrome 155.0.8059.39.
Information disclosure in the Permissions component of Google Chrome before 155.0.8059.39 allows a remote, unauthenticated attacker to bypass the browser's site-isolation boundary by luring a victim into loading a crafted HTML page. Exploitation requires user interaction (UI:R) - the target must visit attacker-controlled content - and the resulting impact is limited to leaking information across origins rather than code execution, data modification, or denial of service. A vendor fix is already available in 155.0.8059.39, there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating a low near-term exploitation likelihood.
Type confusion in the V8 JavaScript engine of Google Chrome before 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Signals conflict and must be weighed carefully: the numeric severity is high, yet Google's own Chromium security severity for this issue is 'Low' and CISA's SSVC assessment records no exploitation and a non-automatable attack path, with no public exploit identified at time of analysis. A vendor-released patch exists in Chrome 155.0.8059.39, so fully updated installations are not exposed.
Information disclosure in Google Chrome for Android (versions prior to 155.0.8059.39) allows remote, unauthenticated attackers to reach sensitive data held by the browser's Autofill feature via a crafted HTML page, with the flaw rooted in incorrect authorization (CWE-863) in the Autofill path. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), exploitation requires the victim to actively navigate to the attacker's page and the impact is confined to confidentiality, with no integrity or availability effect; the vendor-supplied 8.8 score (C:H/I:H/A:H) and the 'Low' Chromium severity conflict with this assessment and should be reconciled before prioritization. Chrome on Android is the affected build, no public exploit was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Origin policy bypass in Google Chrome for Android prior to 155.0.8059.39 lets a remote attacker acting through a confused deputy have actions carried out under a different web origin's authority, so a victim who is socially engineered into opening a crafted HTML page can have that page reach resources or capabilities it should never hold for its own origin. Only Chrome on Android is affected, exploitation is not silent (it requires the user to open attacker-supplied content, CVSS PR:N/UI:R), and no public exploit code or active exploitation has been identified at time of analysis; EPSS is 0.22% (12th percentile), and Google rates the underlying Chromium bug as Low severity. Note the sharp signal conflict that must be reconciled before prioritization: the nominal vendor CVSS is 8.3 while EPSS, vendor severity, and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) all point to materially lower real-world risk.
Integer overflow in the Media component of Google Chrome (all versions prior to 155.0.8059.39) allows a remote, unauthenticated attacker to corrupt memory via a crafted HTML page containing specially formed media content, with the potential to execute arbitrary code outside the browser sandbox. Exploitation is not automatic: the CVSS vector (UI:R) confirms the victim must actively load the attacker-controlled or compromised page, and Google rated this a Chromium severity of 'Low', indicating the sandbox-escape outcome is not reliably achievable and probably depends on specific memory conditions or combining this primitive with others. No public exploit code and no CISA KEV entry were identified at time of analysis; the 9.6 score reflects the scope-change metric (S:C) and high C/I/A impact rather than proven real-world exploitation, so the practical risk is lower than the headline score suggests.
Information disclosure in the Passwords component of Google Chrome desktop builds prior to 155.0.8059.39 lets a remote, unauthenticated attacker obtain sensitive data when a victim renders a crafted HTML page. The vendor rates the issue Chromium security severity Low, and the independent assessment converges on a limited-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) rather than the 8.8 figure carried in some feeds, so the mandatory user interaction and the low-confidentiality scope are the real risk drivers. There is no public exploit identified at time of analysis, and a vendor patch is already shipping in the stable channel as 155.0.8059.39.
Sandbox escape in Google Chrome before 155.0.8059.39 via a heap-based buffer overflow (CWE-122) in ANGLE, Chrome's graphics translation layer: a remote attacker who has already compromised a sandboxed renderer process can use a crafted HTML page to execute arbitrary code outside the sandbox. It is a second-stage primitive rather than an initial-access bug - the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H (8.3) reflects high attack complexity, a required pre-existing renderer exploit chain, and active user interaction (UI:R), with the scope change S:C capturing the crossing of the sandbox boundary, even though Chromium rates the underlying bug Low severity. No public exploit code was identified at time of analysis and CISA's SSVC data records no observed exploitation, so the headline 8.3 should be weighed against the significant preconditions.
Code execution outside the Chrome sandbox on Windows is possible through CVE-2026-106186, an uncontrolled search path flaw in Chrome's CredentialProvider component affecting Chrome builds prior to 155.0.8059.39. The issue is local-only (CVSS:3.1/AV:L) and requires both a pre-existing local foothold with write access to a directory the component searches and user interaction to load the affected program, yet because the credential provider loads in a more privileged Windows context the scope changes (S:C) and confidentiality, integrity, and availability impacts are all High, yielding a base score of 8.6 with no privileges required (PR:N). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; SSVC rates exploitation as 'none' and automatable as 'no', and Chromium's own internal severity rating is 'Low', which sharply tempers the headline CVSS figure. A vendor patch is available as Chrome 155.0.8059.39.
Site isolation bypass in Google Chrome for Android (versions prior to 155.0.8059.39) lets an attacker who has already compromised the renderer process cross the per-site process boundary and reach data that should remain isolated to other origins, triggered when the victim loads a crafted HTML page. It is a second-stage flaw rather than an initial-access vector: exploitation is gated on a separate, pre-existing renderer compromise plus required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), which is why the vendor assigned a Chromium severity of Low even though the base score is 8.2. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is only 0.21% (11th percentile); a vendor patch is available, so the residual risk is concentrated in unpatched Android clients that are simultaneously exposed to a first-stage renderer exploit.
Arbitrary code execution confined to Chrome's renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39, where an incorrect comparison in the font rendering pipeline can be triggered by a crafted HTML page. This is an unauthenticated remote attack (AV:N/PR:N) that requires the victim to load attacker-controlled web content (UI:R); the resulting code execution stays inside the renderer sandbox (S:U), and escaping to the host operating system requires a separate, unrelated sandbox-escape vulnerability - which is why Chromium assigned a Low security severity despite the CVSS 8.8 base score. No public exploit code was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Incorrect authorization in the Selection component of Google Chrome for iOS lets a remote, unauthenticated attacker obtain sensitive information when a victim opens a crafted HTML page, and the issue is resolved in Chrome 155.0.8059.39. Only the iOS build of Chrome below that version is in scope; desktop and Android builds are not named as affected, and exploitation requires the user to actively visit the attacker-controlled page (UI:R per the assessed vector). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the practical risk is bounded by mandatory user interaction, the narrow iOS-only affected population, and the fact that a vendor fix already ships; note that the supplied base score of 8.8 (C:H/I:H/A:H) is inconsistent with both the Chromium 'Low' severity label and the assessed vector, which rates impact as confidentiality-only.
Missing authorization in the Actor component of Google Chrome prior to 155.0.8059.39 allows code to escape the browser sandbox, but only after the attacker has already compromised the renderer process via a separate bug and then gets the victim to load a crafted HTML page. This prerequisite, combined with required user interaction (UI:R) and high attack complexity (AC:H) from the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector, means the flaw is only usable as a link in an exploit chain rather than as a standalone initial-access vector; the changed scope (S:C) and high confidentiality, integrity and availability impact reflect the potential for full code execution outside the sandbox. No public exploit code identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, so risk should be weighed against the conflicting 8.3 score versus the demanding exploitation preconditions. A vendor patch is available in Chrome 155.0.8059.39.
