Monthly
OS-level privilege escalation in Google Chrome for Windows before 150.0.7871.47 lets a local attacker leverage an inappropriate implementation in the CredentialProvider component to elevate privileges via a malicious file. Exploitation requires local access plus user interaction (UI:R), and though Google rated the Chromium security severity 'Low', the CVSS 3.1 base score is 7.8 (High) due to full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is very low at 0.11% (2nd percentile).
Arbitrary read/write in Google Chrome on Windows (versions prior to 150.0.7871.47) allows a remote attacker to corrupt or exfiltrate in-process memory when a victim visits a crafted HTML page, stemming from insufficient input validation in the WebAppInstalls component. The CVSS 8.1 rating reflects high confidentiality and integrity impact requiring only user interaction (visiting a page), though Chromium rated the underlying security severity as Low. There is no public exploit identified at time of analysis, EPSS is a low 0.18% (8th percentile), and CISA SSVC marks exploitation as none, indicating high theoretical impact but currently low real-world exploitation pressure.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux, fixed in 150.0.7871.47, lets a remote attacker corrupt memory via crafted network traffic and potentially run arbitrary code. The flaw is a CWE-416 use-after-free reported by Google's internal Chrome security team; there is no public exploit identified at time of analysis and it is not in CISA KEV. Note a signal conflict: NVD scores this 9.8 (Critical) while Chromium itself rated the security severity 'Low', and EPSS is only 0.20% (10th percentile).
Sandbox escape in Google Chrome's DevTools component (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox and reach the host via a crafted HTML page. Google's Chromium security team rated this Low severity because it is a second-stage bug requiring prior renderer compromise, which conflicts sharply with the NVD CVSS 9.6 (Critical); no public exploit is identified at time of analysis, KEV/SSVC show no known exploitation, and EPSS is low at 0.18%. A vendor patch is available.
Privilege escalation in Google Chrome's Cast component before 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to escape renderer-level restrictions and gain higher privileges via a crafted HTML page. Rated Low severity by Chromium despite a 7.5 CVSS, it functions as a second-stage sandbox-escape primitive rather than a standalone initial-access bug. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), indicating minimal near-term mass-exploitation risk.
UI spoofing in Google Chrome for Android before 150.0.7871.47 lets a local attacker misrepresent browser interface elements through the WebAppInstalls component using a malicious file. The flaw (CWE-451) requires a crafted file to be opened on the device and could deceive users into trusting spoofed content or install prompts. Google rates the Chromium security severity as Low, no public exploit has been identified, and EPSS is negligible at 0.11%.
Sandbox escape in Google Chrome for Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process abuse a use-after-free in the Updater component via a crafted HTML page to break out of the browser sandbox. It is a second-stage bug that Chromium rated only Low severity despite the CVSS 9.6 score, with no public exploit identified at time of analysis and a low EPSS probability of 0.18% (8th percentile). Google has shipped a fixed Stable-channel build.
Arbitrary code execution in Google Chrome's WebProtect component (versions prior to 150.0.7871.47) arises from a use-after-free (CWE-416) that a malicious Chrome extension can trigger to run attacker-controlled code. Exploitation is gated behind convincing a victim to install a crafted extension, and Chromium rated the security severity as Low despite the NVD CVSS of 8.1. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile).
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process bypass Mojo IPC policy enforcement and break out of the sandbox using a crafted HTML page. This is a second-stage flaw in the Mojo inter-process communication layer rather than an initial-access bug, and Google itself rated the Chromium security severity as Low despite the NVD CVSS of 9.6. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Sandboxed remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 150.0.7871.47) lets a remote attacker corrupt memory via a crafted PDF, triggering a use-after-free (CWE-416). Exploitation requires the victim to open or view a malicious PDF (UI:R), and per the description any resulting code execution occurs inside the browser sandbox, which meaningfully constrains impact absent a separate sandbox-escape. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and CISA SSVC records exploitation status as none.
Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Scheduling component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.21% (12th percentile). Google rates the Chromium security severity as Low despite the NVD CVSS of 8.8, reflecting that code execution is confined to the sandbox rather than the host.
Sandbox escape in Google Chrome for Android before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting insufficient input validation in the Text component. Chromium rated this Low severity because it is a second-stage bug requiring prior renderer compromise, and no public exploit has been identified. EPSS is low (0.17%, 7th percentile) and CISA SSVC records no known exploitation, so realistic urgency is far below the raw CVSS 9.6.
Sandboxed remote code execution in Google Chrome desktop before 150.0.7871.47 lets a remote attacker run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page, exploiting insufficient input validation in the WebAppInstalls component. Google rates the Chromium severity as Low because execution is contained within the sandbox and no escape is included, and there is no public exploit identified at time of analysis. EPSS is low (0.21%, 12th percentile) and CISA SSVC records exploitation status as none.
Heap corruption via use-after-free in Google Chrome's Passwords component affects all desktop builds prior to 150.0.7871.47, letting a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and code execution in the renderer. The CVSS 3.1 vector (8.8) requires user interaction (visiting the page) but no privileges or authentication. No public exploit identified at time of analysis, and the low EPSS score (0.17%, 7th percentile) plus Chromium's own 'Low' severity rating suggest limited real-world exploitation likelihood despite the high CVSS.
Sandbox escape in Google Chrome on macOS before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page. The root cause is insufficient policy enforcement in Chrome's macOS sandbox (CWE-693). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile); Google's own Chromium security team rated the severity 'Low', which conflicts sharply with the CVSS 9.6 assigned by NVD.
Heap corruption via use-after-free affects Google Chrome for iOS prior to 150.0.7871.47, where a remote attacker serving a crafted HTML page can trigger memory corruption after luring the victim into performing specific UI gestures. Chromium rated the issue Low severity, and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile) and CISA SSVC records no known exploitation. A vendor patch is available, so the practical priority is routine browser-update hygiene rather than emergency response.
Sandbox escape in Google Chrome on macOS prior to 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the WebAppInstalls component. Chromium rated the underlying issue Low severity even though the CVSS base score is 9.6, and there is no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile). The vulnerability is a second-stage primitive that requires prior renderer code execution, not a standalone drive-by.
Sandbox escape in Google Chrome desktop versions prior to 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and gain code execution on the host via a crafted HTML page. The flaw stems from insufficient policy enforcement in the browser process (CWE-20) and, while carrying a high CVSS base score of 9.6 due to the scope change, was rated only Low severity by Chromium because it is not independently exploitable. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile).
OS-level privilege escalation in Google Chrome's Windows installer component (versions prior to 150.0.7871.47) lets a local attacker execute code at elevated privilege by planting a malicious file that triggers a use-after-free during installation. Google rates the Chromium security severity as Low, and while a vendor patch is available there is no public exploit identified at time of analysis; EPSS is very low (0.11%, 2nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 7.8 reflects total technical impact if triggered, but exploitation requires local access, user interaction, and Windows-specific installer conditions.