Arbitrary code execution outside the browser sandbox is possible in Google Chrome on macOS prior to 155.0.8059.39, where incorrect reference resolution in the WebAppInstalls component allows crafted network traffic to cross a process trust boundary. Exploitation is not standalone: the attacker must already have compromised the Chrome renderer process, which makes this a second-stage sandbox-escape primitive in a larger exploit chain rather than a directly reachable remote compromise, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects that non-trivial precondition. A vendor-released patch (Chrome 155.0.8059.39) is available, and no public exploit code was identified at the time of analysis.
Type confusion in V8, Chrome's default JavaScript and WebAssembly engine, enables a remote attacker to run arbitrary code inside the browser's renderer sandbox in Google Chrome releases below 155.0.8059.39. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms the attack is network-reachable and requires no authentication, though it does require the victim to open attacker-controlled web content, so a phishing, malvertising, or watering-hole lure is a prerequisite. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, so real-world priority currently sits below what the 8.8 base score alone implies; note that code execution is confined to the renderer sandbox, meaning full host compromise would require chaining a separate sandbox-escape flaw. Google has shipped a vendor patch.
Incorrect authorization in the Google Chrome user-interface layer allows a crafted HTML page to escape the renderer sandbox and execute arbitrary code outside it on all Chrome builds prior to 155.0.8059.39. Exploitation requires the victim to open an attacker-supplied page (UI:R in the assessed vector) and, while no authentication is required (PR:N) and no unusual configuration is needed, the attack is not fully remote - it depends on that user action, which is the main limiting factor. Severity signals are mixed: the assessed CVSS vector scores 9.6 with scope change (S:C) and high confidentiality, integrity and availability impact, yet Google rates the underlying Chromium issue as Medium, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox is possible in Google Chrome builds prior to 155.0.8059.39, where a race condition (CWE-367) in the V8 JavaScript engine can be won by a crafted HTML page. Exploitation requires only that the victim load the attacker's page in a vulnerable browser (UI:R, PR:N per the CVSS vector), with no credentials or prior privileges needed, but success additionally depends on hitting a time-of-check/time-of-use timing window, which our assessment captures by raising attack complexity to High (CVSS 3.1 base 8.1 under AC:H, versus the 8.8 score supplied with the CVE under AC:L). The critical caveat is scope: the code execution achieved stays within the renderer sandbox and does not by itself compromise the host operating system, so full system impact requires chaining a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none (Automatable: no, Technical Impact: total), and a vendor-released patch exists in Chrome 155.0.8059.39.
Incorrect authorization in Google Chrome's WebProtect component lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page read sensitive information held in the browser context - the assessed impact is confidentiality-only (C:H/I:N/A:N), with no integrity or availability loss. Every Chrome build prior to 155.0.8059.39 is affected across platforms, and Google rates the underlying issue as Chromium security severity Medium. Exploitation is not drive-by: the CVSS vector requires user interaction (UI:R) and PR:N, so no credentials or non-default configuration are needed but the victim must be lured to the attacker-controlled page, and no public exploit code has been identified at time of analysis, making the base score of 8.8 an overstatement of realistic risk.
An out-of-bounds write in the Media component of Google Chrome before 155.0.8059.39 lets a remote attacker corrupt memory and potentially achieve arbitrary code execution outside the browser sandbox when a victim opens an attacker-crafted HTML page containing malicious media content. The attack is fully remote and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is gated by user interaction (UI:R) - the victim must visit the malicious or compromised page - and the 'outside the sandbox' outcome implies defeating Chrome's process sandbox, which is materially harder in practice than the 9.6 base score suggests. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build.
Site isolation bypass in Google Chrome affects versions prior to 155.0.8059.39, where a missing authorization check (CWE-862) in the browser's Workers implementation lets an attacker who has already compromised a renderer process cross the site-isolation boundary using a crafted PDF file. The attack is remote (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1), but exploitation is gated on a pre-existing renderer foothold obtained through a separate vulnerability, so this is a chained sandbox/site-isolation escape rather than a standalone remote compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (5th percentile), and CISA SSVC rates exploitation as 'none' with automation as 'no', while acknowledging total technical impact if the chain is completed. A vendor patch is available in Chrome 155.0.8059.39.
Incorrect authorization in Google Chrome's Autofill feature (versions prior to 155.0.8059.39) allows an unauthenticated remote attacker (PR:N) to obtain sensitive information via a crafted HTML page, but exploitation requires social engineering to trick the victim into visiting and interacting with the page (UI:R). The independent assessment limits the impact to confidentiality (C:L) with no integrity or availability effect, and exploitation further depends on the victim having relevant data stored in Autofill; no public exploit or active exploitation has been identified. A vendor patch is available.
Incomplete cleanup in Dawn, Chrome's WebGPU implementation, allows a crafted HTML page to potentially corrupt GPU-process state and achieve code execution outside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. Exploitation requires the victim to render attacker-controlled content that reaches the affected WebGPU/Dawn code path (CVSS UI:R with PR:N - unauthenticated remote attackers, but user interaction required), and the outcome is probabilistic rather than a guaranteed silent drive-by; the published base score is 9.6 while Google rates the issue Medium, and our assessed vector raises attack complexity to AC:H to reflect the difficulty of chaining a cleanup flaw into a reliable sandbox escape. No public exploit code has been identified at time of analysis, and Google has released Chrome 155.0.8059.39 as the fix.
Heap-based buffer overflow in Google Chrome's font-handling code (CWE-122) lets an attacker who has already compromised the renderer process execute arbitrary code outside the sandbox when a victim renders a crafted HTML page containing malicious font data. All Chrome builds prior to 155.0.8059.39 on default configurations are affected; exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) and a pre-existing renderer compromise, so it functions as a sandbox-escape chain component rather than a standalone drive-by, and is rated high complexity (AC:H) despite a CVSS base of 8.3 (S:C). No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no exploitation, but the vendor has shipped a fix in 155.0.8059.39.
Confused-deputy bypass in Google Chrome's Contextual Tasks feature allows a remote attacker who already holds renderer code execution to cross a security boundary into a privileged page by loading a crafted HTML page, with high confidentiality and integrity impact (unauthenticated per the CVSS vector, but requiring user interaction). The flaw affects Chrome builds prior to 155.0.8059.39 and functions primarily as a chain link - the prerequisite renderer compromise from a separate bug is the real gate, which sharply narrows standalone risk despite the 8.1 score. No public exploit code has been identified at time of analysis and EPSS is very low at 0.18% (7th percentile), with CISA SSVC recording no observed exploitation; a vendor-released patch exists in 155.0.8059.39.
Use-after-free in Chrome's font handling on Windows allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page; the flaw affects Google Chrome versions prior to 155.0.8059.39. Exploitation requires user interaction (UI:R) - the victim must load attacker-controlled content - and there are no authentication prerequisites (PR:N), but the resulting code execution is confined to the Chrome sandbox, so host-level compromise would require a second, independent sandbox-escape bug. Consistent with the medium severity rating assigned by the Chromium team, CISA's SSVC assessment records no known exploitation and no automatable exploitation path, and no public exploit code has been identified at time of analysis.
Site isolation bypass in Google Chrome versions earlier than 155.0.8059.39 lets a remote attacker who has already compromised a renderer process escape Chrome's process boundary and reach data or privileged accessibility functionality belonging to other origins by way of a crafted HTML page the victim loads. The flaw is an incorrect-authorization bug (CWE-863) in the browser's Accessibility component, making it a chained, second-stage primitive rather than a standalone remote compromise, which is why the assessed vector uses AC:H (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) despite an underlying base score of 8.1. Google has released a vendor patch in 155.0.8059.39; no public exploit code and no confirmed active exploitation were identified at time of analysis (EPSS 0.18%, CISA SSVC exploitation: none, automatable: no), so the risk is real but is not currently a frontline emergency.