Sandbox escape in Google Chrome's Cast component (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory-corruption bug. Google's Chromium team rated the security severity as Low, and while NVD assigns a 9.6 CVSS reflecting full sandbox-escape impact, exploitation is gated behind a pre-existing renderer compromise. No public exploit was identified at time of analysis, EPSS is very low at 0.17% (7th percentile), and there is no CISA KEV listing.
Sandbox-contained arbitrary code execution in Google Chrome (Chromium DevTools component) before version 150.0.7871.47 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416); Google rated its Chromium security severity as Low because execution is confined to the sandbox rather than the host OS. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and CISA SSVC lists exploitation as none - but a vendor patch is already available in the Stable channel.
Out-of-bounds memory read in the CameraCapture component of Google Chrome on ChromeOS (versions prior to 150.0.7871.47) lets a remote attacker leak adjacent process memory when a victim opens a crafted HTML page. No public exploit identified at time of analysis, and EPSS is low (0.17%), but the flaw is marked automatable by CISA SSVC. Note a signal conflict: the NVD CVSS is 8.1 (high) while Google rates the Chromium security severity as Low.
Heap corruption in Google Chrome's WebNN (Web Neural Network API) implementation on Windows, fixed in 150.0.7871.47, lets an attacker who has already compromised the renderer process trigger a heap buffer overflow via a crafted HTML page and potentially escalate beyond the sandbox. Chromium's own security team rated this Low severity, while NVD scores it 8.8; EPSS is low at 0.19% (9th percentile) and there is no public exploit identified at time of analysis. It is not listed in CISA KEV and SSVC records exploitation status as none.
Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from insufficient policy enforcement in the WebHID component, letting a remote attacker who lures a victim to a crafted HTML page break out of intended HID access controls and run arbitrary code. Exploitation requires user interaction (visiting a malicious page) but no authentication, and no public exploit has been identified at time of analysis; EPSS is low at 0.21% (12th percentile). Notably, Google rates the Chromium security severity as 'Low' while the NVD-style CVSS is 8.8, a discrepancy worth weighing when prioritizing.
Heap corruption in the Chromoting (Chrome Remote Desktop) component of Google Chrome before 150.0.7871.47 lets a remote attacker deliver malicious network traffic to a victim's active remote session, potentially corrupting heap memory and enabling arbitrary code execution in the browser process. All desktop Chrome installs using Chrome Remote Desktop below the fixed build are affected. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation as none; EPSS is low at 0.16% (6th percentile), so this is a patch-during-normal-cycle item rather than an emergency.
Privilege escalation in Google Chrome's WebRTC component (versions prior to 150.0.7871.47) allows a remote attacker to escape normal renderer restrictions when a victim opens a crafted HTML page, per the CVSS vector achieving high confidentiality, integrity, and availability impact. Exploitation requires user interaction (visiting a malicious page) but no prior authentication. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 7th percentile); notably, Google/Chromium rated this 'Low' severity while the NVD CVSS is 8.8 (High), a discrepancy defenders should weigh.
Remote code execution in Google Chrome for iOS prior to 150.0.7871.47 stems from a use-after-free (CWE-416) that a remote attacker can trigger when a victim loads a crafted HTML page. Despite Chromium rating the underlying bug 'Low' severity, the NVD CVSS scores it 8.8 (High) because successful exploitation yields full compromise of the browser process. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile), with CISA SSVC recording no observed exploitation.
Remote code execution in Google Chrome for Android prior to 150.0.7871.47 stems from a use-after-free in the PageInfo component, allowing a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser process. Chromium rated the security severity Low, and while the CVSS base score is 7.5, the high attack complexity and required user interaction constrain practical exploitation. No public exploit identified at time of analysis, and the EPSS score is low at 0.21% (12th percentile).
Local privilege escalation in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows before 150.0.7871.47 allows a local attacker who plants a malicious file to elevate privileges after the victim interacts with it. The flaw stems from insufficient validation of untrusted input (CWE-20) and carries a 7.8 CVSS but was rated Low severity by Chromium's own team. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.13%, 3rd percentile), consistent with a local, interaction-dependent issue rather than a mass-exploitable one.
Sandbox escape in Google Chrome's Media component before version 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to break out of the sandbox using a crafted video file. The flaw stems from insufficient validation of untrusted input (CWE-20) and carries a scope-changing CVSS 3.1 score of 9.6, though Google rated the underlying Chromium severity as Low and no public exploit has been identified at time of analysis. EPSS is low at 0.16% (6th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome on Windows prior to 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted input to the Device Trust component via a malicious HTML page. NVD scores this 9.6 (Critical) while Google rates the Chromium security severity as Low, and there is no public exploit identified at time of analysis. EPSS is very low at 0.17% (7th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and is second-stage: it is not directly exploitable from the open web without a prior renderer compromise. No public exploit has been identified at time of analysis, and its EPSS exploitation probability is low (0.17%, 7th percentile); notably, Google rated the Chromium security severity as Low despite the NVD CVSS of 9.6.
Sandbox escape in Google Chrome's GetUserMedia (media capture) implementation before version 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own security team; despite an NVD CVSS of 9.6, Chromium rates its severity Low, and there is no public exploit identified at time of analysis with an EPSS of only 0.17% (7th percentile).
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Serial (Web Serial API) component, allowing a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser. Note the signal conflict: NVD scores this 8.8 (High) with high confidentiality/integrity/availability impact, yet Chromium's own triage rates the security severity as Low. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.17% (7th percentile).
Heap corruption in Google Chrome's BrowserTag component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by a crafted Chrome extension. An attacker who convinces a victim to install a malicious extension can potentially exploit the freed-memory condition to corrupt the heap and execute code. No public exploit identified at time of analysis, and EPSS is low (0.12%, 2nd percentile), consistent with the Chromium team's own 'Low' severity rating despite the NVD CVSS of 8.8.
Sandbox escape in Google Chrome's New Tab Page prior to 150.0.7871.47 allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. The flaw stems from insufficient validation of untrusted input (CWE-20) and requires a pre-existing renderer foothold, making it a second-stage exploit rather than an initial-access vector. Google rated the Chromium severity as Low; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile).
Sandbox escape in Google Chrome's GPU process before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. The flaw is a protection-mechanism failure (CWE-693) that Google patched in the June 2026 Stable channel update; Chromium rated its intrinsic severity Low because it is only useful as the second link in an exploit chain, and no public exploit has been identified at time of analysis. EPSS probability is low (0.17%, 7th percentile), consistent with a chained bug rather than a mass-exploitable entry point.
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Bluetooth subsystem, letting a remote attacker who lures a victim to a crafted HTML page cross a security boundary the browser is supposed to guard. Google's Chrome release channel and the NVD-assigned CVSS 3.1 base score of 8.8 (High) diverge from Chromium's own internal 'Low' severity rating, signaling the practical impact is likely narrower than the raw score implies. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.17% (7th percentile), consistent with no active exploitation reported.
Arbitrary code execution in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, triggerable by a crafted Chrome Extension. An attacker who convinces a user to install a malicious extension can corrupt memory to run code in the browser context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.13% (3rd percentile), and CISA SSVC records exploitation status as none.
Use-after-free in Google Chrome's SignIn component (versions prior to 150.0.7871.47) allows a remote attacker to trigger heap corruption and potentially achieve code execution after luring a victim to a crafted HTML page and performing specific UI gestures. No public exploit was identified at time of analysis, and with an EPSS of 0.17% (7th percentile) and Chromium-rated 'Low' severity, near-term mass exploitation appears unlikely despite the high 8.8 CVSS. The flaw is patched in the current stable channel and is not listed in CISA KEV.
Heap corruption in Google Chrome's Views UI framework on macOS (versions before 150.0.7871.47) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free, potentially achieving code execution in the renderer. Google rates the Chromium severity as Low, but the NVD CVSS is 8.8 (High), and no public exploit has been identified at time of analysis. EPSS is low at 0.21% (11th percentile), and the flaw is not in CISA KEV.
Use-after-free in Google Chrome's Ozone component on Linux prior to 150.0.7871.47 lets a remote attacker trigger heap corruption after luring a user to a crafted HTML page and inducing specific UI gestures. Rated CVSS 8.8 with high confidentiality, integrity and availability impact, it is patched in the stable channel but requires user interaction (UI:R). No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile), and Google classifies the Chromium severity as Medium.
Local privilege escalation in Google Chrome's Updater component on Windows (versions prior to 150.0.7871.47) allows a local attacker to escalate to OS-level privileges via a malicious file that triggers a use-after-free condition. Google rates the Chromium security severity as Medium, though the CVSS base score is 7.8 (High) because the Updater runs with elevated (SYSTEM) privileges. There is no public exploit identified at time of analysis and EPSS is very low (0.11%, 1st percentile), indicating negligible observed exploitation activity.
Sandbox escape in Google Chrome's Navigation component before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Medium by Chromium but carries a 9.6 CVSS due to the scope-changing sandbox breach; EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis, indicating it is realistically a second-stage link in an exploit chain rather than a standalone remote-code path.
Out-of-bounds memory read in the SurfaceCapture component of Google Chrome before 150.0.7871.47 lets a remote attacker leak adjacent heap memory when a victim opens a crafted HTML page. Chromium rated the flaw Medium severity, though the associated CVSS is 8.1; there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.17% (7th percentile), consistent with a browser bug fixed pre-disclosure. Successful exploitation could disclose sensitive in-process data or crash the renderer, and typically serves as one link in a larger sandbox-escape chain rather than standalone compromise.
Heap corruption in the Passwords component of Google Chrome desktop before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and likely code execution in the renderer. Rated CVSS 8.8 (Chromium severity Medium), it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and CISA SSVC records no observed exploitation.
Remote code execution in Google Chrome (Desktop) before 150.0.7871.47 stems from a use-after-free in the Navigation component, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt memory and run arbitrary code in the renderer. Chromium rated it Medium, but the CVSS 8.8 reflects full C/I/A impact requiring only user interaction (visiting a page). There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, with a low EPSS of 0.21%.
Use-after-free in Google Chrome's Omnibox component on Android (versions prior to 150.0.7871.47) lets a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page trigger heap corruption and potentially achieve code execution in the renderer. Rated Medium by Chromium but scored CVSS 8.8 due to network reach and full CIA impact after minimal user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.17%), and SSVC records exploitation status as none.
Navigation restriction bypass in Google Chrome on macOS prior to 150.0.7871.47 lets a remote attacker evade Safe Browsing protections by luring a victim into opening a malicious file, via an integer overflow in the Safe Browsing component. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The practical effect is that a security warning meant to block dangerous navigations can be defeated, not direct code execution.
Arbitrary code execution in Google Chrome's DevTools component (versions prior to 150.0.7871.47) lets a remote attacker run code inside the renderer sandbox after luring a victim into performing specific UI gestures with a malicious file. Rated Medium by Chromium but scored CVSS 7.5, the flaw stems from insufficient validation of untrusted input (CWE-20); no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.24% (15th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting a malicious page) but no authentication, and the flaw carries a CVSS 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.30%, 22nd percentile), indicating no evidence of widespread exploitation despite the high CVSS.
Arbitrary code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in Oilpan, Blink's garbage collector, letting a remote attacker who lures a victim to a crafted HTML page run code within the renderer sandbox. Google rated it Medium severity; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). Google has shipped a fixed Stable-channel build, and exploitation requires user interaction (visiting a malicious page).
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the renderer sandbox by abusing insufficient policy enforcement in the browser's USB (WebUSB) handling, delivered through a crafted HTML page. The flaw is rated Medium by Chromium but carries a high CVSS (8.3) due to the scope change from renderer to browser process; EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis. A vendor patch is available in the June 2026 Stable channel update.
Out-of-bounds memory write in Google Chrome's Fonts component (versions prior to 150.0.7871.47) lets a remote attacker corrupt heap memory when a victim renders a crafted HTML page, creating a path toward renderer-process code execution. The flaw stems from an integer overflow during font handling and requires only that the target open an attacker-controlled page. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Dawn (WebGPU) implementation on Android before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox and reach the host via a crafted HTML page. Reported by Google's own Chrome security team and rated Medium by Chromium despite an NVD CVSS of 9.6, it currently has no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile). It is a second-stage bug that requires a prior renderer compromise, so it is dangerous as part of an exploit chain rather than as a standalone entry point.
Privilege escalation in Google Chrome desktop versions prior to 150.0.7871.47 lets a remote attacker escalate privileges when a victim opens a crafted HTML page, stemming from insufficient input validation in the Enterprise component. Chromium rated the flaw Medium severity, though the assigned CVSS of 8.8 reflects high confidentiality, integrity, and availability impact once triggered. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.21% (11th percentile).
Local privilege escalation in Google Chrome for Android before 150.0.7871.47 stems from insufficient validation of untrusted input in the browser UI, letting a local attacker who convinces a user to open a malicious file gain elevated privileges. Rated Medium by Chromium but scored CVSS 7.8 (total technical impact per SSVC), with no public exploit identified at time of analysis and a low EPSS of 0.13% (3rd percentile). Google has shipped a fixed Stable channel build.
Remote code execution in Google Chrome on Windows before 150.0.7871.47 allows a remote attacker to run arbitrary code after luring a victim to a crafted HTML page and coercing specific UI gestures via an inappropriate implementation in the Downloads component. Rated Medium by Chromium but scored CVSS 7.5 due to full compromise potential; no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile). SSVC lists exploitation as none, so this is a patch-in-normal-cycle item rather than an emergency.
Sandbox escape in Google Chrome on Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that abuses insufficient input validation in the Media component. Google rates the Chromium security severity as Medium and a fix is shipped in the stable channel, but no public exploit has been identified and EPSS exploitation probability is low at 0.21%. The high 9.6 CVSS reflects the total system compromise possible once chained, not standalone exploitability.