Arbitrary code execution outside Chrome's sandbox on Android affects Google Chrome builds prior to 155.0.8059.39, where a missing authorization check (CWE-862) can be abused by a malicious co-installed Android app. The attack is local - it requires an attacker-controlled app to already be present on the same device plus successful social engineering to get the victim to install it and trigger the action - so a default, lone Chrome installation is not directly exploitable. Google rates this Chromium security severity Medium, the vendor CVSS is 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while our assessment substitutes UI:R, no publicly available exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is only 0.12% (2nd percentile).
Site isolation bypass in Google Chrome on Android (prior to 155.0.8059.39) allows an attacker who has already compromised the renderer process to reach the browser's Passwords component via a crafted HTML page and a missing authorization check, exposing stored credential data. The bug is a chained, second-stage issue: it cannot be triggered by an unprivileged remote attacker without pre-existing renderer code execution, and it requires user interaction to load the crafted page, which is why the assessed vector (AV:N/AC:H/PR:L/UI:R/C:H/I:N/A:N) makes realistic risk LOW despite the 8.1 base score. No public exploit identified at time of analysis, EPSS is only 0.21% (11th percentile), CISA SSVC records Exploitation: none, and Google rated the Chromium security severity Medium, so this is a routine patch-cycle fix rather than an emergency.
Sensitive-information disclosure in Google Chrome for iOS before 155.0.8059.39 allows a remote, unauthenticated attacker to abuse a missing authorization check by socially engineering a victim into opening a crafted HTML page. The independent assessment limits the impact to confidentiality (C:H/I:N/A:N), so this should be treated as an information disclosure issue rather than code execution or data tampering, and exploitation requires user interaction on the iOS build only. Vendor patch 155.0.8059.39 is available, and no public exploit code or CISA KEV active exploitation was identified in the supplied intelligence.
Sandbox escape and potential arbitrary code execution outside the browser sandbox in Google Chrome via a confused-deputy flaw in the Google Lens feature, affecting all desktop releases prior to 155.0.8059.39. Exploitation is not standalone: a remote attacker must first have compromised the Chrome renderer process (a separate renderer-stage bug), then convince the victim to load a crafted HTML page, after which the Lens component can be induced to perform a privileged operation that crosses the sandbox boundary on the renderer's behalf - consistent with the CVSS:3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H and high attack complexity. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV absent, SSVC exploitation: none), but the maximum technical impact rating means the issue is worth prioritizing within normal patch cycles; vendor-released patch: 155.0.8059.39.
Account takeover of Google-linked bbs-go users is possible because the /api/login/google_one_tap endpoint accepts any Google-signed ID token without ever validating its audience (aud) claim, so the login handler trusts tokens minted for OAuth clients other than the site's own. An attacker who operates their own Google OAuth client can get a victim to sign in at an attacker-controlled property, capture the resulting Google-signed ID token, and replay it against bbs-go to obtain an authenticated session tied to the victim's Google-linked account (CWE-287). The flaw affects bbs-go through version 4.4.6 on instances where Google One Tap login is enabled and the target account is Google-linked; no public exploit identified at time of analysis, although a public technical writeup of the audience-confusion technique is referenced, and exploitation requires victim interaction to obtain a valid token.
Memory corruption in Google Chrome's Workers component affects versions prior to 155.0.8059.84 and can allow a remote attacker to execute arbitrary code inside the browser's renderer sandbox when a victim visits a crafted HTML page. The CVSS vector indicates network reachability, no authentication, and required user interaction, with high confidentiality, integrity, and availability impact inside the sandbox; however, Scope is Unchanged, so full host compromise requires a separate sandbox escape. Assessment signals conflict and should be weighed carefully: CVSS is 8.8 while Chromium rated it Medium, SSVC says exploitation is none and automatable is no, and no public exploit identified at time of analysis; a vendor patch is available.
Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.
Improper input validation in Google Chrome Desktop versions prior to 155.0.8059.84 could let a remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. The CVSS 3.1 vector scores 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H), meaning no authentication is required but the victim must interact with attacker-supplied content, and the Changed Scope rating implies a security-boundary crossing such as an escape from the renderer sandbox - a non-trivial step that CISA's SSVC rates as not automatable. Despite the critical base score, the practical risk signal is mixed at time of analysis: exploitation status is none per SSVC, no public exploit code has been identified, and EPSS is only 0.21% (11th percentile), while Chromium's own severity classification for this issue is Medium and a vendor patch is available.
Memory corruption in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 lets a remote, unauthenticated attacker achieve arbitrary code execution inside the browser's renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction (CVSS UI:R) - the target must navigate to attacker-controlled or compromised web content - and no public exploit code has been identified at time of analysis, with CISA SSVC rating current exploitation as 'none'. Because the code execution is explicitly confined to the sandbox (S:U), full host compromise would require chaining a separate sandbox-escape vulnerability, making this a high-priority patch item rather than an emergency.
Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.
Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).
Memory corruption in Google Chrome's DOM implementation allows remote attackers to execute arbitrary code within the browser's renderer sandbox by convincing a victim to load a crafted HTML page. All Chrome builds prior to 155.0.8059.84 are affected; exploitation is unauthenticated (CVSS PR:N) but requires the user to navigate to attacker-controlled content (UI:R), and the resulting code execution is contained by the sandbox (S:U), so host compromise would require a separate sandbox-escape vulnerability. No public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none, though the vendor's Chrome severity rating is High and technical impact is total for the compromised renderer; a vendor patch is available in Chrome 155.0.8059.84 and the corresponding extended stable update.
Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.
Improper authentication in the SAML SSO identity-linking flow of self-hosted Sentry 26.5.0 through 26.7.1 lets an attacker who controls a SAML identity provider trick an already-authenticated user into opening a crafted URL, link the attacker's federated identity to that user's Sentry account, and achieve full account takeover (CVSS 4.0 base 7.6, High; independent assessment CVSS 3.1 7.6 with C:H/I:H). Exploitation is constrained by two prerequisites: the victim's browser must accept the cross-site cookie context (Firefox sending SameSite=None cookies, or Chromium with third-party cookies explicitly enabled, which is not the Chromium default), and the target deployment must have SAML SSO configured, so the realistically reachable population is narrower than the raw score suggests. Sentry SaaS was remediated on July 27, 2026 and is not affected; self-hosted instances are fixed in 26.7.2, and no public exploit code was identified at time of analysis.
Account pre-hijacking in the Prowler API (5.4.0 up to but not including 5.35.0) lets an unauthenticated remote attacker gain persistent control of a user account that has not yet registered, by self-registering the victim's email address before the real owner ever signs up or links single sign-on. Because social account linking in ProwlerSocialAccountAdapter.pre_social_login() matches a Google or GitHub login to any existing local account with the same email address without requiring the address to be verified by the provider or on the local account, the genuine owner's later social sign-in is silently connected to the attacker's pre-created account, and the attacker's original password remains valid, exposing cloud provider credentials, scan findings and tenant memberships held in that account. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, though exploitation requires only open self-registration plus a victim who later authenticates through Google or GitHub (a race condition that closes once the legitimate owner has an account). The source assigns CVSS 4.0 7.6 (HIGH); our independent assessment scores it CVSS 3.1 AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N.
Privilege escalation in Google Cloud Application Integration (versions prior to 2026-08-27) allows an authenticated low-privilege user within a Google Cloud project to abuse AuthConfig validation and the integration execution runtime to impersonate a higher-privileged service account and gain that account's cloud permissions. The flaw is classified as Incorrect Authorization (CWE-863) with a CVSS v4.0 base score of 7.3; there is no public exploit identified at time of analysis and no CISA KEV listing. Google remediated the issue server-side on 27 August 2026, so current Google Cloud instances are no longer affected and no customer patching action is required.