Use-after-free memory corruption in Google Chrome for iOS before version 150.0.7871.47 allows a remote attacker to trigger heap corruption when a victim loads a crafted HTML page, potentially leading to code execution within the browser context. The flaw was reported by Google's own security team and carries an NVD CVSS of 8.8, though Chromium rated its severity as Medium, and no public exploit has been identified at time of analysis. EPSS is low (0.21%, 11th percentile) and CISA SSVC records no observed exploitation, indicating this is a patch-on-schedule issue rather than an active threat.
Heap corruption in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who lures a user through specific in-page UI gestures on a crafted HTML page trigger a use-after-free (CWE-416), potentially leading to arbitrary code execution in the renderer. Rated Medium by the Chromium security team but scored CVSS 8.8 due to full confidentiality/integrity/availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.21% (11th percentile), consistent with a freshly patched browser bug that has no known weaponization.
Sandbox escape in Google Chrome DevTools before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, stemming from insufficient policy enforcement (CWE-693). NVD scores this 9.6 with a scope-change vector, though Google rates the Chromium severity only Medium and it is a second-stage bug requiring prior renderer compromise. No public exploit has been identified at time of analysis and EPSS is low (0.21%), consistent with a chained rather than standalone threat.
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the browser's Bluetooth stack, letting a remote attacker who lures a victim to a crafted HTML page bypass client-side security checks (CWE-602). Exploitation requires user interaction (visiting the page) but no authentication (PR:N/UI:R), and NVD scores it 8.8 while Google's own Chromium team rated the severity Medium. There is no public exploit identified at time of analysis, EPSS is low at 0.22%, and CISA SSVC records exploitation status as none.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who already controls a compromised renderer process break out of the browser sandbox through insufficient policy enforcement in the Web Serial API, using a crafted HTML page. Google rated the underlying Chromium bug Medium severity even though NVD assigns a 9.6 CVSS due to the scope-changing impact. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.22%, 12th percentile).
Remote code execution in Google Chrome prior to 150.0.7871.47 stems from a use-after-free (CWE-416) in the browser's HTML handling, letting a remote attacker who lures a victim to a crafted page execute arbitrary code, though execution is confined inside Chrome's renderer sandbox. Chromium rated the issue Medium severity precisely because the code runs within the sandbox rather than escaping it; no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) with SSVC exploitation status 'none'. Google has shipped a fixed Stable-channel build.
Sandboxed remote code execution in Google Chrome's Cast Receiver component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by luring a victim to a crafted HTML page. Google rates the Chromium severity as Medium because the resulting code execution is confined to the browser sandbox, though NVD scores it CVSS 8.8; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.27% (18th percentile).
Privilege escalation in Google Chrome's Chromecast component affects all desktop versions prior to 150.0.7871.47, where insufficient policy enforcement lets a remote attacker who lures a victim to a crafted HTML page escalate privileges within the browser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile). Note a signal conflict: the assigned CVSS is 8.8 (High) while Google/Chromium rated the underlying flaw only Medium severity.
Privilege escalation in Google Chrome's Extensions component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out via a crafted HTML page. Rated Medium by Chromium and CVSS 7.5, it stems from insufficient validation of untrusted input (CWE-20) and requires user interaction plus a pre-existing renderer foothold. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 12th percentile), and it is not on CISA KEV.
Use-after-free in the Extensions component of Google Chrome before 150.0.7871.47 lets a remote attacker execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Chromium rated the security severity Medium, though the associated CVSS score is 8.8 (High) due to network vector and high impact; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.26%. Google has shipped a fixed Stable channel build.
Sandboxed remote code execution in Google Chrome for Android before 150.0.7871.47, stemming from a use-after-free in the Skia graphics library, lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google rated the Chromium security severity as Medium, and no public exploit has been identified at time of analysis; the EPSS score is low (0.26%, 17th percentile), and the bug is not on CISA KEV. Exploitation requires user interaction (visiting the malicious page) but no authentication.
Heap-based integer overflow in Google Chrome's Chromecast component allows an adjacent-network attacker to achieve arbitrary code execution against browsers running versions prior to 150.0.7871.47. The flaw is reachable via crafted malicious network traffic and carries a high CVSS of 8.8; Google has shipped a stable-channel fix, and no public exploit has been identified at time of analysis. Chromium rates the underlying issue as Medium severity despite the high CVSS, reflecting the adjacency and interaction constraints.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) allows a remote attacker to potentially break out of the renderer sandbox when a victim loads a crafted HTML page. The flaw is a CWE-843 type confusion; while NVD scores it CVSS 9.6 (critical), Google's own Chromium team rated the security severity as Medium, and there is no public exploit identified at time of analysis. EPSS is low (0.23%, 13th percentile) and CISA SSVC records no known exploitation, so this is a patch-on-cycle browser bug rather than an emergency.
Sandbox escape in Google Chrome desktop prior to 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox by winning a race condition in the USB subsystem via a crafted HTML page. Chromium rated it Medium severity despite the 9.6 CVSS, reflecting that it is a second-stage bug requiring prior renderer compromise; there is no public exploit identified at time of analysis and it is not in CISA KEV, with EPSS at just 0.21% (11th percentile).
Sandbox escape in Google Chrome's USB subsystem on macOS (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and was reported by Google's own security team; Chromium rated it Medium severity despite the NVD CVSS of 9.6. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 11th percentile), consistent with a chained/second-stage bug rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, letting an attacker who has already compromised the renderer process break out of the sandbox and reach the higher-privileged browser process via a crafted HTML page. This is a second-stage exploitation primitive rather than an initial-access flaw, which is why Google rates the Chromium severity as Medium despite the 9.6 CVSS. No public exploit has been identified, there is no CISA KEV listing, and EPSS exploitation probability is low (0.21%, 11th percentile).
Sandbox escape in Google Chrome for Android before 150.0.7871.47 lets a local attacker break out of the renderer/browser sandbox by feeding a malicious file into the WebAppInstalls component, which insufficiently validates untrusted input (CWE-20). Chromium rates the security severity as Medium, and no public exploit has been identified at time of analysis; EPSS estimates only a 0.13% (3rd percentile) chance of exploitation in the next 30 days. A vendor patch is available in Chrome 150.0.7871.47.
Sandboxed remote code execution in the WebView component of Google Chrome for Android before 150.0.7871.47 lets a remote attacker run arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. Rated CVSS 8.8 (network vector, no privileges, requires user interaction), the flaw is a CWE-416 use-after-free, but code execution is confined to the sandbox and would require a separate escape to reach the host. No public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile), indicating limited near-term mass-exploitation pressure despite the high base score.
Sandbox escape in Google Chrome's Device component on Windows (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416). Google rates the Chromium security severity as Medium, reflecting that it is a second-stage bug requiring prior renderer compromise, though the NVD CVSS of 9.6 is inflated by the sandbox scope change. There is no public exploit identified at time of analysis and EPSS is low (0.21%), indicating no current sign of widespread exploitation.
Privilege escalation in Google Chrome desktop prior to 150.0.7871.47 stems from insufficient policy enforcement in the WebHID subsystem, letting a maliciously crafted extension escape its intended boundaries and gain elevated access to human-interface devices and browser privileges. Exploitation first requires convincing a victim to install the malicious extension, after which a crafted Chrome Extension bypasses WebHID access controls. Chromium rates the issue Medium; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.13%, 3rd percentile).
Privilege escalation in Google Chrome for Android (CustomTabs) prior to 150.0.7871.47 allows a local attacker to escalate privileges by supplying a malicious file that CustomTabs fails to validate properly. Google rates the Chromium severity as Medium, and the requirement for user interaction plus local access limits remote mass exploitation. No public exploit has been identified at time of analysis and the EPSS score is very low (0.13%, 3rd percentile), so opportunistic exploitation appears unlikely.
Sandbox escape in Google Chrome before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page, exploiting a use-after-free (CWE-416) in the Core component. Google-assigned Chromium severity is Medium, though the NVD CVSS is 9.6 due to the cross-boundary scope change. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), indicating it is not yet a mass-exploitation target.
Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 150.0.7871.47) allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox, a critical trust-boundary bypass affecting the Windows/macOS/Linux desktop browser. The NVD scores this 9.6 (scope-changed) though Google rates the underlying Chromium issue as Medium severity, and there is no public exploit identified at time of analysis. EPSS is low (0.21%) and CISA SSVC records exploitation status as none, indicating no observed active abuse.
Privilege escalation in Google Chrome for Android before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out further by feeding a crafted HTML page into the Speech component, which fails to validate untrusted input (CWE-20). Google rated it Medium severity; a fix has shipped in the Stable channel, EPSS is low (0.21%, 11th percentile), and there is no public exploit identified at time of analysis. This is a sandbox-escape-class chaining bug rather than a standalone remote drive-by, since it presupposes a prior renderer compromise.
Remote code execution in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in the Ozone platform layer, allowing a remote attacker who lures a victim into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser context. Rated High by Chromium and CVSS 7.5, exploitation is gated by required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.26% (17th percentile).
Sandbox escape in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in Ozone, Chrome's platform abstraction layer for windowing and graphics. An attacker who has already compromised the renderer process can leverage a crafted HTML page to break out of the browser sandbox and gain code execution at the higher-privileged browser-process level. There is no public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a second-stage bug that requires a prior renderer compromise rather than a directly weaponizable single-shot flaw.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Journeys (browsing history) component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader code execution on the host via a crafted HTML page. Rated High severity by Chromium and CVSS 9.6, a fix is available from vendor; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Exploitation is meaningful only as the second stage of a chain, since it presupposes prior renderer compromise.
Discretionary access control bypass in Google Chrome for Android before 150.0.7871.47 lets a local attacker abuse the WebAppInstalls component through a crafted HTML page, undermining the platform's integrity and availability boundaries. Google rates the Chromium severity High and has shipped a fix in the Stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Access-control bypass in Google Chrome for Android before 150.0.7871.47 allows an attacker to subvert discretionary access controls through the WebAppInstalls component by serving a crafted HTML page, stemming from insufficient validation of untrusted input. Rated High by Chromium and scored CVSS 9.1, the flaw carries high integrity and availability impact but no confidentiality loss; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Sandboxed arbitrary code execution in Google Chrome for iOS before 150.0.7871.47 lets an attacker who convinces a user to open a malicious file run code inside the browser's sandbox due to insufficient validation of untrusted input. Google rates the Chromium severity High and ships the fix in 150.0.7871.47; EPSS is low (0.15%, 4th percentile) and there is no public exploit identified at time of analysis. The flaw requires user interaction (opening the file) and, per the description, the resulting execution is confined to the sandbox rather than the underlying OS.
Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows versions prior to 150.0.7871.47 allows a local attacker to break out of the browser sandbox by getting a victim to open a malicious file. Google rates the Chromium severity as High, and while a vendor patch is available, EPSS is low (0.13%) and CISA SSVC records no known exploitation, so this is no public exploit identified at time of analysis. The scope-changing, high-impact nature (full confidentiality, integrity and availability loss beyond the sandbox boundary) makes it a meaningful patch priority for Windows Chrome fleets despite requiring user interaction.
OS-level privilege escalation in Google Chrome for Windows before 150.0.7871.47 lets a local attacker leverage an inappropriate implementation in the CredentialProvider component to elevate privileges via a malicious file. Exploitation requires local access plus user interaction (UI:R), and though Google rated the Chromium security severity 'Low', the CVSS 3.1 base score is 7.8 (High) due to full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and the EPSS probability is very low at 0.11% (2nd percentile).
Arbitrary read/write in Google Chrome on Windows (versions prior to 150.0.7871.47) allows a remote attacker to corrupt or exfiltrate in-process memory when a victim visits a crafted HTML page, stemming from insufficient input validation in the WebAppInstalls component. The CVSS 8.1 rating reflects high confidentiality and integrity impact requiring only user interaction (visiting a page), though Chromium rated the underlying security severity as Low. There is no public exploit identified at time of analysis, EPSS is a low 0.18% (8th percentile), and CISA SSVC marks exploitation as none, indicating high theoretical impact but currently low real-world exploitation pressure.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux, fixed in 150.0.7871.47, lets a remote attacker corrupt memory via crafted network traffic and potentially run arbitrary code. The flaw is a CWE-416 use-after-free reported by Google's internal Chrome security team; there is no public exploit identified at time of analysis and it is not in CISA KEV. Note a signal conflict: NVD scores this 9.8 (Critical) while Chromium itself rated the security severity 'Low', and EPSS is only 0.20% (10th percentile).
Sandbox escape in Google Chrome's DevTools component (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox and reach the host via a crafted HTML page. Google's Chromium security team rated this Low severity because it is a second-stage bug requiring prior renderer compromise, which conflicts sharply with the NVD CVSS 9.6 (Critical); no public exploit is identified at time of analysis, KEV/SSVC show no known exploitation, and EPSS is low at 0.18%. A vendor patch is available.
Privilege escalation in Google Chrome's Cast component before 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to escape renderer-level restrictions and gain higher privileges via a crafted HTML page. Rated Low severity by Chromium despite a 7.5 CVSS, it functions as a second-stage sandbox-escape primitive rather than a standalone initial-access bug. There is no public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile), indicating minimal near-term mass-exploitation risk.
UI spoofing in Google Chrome for Android before 150.0.7871.47 lets a local attacker misrepresent browser interface elements through the WebAppInstalls component using a malicious file. The flaw (CWE-451) requires a crafted file to be opened on the device and could deceive users into trusting spoofed content or install prompts. Google rates the Chromium security severity as Low, no public exploit has been identified, and EPSS is negligible at 0.11%.
Sandbox escape in Google Chrome for Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process abuse a use-after-free in the Updater component via a crafted HTML page to break out of the browser sandbox. It is a second-stage bug that Chromium rated only Low severity despite the CVSS 9.6 score, with no public exploit identified at time of analysis and a low EPSS probability of 0.18% (8th percentile). Google has shipped a fixed Stable-channel build.