Multiple Rakuten Mobile Android handsets - Rakuten Mini, Rakuten Hand, Rakuten Hand 5G, and Rakuten Bigs - ship with AOSP default test keys still trusted by Android Verified Boot, so a system image signed with those publicly known keys passes boot integrity verification instead of being rejected. An attacker with physical possession of the handset and the ability to enter its flashing/fastboot mode can therefore install a crafted system image and gain full control of confidentiality, integrity, and availability (VC:H/VI:H/VA:H), which is the basis for the CVSS 4.0 base score of 7.0 (HIGH), gated heavily by the AV:P physical-access prerequisite. There is no public exploit code identified at time of analysis and no confirmed active exploitation (no CISA KEV listing); the risk is concentrated in lost, stolen, seized, or resold devices rather than any remote or network-reachable attack path.
Command injection in the NetBird desktop client (versions 0.60.0 through 0.74.6) lets a malicious or compromised peer inject arbitrary OpenSSH directives - including command-executing ones - into the system-wide drop-in config of other clients' Linux, macOS, Windows and FreeBSD hosts. Exploitation requires the attacker to control an enrolled peer whose crafted FQDN or hostname containing a double quote is distributed to the victim, and the injected command runs only when a local user subsequently invokes ssh, so peer membership plus a local user action are both prerequisites rather than an unauthenticated internet-facing attack. NetBird 0.74.7 fixes the issue by rejecting peer names that are not valid DNS names; no public exploit identified at time of analysis, and the Android and iOS apps are not affected.
Unauthenticated arbitrary file upload in the Printcart Store (PCDesigner / NB Designer) plugin for WooCommerce, versions up to and including 2.9.1, allows a remote attacker to write a .php file into the web-served wp-content/uploads/nbdesigner/temp/ directory and thereby execute arbitrary code on the server, yielding full compromise of confidentiality, integrity, and availability (CVSS 3.1 base 9.8, AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The flaw sits in the nbdesigner_copy_image_from_url AJAX action, which is exposed to logged-out callers via wp_ajax_nopriv_; its Google Drive branch rebuilds the destination filename from the raw, attacker-supplied gapi[name] parameter, bypassing the jpg/jpeg/png/gif allow-list used on the other branch, and the required save-design nonce is freely issued to anonymous callers by the nbd_check_use_logged_in endpoint, so it presents no barrier. Exploitation is not conditional on credentials, but does require the attacker to supply a Google Drive file they control plus a valid OAuth token, and it succeeds only where the uploads directory executes PHP - typical on default Apache/mod_php stacks but blocked under hardened upload configurations; no public exploit code or confirmed active exploitation was identified at time of analysis.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.
Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.
In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
Heap-based buffer overflow in Google Chrome's Animation component allows a remote attacker to execute arbitrary code inside the renderer sandbox by getting a victim to load a crafted HTML page in any build prior to 155.0.8059.79. The bug carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H): no authentication or special configuration is required, but exploitation depends on the user rendering attacker-controlled content, and because the scope is unchanged the resulting code execution is confined to the sandboxed renderer process rather than the host OS. No public exploit code and no confirmed active exploitation have been identified at time of analysis - CISA's SSVC evaluation rates Exploitation as 'none' - so this is a patch-promptly item rather than an emergency, with Google rating the issue High severity.
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
Use-after-free in Google Chrome's DOM implementation before 155.0.8059.79 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. The flaw affects desktop stable and extended-stable channels and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with exploitation limited by the requirement for user interaction and by the renderer sandbox preventing direct host compromise without a separate sandbox escape. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape in Google Chrome desktop builds prior to 155.0.8059.79 allows an attacker who can already run a program on the target host to abuse an incorrect authorization check in Chrome's Updater component and execute arbitrary code outside the browser sandbox, with high impact to confidentiality, integrity and availability plus a scope change across the sandbox boundary. The independent assessment scores this CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H, meaning a pre-existing low-privileged local foothold and user interaction are both required, and CISA's SSVC rates the issue non-automatable, so opportunistic mass exploitation is unlikely. No public exploit code or confirmed active exploitation has been identified at time of analysis, and Google has shipped a vendor patch in Chrome 155.0.8059.79.
Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.
Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.
Sandbox escape in Google Chrome on macOS lets an attacker who has already compromised the renderer process execute arbitrary code outside the browser sandbox by delivering a crafted extension that abuses incorrect reference resolution in the Extensions subsystem, affecting all Mac builds prior to 155.0.8059.79. Google rates the issue High (Chromium severity: High) and has shipped a vendor fix, and there is no public exploit identified at time of analysis, with the CISA SSVC assessment recording exploitation as none. The impact is total once the chain fires (Scope:Changed, C:H/I:H/A:H), but high attack complexity (AC:H), required user interaction (UI:R) and the hard prerequisite of a prior renderer compromise make this a targeted second-stage escalation rather than a standalone remote exploit.
A heap-based buffer overflow in PDFium, the PDF rendering engine embedded in Google Chrome, allows a remote attacker to achieve arbitrary code execution inside the browser's renderer sandbox by convincing a victim to open a crafted HTML page. All desktop Chrome builds prior to 155.0.8059.79 (stable and extended-stable channels) are affected, and exploitation requires user interaction (UI:R), which limits mass or automated abuse. No public exploit code has been identified at time of analysis and CISA's SSVC assessment rates exploitation as none; however, CISA assigns a total technical impact once the bug is triggered, and Google rates the Chromium security severity as High. The primary constraint on real-world impact is that code execution is confined to the renderer sandbox, so full host compromise would additionally require chaining a separate sandbox-escape vulnerability.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.
Heap buffer overflow in ANGLE, Chrome's graphics translation layer, allows a remote attacker to potentially execute arbitrary code outside the browser sandbox on Android. Chrome on Android builds prior to 155.0.8059.79 are affected, and the attack requires no authentication (PR:N) but does require the victim to render attacker-controlled web content (UI:R), with a CVSS base score of 9.6 and a scope change indicating sandbox-escape impact. No public exploit code has been identified at time of analysis, no CISA KEV entry exists, and SSVC rates exploitation as 'none' with automatable 'no', although technical impact is rated total and Google classifies the issue as Critical (Chromium security severity: Critical).
Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.
Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.
Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.
Incorrect authorization in Chrome's Mojo IPC layer on Windows prior to 155.0.8059.79 allows a local attacker - a low-privileged user or code already running inside a Chrome child process - to escape the sandbox and execute arbitrary code with the browser's privileges; the flaw is a privilege boundary failure in the browser process, not a remote code-execution bug reachable by a web page alone. Exploitation requires a foothold on the Windows host: either a malicious local program or, in the more typical Chrome scenario, a compromised sandboxed renderer that chains this bug to break out. There is no public exploit identified at time of analysis and no CISA KEV listing, and a vendor patch is available; NVD's 9.6 score (AV:N/UI:R) overstates reachability compared with the independently assessed vector (AV:L/PR:L/UI:N), so the practical risk profile is a post-compromise sandbox escape rather than an unauthenticated network attack.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Type confusion in the V8 JavaScript engine of Google Chrome allows remote attackers to achieve arbitrary code execution inside the renderer sandbox when a victim loads a crafted HTML page, affecting all builds prior to 155.0.8059.79. Exploitation requires no credentials (PR:N) but does require user interaction - the target must navigate to or be served attacker-controlled web content - and the resulting code execution remains confined to the renderer process, so a separate sandbox escape would be needed for host-level compromise. No public exploit code has been identified at time of analysis, there is no confirmed active exploitation (not in CISA KEV), and EPSS is low at 0.23% (13th percentile); Google has released a patched build and Chrome's automatic update mechanism shortens the practical exposure window.
Use-after-free in Google Chrome's Media component before version 155.0.8059.79 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a user to open a crafted HTML page that drives the vulnerable media-parsing code path. Exploitation requires user interaction (the victim must navigate to or be redirected to attacker-controlled content), and the resulting code execution is confined to the sandbox, meaning host compromise would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, EPSS is low (0.21%, 11th percentile), and Google has released a fixed build, so risk is serious but not emergency-level; priority should follow normal rapid-patching timelines.
Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.
Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Privilege escalation in the custom URL scheme handler of Zoom Workplace for Android before version 7.2.1 allows an attacker who can get the device to process a crafted link or invoke the handler (for example via a co-resident malicious app) to gain capabilities beyond those the invoking context should hold, with high confidentiality and integrity impact per the assessed CVSS of 8.1. Only the Android client is indicated; iOS and desktop builds are not referenced in the affected CPE, and installations at 7.2.1 or later are not affected. There is no CISA KEV listing and no public exploit code identified at time of analysis, and the authentication prerequisite is genuinely ambiguous: the description suggests an unauthenticated network attacker while the published CVSS vector (PR:L) and the independent assessment differ on whether any session is required, so treat the exploitability preconditions as unresolved pending confirmation from Zoom. Note that the vendor vector (PR:L/UI:N) and the assessed vector (PR:N/UI:R) diverge, meaning it is not settled whether success needs a low-privileged session or user interaction with a crafted link.
Denial of service in Google Guava 4.0 through 33.7.1 can be triggered by remote unauthenticated attackers who can supply crafted Java serialization streams containing CompactHashMap, CompactHashSet, or MapMakerInternalMap objects, causing Guava to allocate an attacker-controlled backing array without throttling and exhaust memory with OutOfMemoryError. This is a genuine but conditional availability-only risk: exploitation requires the target application to perform Java native deserialization (ObjectInputStream.readObject) on attacker-influenced input, and any authentication or authorization in front of the deserializing endpoint further limits reach; no code execution or data disclosure results. A vendor fix is available in Guava 33.7.2, and no public exploit identified at time of analysis.
Code execution inside the gVisor sentry process is achievable by a local attacker holding standard container privileges on any platform running a gVisor build prior to release 20260831.0, due to a use-after-free/double-free of the MemoryFile backing an in-sandbox overlay filesystem in the virtual filesystem (VFS) mount layer. The issue is local-only and requires authenticated in-sandbox access (CVSS 4.0 vector AV:L/PR:L), and the resulting code execution lands in the sentry, which remains confined by host-level Linux seccomp and namespace boundaries rather than directly in the host kernel, so a single exploitation does not automatically yield host-kernel compromise or cross-tenant escape. No public exploit code was identified at time of analysis, but the trigger path is documented in the upstream fix's regression tests.
Memory-exhaustion denial of service in the elixir-protobuf library (protobuf) from 0.8.0 onward allows an unauthenticated remote attacker to crash an Elixir decoding process by supplying a deeply nested JSON document through Protobuf.JSON.decode/3, decode!/3, or from_decoded/3 when the target schema contains a self-referential or cyclic message type. Because the embedded-message clause of decode_singular/3 recurses once per nesting level without touching the decoder's depth counter, the recursion_limit option offers no protection and each level consumes a stack frame plus heap objects until the process runs out of memory; confidentiality and integrity are unaffected, only availability. Exploitation is unauthenticated and requires no user interaction, but is limited to applications that decode untrusted JSON into recursive message definitions, and no public exploit code has been identified at time of analysis (EPSS data not provided).
Reflected cross-site scripting in the WordPress plugin 'Disable and Remove Google Fonts | GDPR & DSGVO friendly' through version 2.0.2 allows remote attackers to inject arbitrary script into a victim's browser session, rated CVSS 7.1 (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L). The flaw is unauthenticated from the network perspective but requires a victim to follow a crafted link or otherwise trigger the malicious request (UI:R), with the scope change reflecting that the injected script executes in the context of the victim's browser against the affected site. No public exploit code or confirmed active exploitation was identified at time of analysis, and no EPSS or CISA KEV data was supplied with this report; the vulnerability was disclosed by Patchstack.
Stored cross-site scripting in the OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress affects every version up to and including 6.3.10, allowing unauthenticated attackers to inject arbitrary script through the 's' search parameter as it is handled by the plugin's comments-atom feed flow; the payload is written into a retained .tmp file and executes when a victim later loads the affected page or file. Exploitation is conditional rather than automatic: it only succeeds where the front-end web server serves that .tmp artifact without a Content-Type header and without X-Content-Type-Options: nosniff, so that a MIME-sniffing Chromium-based browser treats it as HTML and runs the script, a configuration the advisory notes is common by default on many Apache and nginx/php-fpm deployments. No public exploit code has been identified and the issue is not listed in CISA KEV; because the assessed vector requires high attack complexity and a non-sniffing or correctly-headered server blocks the attack entirely, this is a genuine but conditional, moderate-risk issue rather than a top-tier emergency. A vendor-released fix is available in 6.3.11.
Information disclosure in the HPE Networking ClearPass Policy Manager Android client application allows an unauthenticated remote attacker to invoke improperly access-controlled application functionality from an untrusted source, potentially exposing sensitive information held on or accessible to the victim's mobile device. Exploitation requires the ClearPass Android client to be installed plus mandatory victim interaction (UI:R) with attacker-supplied content - for example a malicious co-installed app, crafted intent, deep link, or content - so delivery likely relies on an Android inter-component path rather than direct internet-facing exposure, and no public exploit was identified at time of analysis. Note that the vendor-supplied CVSS 3.1 vector (8.8, C:H/I:H/A:H) overstates the issue relative to the described confidentiality-only impact; our independent assessment limits the score to AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
Use-after-free in Google Chrome's CSS handling affects builds prior to 155.0.8059.39 and allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), yet Google assigned it Chromium severity Low because the resulting code execution is confined to the browser sandbox and requires user interaction - full host compromise would require chaining a separate sandbox-escape bug. No public exploit identified at time of analysis, and a vendor patch is available.
Code execution outside the Chrome sandbox is possible in Google Chrome desktop builds prior to 155.0.8059.39, where a use-after-free in the network component (CVE-2026-106234, CWE-416) can be triggered by a crafted Chrome extension that a remote, unauthenticated attacker convinces a victim to install. The UI:R prerequisite - social engineering the user into installing the extension - is the primary limiting factor, which is why the vendor assigned a Chromium security severity of Low even though the assessed CVSS is 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H) and technical impact is rated total in the CISA SSVC framework; the high CVSS and the Low vendor severity are sharply conflicting signals. No public exploit identified at time of analysis (SSVC exploitation: none), and a vendor patch is available.
A low-severity information disclosure exists in the Payments component of Google Chrome, where a remote attacker using a crafted HTML page and social-engineering lures could cause the browser to leak sensitive information handled by the payments/autofill feature in builds prior to 155.0.8059.39. Exploitation is not automatic: the victim must be convinced to open the attacker's page while running a vulnerable build, and the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confines realistic impact to confidentiality loss with no integrity or availability effect. There is no confirmed active exploitation (not in CISA KEV) and no public exploit identified at time of analysis; a vendor patch is available in Chrome 155.0.8059.39. Note that the supplied CVSS base score of 8.8 (C:H/I:H/A:H) is inconsistent with both the Chromium severity rating of Low and the independent assessment, and should not be used for prioritization without reconciliation.