Arbitrary code execution in Google Chrome's WebProtect component (versions prior to 150.0.7871.47) arises from a use-after-free (CWE-416) that a malicious Chrome extension can trigger to run attacker-controlled code. Exploitation is gated behind convincing a victim to install a crafted extension, and Chromium rated the security severity as Low despite the NVD CVSS of 8.1. No public exploit identified at time of analysis, and EPSS is low (0.13%, 3rd percentile).
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process bypass Mojo IPC policy enforcement and break out of the sandbox using a crafted HTML page. This is a second-stage flaw in the Mojo inter-process communication layer rather than an initial-access bug, and Google itself rated the Chromium security severity as Low despite the NVD CVSS of 9.6. No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile).
Sandboxed remote code execution in Google Chrome's PDFium PDF rendering engine (versions prior to 150.0.7871.47) lets a remote attacker corrupt memory via a crafted PDF, triggering a use-after-free (CWE-416). Exploitation requires the victim to open or view a malicious PDF (UI:R), and per the description any resulting code execution occurs inside the browser sandbox, which meaningfully constrains impact absent a separate sandbox-escape. There is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and CISA SSVC records exploitation status as none.
Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Scheduling component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. There is no public exploit identified at time of analysis and the vulnerability is not in CISA KEV; EPSS is low at 0.21% (12th percentile). Google rates the Chromium security severity as Low despite the NVD CVSS of 8.8, reflecting that code execution is confined to the sandbox rather than the host.
Sandbox escape in Google Chrome for Android before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting insufficient input validation in the Text component. Chromium rated this Low severity because it is a second-stage bug requiring prior renderer compromise, and no public exploit has been identified. EPSS is low (0.17%, 7th percentile) and CISA SSVC records no known exploitation, so realistic urgency is far below the raw CVSS 9.6.
Sandboxed remote code execution in Google Chrome desktop before 150.0.7871.47 lets a remote attacker run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page, exploiting insufficient input validation in the WebAppInstalls component. Google rates the Chromium severity as Low because execution is contained within the sandbox and no escape is included, and there is no public exploit identified at time of analysis. EPSS is low (0.21%, 12th percentile) and CISA SSVC records exploitation status as none.
Heap corruption via use-after-free in Google Chrome's Passwords component affects all desktop builds prior to 150.0.7871.47, letting a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and code execution in the renderer. The CVSS 3.1 vector (8.8) requires user interaction (visiting the page) but no privileges or authentication. No public exploit identified at time of analysis, and the low EPSS score (0.17%, 7th percentile) plus Chromium's own 'Low' severity rating suggest limited real-world exploitation likelihood despite the high CVSS.
Sandbox escape in Google Chrome on macOS before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox through a crafted HTML page. The root cause is insufficient policy enforcement in Chrome's macOS sandbox (CWE-693). No public exploit identified at time of analysis, and EPSS is low (0.17%, 7th percentile); Google's own Chromium security team rated the severity 'Low', which conflicts sharply with the CVSS 9.6 assigned by NVD.
Heap corruption via use-after-free affects Google Chrome for iOS prior to 150.0.7871.47, where a remote attacker serving a crafted HTML page can trigger memory corruption after luring the victim into performing specific UI gestures. Chromium rated the issue Low severity, and there is no public exploit identified at time of analysis; EPSS is low at 0.18% (8th percentile) and CISA SSVC records no known exploitation. A vendor patch is available, so the practical priority is routine browser-update hygiene rather than emergency response.
Sandbox escape in Google Chrome on macOS prior to 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the WebAppInstalls component. Chromium rated the underlying issue Low severity even though the CVSS base score is 9.6, and there is no public exploit identified at time of analysis; EPSS is 0.17% (7th percentile). The vulnerability is a second-stage primitive that requires prior renderer code execution, not a standalone drive-by.
Sandbox escape in Google Chrome desktop versions prior to 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and gain code execution on the host via a crafted HTML page. The flaw stems from insufficient policy enforcement in the browser process (CWE-20) and, while carrying a high CVSS base score of 9.6 due to the scope change, was rated only Low severity by Chromium because it is not independently exploitable. No public exploit has been identified and EPSS probability is very low (0.17%, 7th percentile).
OS-level privilege escalation in Google Chrome's Windows installer component (versions prior to 150.0.7871.47) lets a local attacker execute code at elevated privilege by planting a malicious file that triggers a use-after-free during installation. Google rates the Chromium security severity as Low, and while a vendor patch is available there is no public exploit identified at time of analysis; EPSS is very low (0.11%, 2nd percentile) and CISA SSVC records no observed exploitation. The high CVSS 7.8 reflects total technical impact if triggered, but exploitation requires local access, user interaction, and Windows-specific installer conditions.
Sandbox escape in Google Chrome's Cast component (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416) memory-corruption bug. Google's Chromium team rated the security severity as Low, and while NVD assigns a 9.6 CVSS reflecting full sandbox-escape impact, exploitation is gated behind a pre-existing renderer compromise. No public exploit was identified at time of analysis, EPSS is very low at 0.17% (7th percentile), and there is no CISA KEV listing.
Sandbox-contained arbitrary code execution in Google Chrome (Chromium DevTools component) before version 150.0.7871.47 allows a remote attacker to run code within the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416); Google rated its Chromium security severity as Low because execution is confined to the sandbox rather than the host OS. There is no public exploit identified at time of analysis, EPSS is low (0.21%), and CISA SSVC lists exploitation as none - but a vendor patch is already available in the Stable channel.
Out-of-bounds memory read in the CameraCapture component of Google Chrome on ChromeOS (versions prior to 150.0.7871.47) lets a remote attacker leak adjacent process memory when a victim opens a crafted HTML page. No public exploit identified at time of analysis, and EPSS is low (0.17%), but the flaw is marked automatable by CISA SSVC. Note a signal conflict: the NVD CVSS is 8.1 (high) while Google rates the Chromium security severity as Low.
Heap corruption in Google Chrome's WebNN (Web Neural Network API) implementation on Windows, fixed in 150.0.7871.47, lets an attacker who has already compromised the renderer process trigger a heap buffer overflow via a crafted HTML page and potentially escalate beyond the sandbox. Chromium's own security team rated this Low severity, while NVD scores it 8.8; EPSS is low at 0.19% (9th percentile) and there is no public exploit identified at time of analysis. It is not listed in CISA KEV and SSVC records exploitation status as none.
Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from insufficient policy enforcement in the WebHID component, letting a remote attacker who lures a victim to a crafted HTML page break out of intended HID access controls and run arbitrary code. Exploitation requires user interaction (visiting a malicious page) but no authentication, and no public exploit has been identified at time of analysis; EPSS is low at 0.21% (12th percentile). Notably, Google rates the Chromium security severity as 'Low' while the NVD-style CVSS is 8.8, a discrepancy worth weighing when prioritizing.