Incomplete cleanup in the Chromoting (Chrome Remote Desktop) component of Google Chrome on macOS before 155.0.8059.39 lets a remote, unauthenticated attacker bypass system access restrictions using crafted network traffic, per the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N vector. Impact is materially constrained: only macOS hosts on an affected build with Chromoting enabled and reachable are in scope, and the realistic outcome is limited information exposure rather than full compromise, which is consistent with the vendor's 'Low' Chromium severity rating. Risk signals conflict sharply - the supplied CVSS score of 9.1 (C:H/I:N/A:H) and the authoritative assessed vector of C:L/I:N/A:N disagree - and must be reconciled before prioritization; EPSS is negligible at 0.17% (6th percentile), there is no KEV listing, and no public exploit identified at time of analysis. Vendor-released patch: Chrome 155.0.8059.39.
Authorization bypass in the Chromoting (Chrome Remote Desktop) host component of Google Chrome on macOS prior to 155.0.8059.39 lets remote attackers circumvent macOS system access restrictions by sending crafted network traffic to the remoting service; the provided CVSS vector is AV:N/PR:N/UI:N so the flaw is treated as network-reachable and unauthenticated. Exploitation is conditional rather than opportunistic: it requires Chrome Remote Desktop (Chromoting) to be installed, enabled and network-reachable on a macOS host, and Google's Chromium team rated the underlying defect only 'Low' severity, which is why our independent assessment reduces impact to C:L/I:L/A:N with AC:H instead of the vendor's 9.1. No public exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is low at 0.21% (10th percentile), so this should not be triaged as a 9.1-equivalent emergency even though the vendor score is high.
Information disclosure in Google Chrome for Android lets a remote attacker who successfully socially engineers a victim into opening a crafted HTML page expose sensitive data handled by the browser's Passwords component; builds prior to 155.0.8059.39 are affected, and no authentication or non-default configuration is required. The vendor classifies the issue as Low severity (CWE-200) and no public exploit code was identified at time of analysis. Note that the supplied CVSS base score of 8.8 (C:H/I:H/A:H) is inconsistent with the information-disclosure description and the vendor's Low rating; our independent assessment scores it AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, i.e. a confidentiality leak that strictly depends on user interaction.
Google Chrome for Android prior to 155.0.8059.39 contains an incorrect-authorization flaw in its Transactions Platform component that lets an unauthenticated remote attacker read sensitive information from the browser by luring the victim into opening a crafted HTML page. No public exploit code has been identified at time of analysis and the issue is not reported as actively exploited, though the attack is fully remote (AV:N/PR:N) and requires only that a user on a vulnerable Android build load the attacker's page (UI:R). Note that public severity signals conflict: the vendor rates this Chromium security severity 'Low' and limits impact to information disclosure, while a widely replicated CVSS 3.1 base score of 8.8 lists high integrity and availability impact that is not supported by the description - our independent assessment scores it 8.8-adjacent only on confidentiality (C:H/I:N/A:N).
The signals here conflict sharply and must be reconciled before prioritization: the supplied CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and the 'Authentication Bypass' tag imply full compromise, while the authoritative assessed vector AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N describes only a confidentiality impact with mandatory user interaction. As assessed, an unauthenticated remote attacker can obtain sensitive information from Google Chrome desktop builds prior to 155.0.8059.39 when a victim opens a crafted HTML page, with no integrity or availability impact and no authenticated-session or special-configuration prerequisite in the product itself. There is no CISA KEV listing and no public exploit code identified at time of analysis, Chromium rates the underlying issue Low severity, and the vendor-released patch is Chrome 155.0.8059.39.
Information disclosure in the Permissions component of Google Chrome before 155.0.8059.39 allows a remote, unauthenticated attacker to bypass the browser's site-isolation boundary by luring a victim into loading a crafted HTML page. Exploitation requires user interaction (UI:R) - the target must visit attacker-controlled content - and the resulting impact is limited to leaking information across origins rather than code execution, data modification, or denial of service. A vendor fix is already available in 155.0.8059.39, there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified at time of analysis, and EPSS is 0.18% (7th percentile), indicating a low near-term exploitation likelihood.
Type confusion in the V8 JavaScript engine of Google Chrome before 155.0.8059.39 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim renders a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8). Signals conflict and must be weighed carefully: the numeric severity is high, yet Google's own Chromium security severity for this issue is 'Low' and CISA's SSVC assessment records no exploitation and a non-automatable attack path, with no public exploit identified at time of analysis. A vendor-released patch exists in Chrome 155.0.8059.39, so fully updated installations are not exposed.
Information disclosure in Google Chrome for Android (versions prior to 155.0.8059.39) allows remote, unauthenticated attackers to reach sensitive data held by the browser's Autofill feature via a crafted HTML page, with the flaw rooted in incorrect authorization (CWE-863) in the Autofill path. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N), exploitation requires the victim to actively navigate to the attacker's page and the impact is confined to confidentiality, with no integrity or availability effect; the vendor-supplied 8.8 score (C:H/I:H/A:H) and the 'Low' Chromium severity conflict with this assessment and should be reconciled before prioritization. Chrome on Android is the affected build, no public exploit was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Origin policy bypass in Google Chrome for Android prior to 155.0.8059.39 lets a remote attacker acting through a confused deputy have actions carried out under a different web origin's authority, so a victim who is socially engineered into opening a crafted HTML page can have that page reach resources or capabilities it should never hold for its own origin. Only Chrome on Android is affected, exploitation is not silent (it requires the user to open attacker-supplied content, CVSS PR:N/UI:R), and no public exploit code or active exploitation has been identified at time of analysis; EPSS is 0.22% (12th percentile), and Google rates the underlying Chromium bug as Low severity. Note the sharp signal conflict that must be reconciled before prioritization: the nominal vendor CVSS is 8.3 while EPSS, vendor severity, and our independent assessment (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N) all point to materially lower real-world risk.
Integer overflow in the Media component of Google Chrome (all versions prior to 155.0.8059.39) allows a remote, unauthenticated attacker to corrupt memory via a crafted HTML page containing specially formed media content, with the potential to execute arbitrary code outside the browser sandbox. Exploitation is not automatic: the CVSS vector (UI:R) confirms the victim must actively load the attacker-controlled or compromised page, and Google rated this a Chromium severity of 'Low', indicating the sandbox-escape outcome is not reliably achievable and probably depends on specific memory conditions or combining this primitive with others. No public exploit code and no CISA KEV entry were identified at time of analysis; the 9.6 score reflects the scope-change metric (S:C) and high C/I/A impact rather than proven real-world exploitation, so the practical risk is lower than the headline score suggests.
Information disclosure in the Passwords component of Google Chrome desktop builds prior to 155.0.8059.39 lets a remote, unauthenticated attacker obtain sensitive data when a victim renders a crafted HTML page. The vendor rates the issue Chromium security severity Low, and the independent assessment converges on a limited-confidentiality impact (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) rather than the 8.8 figure carried in some feeds, so the mandatory user interaction and the low-confidentiality scope are the real risk drivers. There is no public exploit identified at time of analysis, and a vendor patch is already shipping in the stable channel as 155.0.8059.39.
Sandbox escape in Google Chrome before 155.0.8059.39 via a heap-based buffer overflow (CWE-122) in ANGLE, Chrome's graphics translation layer: a remote attacker who has already compromised a sandboxed renderer process can use a crafted HTML page to execute arbitrary code outside the sandbox. It is a second-stage primitive rather than an initial-access bug - the assessed vector CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H (8.3) reflects high attack complexity, a required pre-existing renderer exploit chain, and active user interaction (UI:R), with the scope change S:C capturing the crossing of the sandbox boundary, even though Chromium rates the underlying bug Low severity. No public exploit code was identified at time of analysis and CISA's SSVC data records no observed exploitation, so the headline 8.3 should be weighed against the significant preconditions.