Heap corruption in the Chromoting (Chrome Remote Desktop) component of Google Chrome before 150.0.7871.47 lets a remote attacker deliver malicious network traffic to a victim's active remote session, potentially corrupting heap memory and enabling arbitrary code execution in the browser process. All desktop Chrome installs using Chrome Remote Desktop below the fixed build are affected. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation as none; EPSS is low at 0.16% (6th percentile), so this is a patch-during-normal-cycle item rather than an emergency.
Privilege escalation in Google Chrome's WebRTC component (versions prior to 150.0.7871.47) allows a remote attacker to escape normal renderer restrictions when a victim opens a crafted HTML page, per the CVSS vector achieving high confidentiality, integrity, and availability impact. Exploitation requires user interaction (visiting a malicious page) but no prior authentication. There is no public exploit identified at time of analysis, and the EPSS score is low (0.17%, 7th percentile); notably, Google/Chromium rated this 'Low' severity while the NVD CVSS is 8.8 (High), a discrepancy defenders should weigh.
Remote code execution in Google Chrome for iOS prior to 150.0.7871.47 stems from a use-after-free (CWE-416) that a remote attacker can trigger when a victim loads a crafted HTML page. Despite Chromium rating the underlying bug 'Low' severity, the NVD CVSS scores it 8.8 (High) because successful exploitation yields full compromise of the browser process. There is no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile), with CISA SSVC recording no observed exploitation.
Remote code execution in Google Chrome for Android prior to 150.0.7871.47 stems from a use-after-free in the PageInfo component, allowing a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser process. Chromium rated the security severity Low, and while the CVSS base score is 7.5, the high attack complexity and required user interaction constrain practical exploitation. No public exploit identified at time of analysis, and the EPSS score is low at 0.21% (12th percentile).
Local privilege escalation in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows before 150.0.7871.47 allows a local attacker who plants a malicious file to elevate privileges after the victim interacts with it. The flaw stems from insufficient validation of untrusted input (CWE-20) and carries a 7.8 CVSS but was rated Low severity by Chromium's own team. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.13%, 3rd percentile), consistent with a local, interaction-dependent issue rather than a mass-exploitable one.
Sandbox escape in Google Chrome's Media component before version 150.0.7871.47 allows a remote attacker who has already compromised the renderer process to break out of the sandbox using a crafted video file. The flaw stems from insufficient validation of untrusted input (CWE-20) and carries a scope-changing CVSS 3.1 score of 9.6, though Google rated the underlying Chromium severity as Low and no public exploit has been identified at time of analysis. EPSS is low at 0.16% (6th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome on Windows prior to 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by feeding crafted input to the Device Trust component via a malicious HTML page. NVD scores this 9.6 (Critical) while Google rates the Chromium security severity as Low, and there is no public exploit identified at time of analysis. EPSS is very low at 0.17% (7th percentile), and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and is second-stage: it is not directly exploitable from the open web without a prior renderer compromise. No public exploit has been identified at time of analysis, and its EPSS exploitation probability is low (0.17%, 7th percentile); notably, Google rated the Chromium security severity as Low despite the NVD CVSS of 9.6.
Sandbox escape in Google Chrome's GetUserMedia (media capture) implementation before version 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) reported by Google's own security team; despite an NVD CVSS of 9.6, Chromium rates its severity Low, and there is no public exploit identified at time of analysis with an EPSS of only 0.17% (7th percentile).
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Serial (Web Serial API) component, allowing a remote attacker who lures a victim to a crafted HTML page to escalate privileges within the browser. Note the signal conflict: NVD scores this 8.8 (High) with high confidentiality/integrity/availability impact, yet Chromium's own triage rates the security severity as Low. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is very low at 0.17% (7th percentile).
Heap corruption in Google Chrome's BrowserTag component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by a crafted Chrome extension. An attacker who convinces a victim to install a malicious extension can potentially exploit the freed-memory condition to corrupt the heap and execute code. No public exploit identified at time of analysis, and EPSS is low (0.12%, 2nd percentile), consistent with the Chromium team's own 'Low' severity rating despite the NVD CVSS of 8.8.
Sandbox escape in Google Chrome's New Tab Page prior to 150.0.7871.47 allows an attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page. The flaw stems from insufficient validation of untrusted input (CWE-20) and requires a pre-existing renderer foothold, making it a second-stage exploit rather than an initial-access vector. Google rated the Chromium severity as Low; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.17%, 7th percentile).
Sandbox escape in Google Chrome's GPU process before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page. The flaw is a protection-mechanism failure (CWE-693) that Google patched in the June 2026 Stable channel update; Chromium rated its intrinsic severity Low because it is only useful as the second link in an exploit chain, and no public exploit has been identified at time of analysis. EPSS probability is low (0.17%, 7th percentile), consistent with a chained bug rather than a mass-exploitable entry point.
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the Bluetooth subsystem, letting a remote attacker who lures a victim to a crafted HTML page cross a security boundary the browser is supposed to guard. Google's Chrome release channel and the NVD-assigned CVSS 3.1 base score of 8.8 (High) diverge from Chromium's own internal 'Low' severity rating, signaling the practical impact is likely narrower than the raw score implies. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.17% (7th percentile), consistent with no active exploitation reported.
Arbitrary code execution in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, triggerable by a crafted Chrome Extension. An attacker who convinces a user to install a malicious extension can corrupt memory to run code in the browser context. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.13% (3rd percentile), and CISA SSVC records exploitation status as none.
Use-after-free in Google Chrome's SignIn component (versions prior to 150.0.7871.47) allows a remote attacker to trigger heap corruption and potentially achieve code execution after luring a victim to a crafted HTML page and performing specific UI gestures. No public exploit was identified at time of analysis, and with an EPSS of 0.17% (7th percentile) and Chromium-rated 'Low' severity, near-term mass exploitation appears unlikely despite the high 8.8 CVSS. The flaw is patched in the current stable channel and is not listed in CISA KEV.
Heap corruption in Google Chrome's Views UI framework on macOS (versions before 150.0.7871.47) lets a remote attacker who lures a victim to a crafted HTML page and coaxes them into specific UI gestures trigger a use-after-free, potentially achieving code execution in the renderer. Google rates the Chromium severity as Low, but the NVD CVSS is 8.8 (High), and no public exploit has been identified at time of analysis. EPSS is low at 0.21% (11th percentile), and the flaw is not in CISA KEV.
Use-after-free in Google Chrome's Ozone component on Linux prior to 150.0.7871.47 lets a remote attacker trigger heap corruption after luring a user to a crafted HTML page and inducing specific UI gestures. Rated CVSS 8.8 with high confidentiality, integrity and availability impact, it is patched in the stable channel but requires user interaction (UI:R). No public exploit is identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile), and Google classifies the Chromium severity as Medium.
Local privilege escalation in Google Chrome's Updater component on Windows (versions prior to 150.0.7871.47) allows a local attacker to escalate to OS-level privileges via a malicious file that triggers a use-after-free condition. Google rates the Chromium security severity as Medium, though the CVSS base score is 7.8 (High) because the Updater runs with elevated (SYSTEM) privileges. There is no public exploit identified at time of analysis and EPSS is very low (0.11%, 1st percentile), indicating negligible observed exploitation activity.