Code execution outside the Chrome sandbox on Windows is possible through CVE-2026-106186, an uncontrolled search path flaw in Chrome's CredentialProvider component affecting Chrome builds prior to 155.0.8059.39. The issue is local-only (CVSS:3.1/AV:L) and requires both a pre-existing local foothold with write access to a directory the component searches and user interaction to load the affected program, yet because the credential provider loads in a more privileged Windows context the scope changes (S:C) and confidentiality, integrity, and availability impacts are all High, yielding a base score of 8.6 with no privileges required (PR:N). No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV; SSVC rates exploitation as 'none' and automatable as 'no', and Chromium's own internal severity rating is 'Low', which sharply tempers the headline CVSS figure. A vendor patch is available as Chrome 155.0.8059.39.
Site isolation bypass in Google Chrome for Android (versions prior to 155.0.8059.39) lets an attacker who has already compromised the renderer process cross the per-site process boundary and reach data that should remain isolated to other origins, triggered when the victim loads a crafted HTML page. It is a second-stage flaw rather than an initial-access vector: exploitation is gated on a separate, pre-existing renderer compromise plus required user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N), which is why the vendor assigned a Chromium severity of Low even though the base score is 8.2. No public exploit identified at time of analysis, no CISA KEV listing, and EPSS is only 0.21% (11th percentile); a vendor patch is available, so the residual risk is concentrated in unpatched Android clients that are simultaneously exposed to a first-stage renderer exploit.
Arbitrary code execution confined to Chrome's renderer sandbox is possible in Google Chrome versions prior to 155.0.8059.39, where an incorrect comparison in the font rendering pipeline can be triggered by a crafted HTML page. This is an unauthenticated remote attack (AV:N/PR:N) that requires the victim to load attacker-controlled web content (UI:R); the resulting code execution stays inside the renderer sandbox (S:U), and escaping to the host operating system requires a separate, unrelated sandbox-escape vulnerability - which is why Chromium assigned a Low security severity despite the CVSS 8.8 base score. No public exploit code was identified at time of analysis, and a vendor-released patch (155.0.8059.39) is available.
Incorrect authorization in the Selection component of Google Chrome for iOS lets a remote, unauthenticated attacker obtain sensitive information when a victim opens a crafted HTML page, and the issue is resolved in Chrome 155.0.8059.39. Only the iOS build of Chrome below that version is in scope; desktop and Android builds are not named as affected, and exploitation requires the user to actively visit the attacker-controlled page (UI:R per the assessed vector). No public exploit code has been identified at time of analysis and the issue is not in CISA KEV, so the practical risk is bounded by mandatory user interaction, the narrow iOS-only affected population, and the fact that a vendor fix already ships; note that the supplied base score of 8.8 (C:H/I:H/A:H) is inconsistent with both the Chromium 'Low' severity label and the assessed vector, which rates impact as confidentiality-only.
Missing authorization in the Actor component of Google Chrome prior to 155.0.8059.39 allows code to escape the browser sandbox, but only after the attacker has already compromised the renderer process via a separate bug and then gets the victim to load a crafted HTML page. This prerequisite, combined with required user interaction (UI:R) and high attack complexity (AC:H) from the assessed CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H vector, means the flaw is only usable as a link in an exploit chain rather than as a standalone initial-access vector; the changed scope (S:C) and high confidentiality, integrity and availability impact reflect the potential for full code execution outside the sandbox. No public exploit code identified at time of analysis and there is no confirmed actively exploited (CISA KEV) status, so risk should be weighed against the conflicting 8.3 score versus the demanding exploitation preconditions. A vendor patch is available in Chrome 155.0.8059.39.
Arbitrary code execution outside the browser sandbox is possible in Google Chrome on macOS prior to 155.0.8059.39, where incorrect reference resolution in the WebAppInstalls component allows crafted network traffic to cross a process trust boundary. Exploitation is not standalone: the attacker must already have compromised the Chrome renderer process, which makes this a second-stage sandbox-escape primitive in a larger exploit chain rather than a directly reachable remote compromise, and the assessed vector (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects that non-trivial precondition. A vendor-released patch (Chrome 155.0.8059.39) is available, and no public exploit code was identified at the time of analysis.
Type confusion in V8, Chrome's default JavaScript and WebAssembly engine, enables a remote attacker to run arbitrary code inside the browser's renderer sandbox in Google Chrome releases below 155.0.8059.39. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) confirms the attack is network-reachable and requires no authentication, though it does require the victim to open attacker-controlled web content, so a phishing, malvertising, or watering-hole lure is a prerequisite. No public exploit code has been identified at time of analysis and CISA's SSVC assessment records exploitation as 'none' and the issue as not automatable, so real-world priority currently sits below what the 8.8 base score alone implies; note that code execution is confined to the renderer sandbox, meaning full host compromise would require chaining a separate sandbox-escape flaw. Google has shipped a vendor patch.
Incorrect authorization in the Google Chrome user-interface layer allows a crafted HTML page to escape the renderer sandbox and execute arbitrary code outside it on all Chrome builds prior to 155.0.8059.39. Exploitation requires the victim to open an attacker-supplied page (UI:R in the assessed vector) and, while no authentication is required (PR:N) and no unusual configuration is needed, the attack is not fully remote - it depends on that user action, which is the main limiting factor. Severity signals are mixed: the assessed CVSS vector scores 9.6 with scope change (S:C) and high confidentiality, integrity and availability impact, yet Google rates the underlying Chromium issue as Medium, and no public exploit code or confirmed active exploitation (CISA KEV) has been identified at time of analysis.
Arbitrary code execution inside the Chrome renderer sandbox is possible in Google Chrome builds prior to 155.0.8059.39, where a race condition (CWE-367) in the V8 JavaScript engine can be won by a crafted HTML page. Exploitation requires only that the victim load the attacker's page in a vulnerable browser (UI:R, PR:N per the CVSS vector), with no credentials or prior privileges needed, but success additionally depends on hitting a time-of-check/time-of-use timing window, which our assessment captures by raising attack complexity to High (CVSS 3.1 base 8.1 under AC:H, versus the 8.8 score supplied with the CVE under AC:L). The critical caveat is scope: the code execution achieved stays within the renderer sandbox and does not by itself compromise the host operating system, so full system impact requires chaining a separate sandbox-escape vulnerability. No public exploit code has been identified at time of analysis, CISA SSVC records Exploitation: none (Automatable: no, Technical Impact: total), and a vendor-released patch exists in Chrome 155.0.8059.39.
Incorrect authorization in Google Chrome's WebProtect component lets a remote, unauthenticated attacker who socially engineers a victim into opening a crafted HTML page read sensitive information held in the browser context - the assessed impact is confidentiality-only (C:H/I:N/A:N), with no integrity or availability loss. Every Chrome build prior to 155.0.8059.39 is affected across platforms, and Google rates the underlying issue as Chromium security severity Medium. Exploitation is not drive-by: the CVSS vector requires user interaction (UI:R) and PR:N, so no credentials or non-default configuration are needed but the victim must be lured to the attacker-controlled page, and no public exploit code has been identified at time of analysis, making the base score of 8.8 an overstatement of realistic risk.
An out-of-bounds write in the Media component of Google Chrome before 155.0.8059.39 lets a remote attacker corrupt memory and potentially achieve arbitrary code execution outside the browser sandbox when a victim opens an attacker-crafted HTML page containing malicious media content. The attack is fully remote and requires no authentication (CVSS:3.1/AV:N/AC:L/PR:N), but it is gated by user interaction (UI:R) - the victim must visit the malicious or compromised page - and the 'outside the sandbox' outcome implies defeating Chrome's process sandbox, which is materially harder in practice than the 9.6 base score suggests. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fixed build.
Site isolation bypass in Google Chrome affects versions prior to 155.0.8059.39, where a missing authorization check (CWE-862) in the browser's Workers implementation lets an attacker who has already compromised a renderer process cross the site-isolation boundary using a crafted PDF file. The attack is remote (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N, score 8.1), but exploitation is gated on a pre-existing renderer foothold obtained through a separate vulnerability, so this is a chained sandbox/site-isolation escape rather than a standalone remote compromise. There is no public exploit identified at time of analysis and no CISA KEV listing; EPSS is low at 0.17% (5th percentile), and CISA SSVC rates exploitation as 'none' with automation as 'no', while acknowledging total technical impact if the chain is completed. A vendor patch is available in Chrome 155.0.8059.39.
Incorrect authorization in Google Chrome's Autofill feature (versions prior to 155.0.8059.39) allows an unauthenticated remote attacker (PR:N) to obtain sensitive information via a crafted HTML page, but exploitation requires social engineering to trick the victim into visiting and interacting with the page (UI:R). The independent assessment limits the impact to confidentiality (C:L) with no integrity or availability effect, and exploitation further depends on the victim having relevant data stored in Autofill; no public exploit or active exploitation has been identified. A vendor patch is available.
Incomplete cleanup in Dawn, Chrome's WebGPU implementation, allows a crafted HTML page to potentially corrupt GPU-process state and achieve code execution outside the browser sandbox in Google Chrome builds prior to 155.0.8059.39. Exploitation requires the victim to render attacker-controlled content that reaches the affected WebGPU/Dawn code path (CVSS UI:R with PR:N - unauthenticated remote attackers, but user interaction required), and the outcome is probabilistic rather than a guaranteed silent drive-by; the published base score is 9.6 while Google rates the issue Medium, and our assessed vector raises attack complexity to AC:H to reflect the difficulty of chaining a cleanup flaw into a reliable sandbox escape. No public exploit code has been identified at time of analysis, and Google has released Chrome 155.0.8059.39 as the fix.
Heap-based buffer overflow in Google Chrome's font-handling code (CWE-122) lets an attacker who has already compromised the renderer process execute arbitrary code outside the sandbox when a victim renders a crafted HTML page containing malicious font data. All Chrome builds prior to 155.0.8059.39 on default configurations are affected; exploitation is unauthenticated (PR:N) but requires user interaction (UI:R) and a pre-existing renderer compromise, so it functions as a sandbox-escape chain component rather than a standalone drive-by, and is rated high complexity (AC:H) despite a CVSS base of 8.3 (S:C). No public exploit code has been identified at time of analysis and CISA's SSVC assessment records no exploitation, but the vendor has shipped a fix in 155.0.8059.39.
Confused-deputy bypass in Google Chrome's Contextual Tasks feature allows a remote attacker who already holds renderer code execution to cross a security boundary into a privileged page by loading a crafted HTML page, with high confidentiality and integrity impact (unauthenticated per the CVSS vector, but requiring user interaction). The flaw affects Chrome builds prior to 155.0.8059.39 and functions primarily as a chain link - the prerequisite renderer compromise from a separate bug is the real gate, which sharply narrows standalone risk despite the 8.1 score. No public exploit code has been identified at time of analysis and EPSS is very low at 0.18% (7th percentile), with CISA SSVC recording no observed exploitation; a vendor-released patch exists in 155.0.8059.39.
Use-after-free in Chrome's font handling on Windows allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page; the flaw affects Google Chrome versions prior to 155.0.8059.39. Exploitation requires user interaction (UI:R) - the victim must load attacker-controlled content - and there are no authentication prerequisites (PR:N), but the resulting code execution is confined to the Chrome sandbox, so host-level compromise would require a second, independent sandbox-escape bug. Consistent with the medium severity rating assigned by the Chromium team, CISA's SSVC assessment records no known exploitation and no automatable exploitation path, and no public exploit code has been identified at time of analysis.
Site isolation bypass in Google Chrome versions earlier than 155.0.8059.39 lets a remote attacker who has already compromised a renderer process escape Chrome's process boundary and reach data or privileged accessibility functionality belonging to other origins by way of a crafted HTML page the victim loads. The flaw is an incorrect-authorization bug (CWE-863) in the browser's Accessibility component, making it a chained, second-stage primitive rather than a standalone remote compromise, which is why the assessed vector uses AC:H (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N) despite an underlying base score of 8.1. Google has released a vendor patch in 155.0.8059.39; no public exploit code and no confirmed active exploitation were identified at time of analysis (EPSS 0.18%, CISA SSVC exploitation: none, automatable: no), so the risk is real but is not currently a frontline emergency.
Arbitrary code execution outside Chrome's sandbox on Android affects Google Chrome builds prior to 155.0.8059.39, where a missing authorization check (CWE-862) can be abused by a malicious co-installed Android app. The attack is local - it requires an attacker-controlled app to already be present on the same device plus successful social engineering to get the victim to install it and trigger the action - so a default, lone Chrome installation is not directly exploitable. Google rates this Chromium security severity Medium, the vendor CVSS is 8.4 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) while our assessment substitutes UI:R, no publicly available exploit code or confirmed active exploitation has been identified at time of analysis, and EPSS is only 0.12% (2nd percentile).
Site isolation bypass in Google Chrome on Android (prior to 155.0.8059.39) allows an attacker who has already compromised the renderer process to reach the browser's Passwords component via a crafted HTML page and a missing authorization check, exposing stored credential data. The bug is a chained, second-stage issue: it cannot be triggered by an unprivileged remote attacker without pre-existing renderer code execution, and it requires user interaction to load the crafted page, which is why the assessed vector (AV:N/AC:H/PR:L/UI:R/C:H/I:N/A:N) makes realistic risk LOW despite the 8.1 base score. No public exploit identified at time of analysis, EPSS is only 0.21% (11th percentile), CISA SSVC records Exploitation: none, and Google rated the Chromium security severity Medium, so this is a routine patch-cycle fix rather than an emergency.
Sensitive-information disclosure in Google Chrome for iOS before 155.0.8059.39 allows a remote, unauthenticated attacker to abuse a missing authorization check by socially engineering a victim into opening a crafted HTML page. The independent assessment limits the impact to confidentiality (C:H/I:N/A:N), so this should be treated as an information disclosure issue rather than code execution or data tampering, and exploitation requires user interaction on the iOS build only. Vendor patch 155.0.8059.39 is available, and no public exploit code or CISA KEV active exploitation was identified in the supplied intelligence.
Sandbox escape and potential arbitrary code execution outside the browser sandbox in Google Chrome via a confused-deputy flaw in the Google Lens feature, affecting all desktop releases prior to 155.0.8059.39. Exploitation is not standalone: a remote attacker must first have compromised the Chrome renderer process (a separate renderer-stage bug), then convince the victim to load a crafted HTML page, after which the Lens component can be induced to perform a privileged operation that crosses the sandbox boundary on the renderer's behalf - consistent with the CVSS:3.1 vector AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H and high attack complexity. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV absent, SSVC exploitation: none), but the maximum technical impact rating means the issue is worth prioritizing within normal patch cycles; vendor-released patch: 155.0.8059.39.