Sandbox escape in Google Chrome's Navigation component before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Medium by Chromium but carries a 9.6 CVSS due to the scope-changing sandbox breach; EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis, indicating it is realistically a second-stage link in an exploit chain rather than a standalone remote-code path.
Out-of-bounds memory read in the SurfaceCapture component of Google Chrome before 150.0.7871.47 lets a remote attacker leak adjacent heap memory when a victim opens a crafted HTML page. Chromium rated the flaw Medium severity, though the associated CVSS is 8.1; there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.17% (7th percentile), consistent with a browser bug fixed pre-disclosure. Successful exploitation could disclose sensitive in-process data or crash the renderer, and typically serves as one link in a larger sandbox-escape chain rather than standalone compromise.
Heap corruption in the Passwords component of Google Chrome desktop before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and likely code execution in the renderer. Rated CVSS 8.8 (Chromium severity Medium), it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and CISA SSVC records no observed exploitation.
Remote code execution in Google Chrome (Desktop) before 150.0.7871.47 stems from a use-after-free in the Navigation component, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt memory and run arbitrary code in the renderer. Chromium rated it Medium, but the CVSS 8.8 reflects full C/I/A impact requiring only user interaction (visiting a page). There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, with a low EPSS of 0.21%.
Use-after-free in Google Chrome's Omnibox component on Android (versions prior to 150.0.7871.47) lets a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page trigger heap corruption and potentially achieve code execution in the renderer. Rated Medium by Chromium but scored CVSS 8.8 due to network reach and full CIA impact after minimal user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.17%), and SSVC records exploitation status as none.
Navigation restriction bypass in Google Chrome on macOS prior to 150.0.7871.47 lets a remote attacker evade Safe Browsing protections by luring a victim into opening a malicious file, via an integer overflow in the Safe Browsing component. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The practical effect is that a security warning meant to block dangerous navigations can be defeated, not direct code execution.
Arbitrary code execution in Google Chrome's DevTools component (versions prior to 150.0.7871.47) lets a remote attacker run code inside the renderer sandbox after luring a victim into performing specific UI gestures with a malicious file. Rated Medium by Chromium but scored CVSS 7.5, the flaw stems from insufficient validation of untrusted input (CWE-20); no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.24% (15th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting a malicious page) but no authentication, and the flaw carries a CVSS 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.30%, 22nd percentile), indicating no evidence of widespread exploitation despite the high CVSS.
Arbitrary code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in Oilpan, Blink's garbage collector, letting a remote attacker who lures a victim to a crafted HTML page run code within the renderer sandbox. Google rated it Medium severity; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). Google has shipped a fixed Stable-channel build, and exploitation requires user interaction (visiting a malicious page).
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the renderer sandbox by abusing insufficient policy enforcement in the browser's USB (WebUSB) handling, delivered through a crafted HTML page. The flaw is rated Medium by Chromium but carries a high CVSS (8.3) due to the scope change from renderer to browser process; EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis. A vendor patch is available in the June 2026 Stable channel update.
Out-of-bounds memory write in Google Chrome's Fonts component (versions prior to 150.0.7871.47) lets a remote attacker corrupt heap memory when a victim renders a crafted HTML page, creating a path toward renderer-process code execution. The flaw stems from an integer overflow during font handling and requires only that the target open an attacker-controlled page. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Dawn (WebGPU) implementation on Android before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox and reach the host via a crafted HTML page. Reported by Google's own Chrome security team and rated Medium by Chromium despite an NVD CVSS of 9.6, it currently has no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile). It is a second-stage bug that requires a prior renderer compromise, so it is dangerous as part of an exploit chain rather than as a standalone entry point.
Privilege escalation in Google Chrome desktop versions prior to 150.0.7871.47 lets a remote attacker escalate privileges when a victim opens a crafted HTML page, stemming from insufficient input validation in the Enterprise component. Chromium rated the flaw Medium severity, though the assigned CVSS of 8.8 reflects high confidentiality, integrity, and availability impact once triggered. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.21% (11th percentile).
Local privilege escalation in Google Chrome for Android before 150.0.7871.47 stems from insufficient validation of untrusted input in the browser UI, letting a local attacker who convinces a user to open a malicious file gain elevated privileges. Rated Medium by Chromium but scored CVSS 7.8 (total technical impact per SSVC), with no public exploit identified at time of analysis and a low EPSS of 0.13% (3rd percentile). Google has shipped a fixed Stable channel build.
Remote code execution in Google Chrome on Windows before 150.0.7871.47 allows a remote attacker to run arbitrary code after luring a victim to a crafted HTML page and coercing specific UI gestures via an inappropriate implementation in the Downloads component. Rated Medium by Chromium but scored CVSS 7.5 due to full compromise potential; no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile). SSVC lists exploitation as none, so this is a patch-in-normal-cycle item rather than an emergency.
Sandbox escape in Google Chrome on Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that abuses insufficient input validation in the Media component. Google rates the Chromium security severity as Medium and a fix is shipped in the stable channel, but no public exploit has been identified and EPSS exploitation probability is low at 0.21%. The high 9.6 CVSS reflects the total system compromise possible once chained, not standalone exploitability.
Use-after-free memory corruption in Google Chrome for iOS before version 150.0.7871.47 allows a remote attacker to trigger heap corruption when a victim loads a crafted HTML page, potentially leading to code execution within the browser context. The flaw was reported by Google's own security team and carries an NVD CVSS of 8.8, though Chromium rated its severity as Medium, and no public exploit has been identified at time of analysis. EPSS is low (0.21%, 11th percentile) and CISA SSVC records no observed exploitation, indicating this is a patch-on-schedule issue rather than an active threat.
Heap corruption in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who lures a user through specific in-page UI gestures on a crafted HTML page trigger a use-after-free (CWE-416), potentially leading to arbitrary code execution in the renderer. Rated Medium by the Chromium security team but scored CVSS 8.8 due to full confidentiality/integrity/availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.21% (11th percentile), consistent with a freshly patched browser bug that has no known weaponization.
Sandbox escape in Google Chrome DevTools before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, stemming from insufficient policy enforcement (CWE-693). NVD scores this 9.6 with a scope-change vector, though Google rates the Chromium severity only Medium and it is a second-stage bug requiring prior renderer compromise. No public exploit has been identified at time of analysis and EPSS is low (0.21%), consistent with a chained rather than standalone threat.
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the browser's Bluetooth stack, letting a remote attacker who lures a victim to a crafted HTML page bypass client-side security checks (CWE-602). Exploitation requires user interaction (visiting the page) but no authentication (PR:N/UI:R), and NVD scores it 8.8 while Google's own Chromium team rated the severity Medium. There is no public exploit identified at time of analysis, EPSS is low at 0.22%, and CISA SSVC records exploitation status as none.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who already controls a compromised renderer process break out of the browser sandbox through insufficient policy enforcement in the Web Serial API, using a crafted HTML page. Google rated the underlying Chromium bug Medium severity even though NVD assigns a 9.6 CVSS due to the scope-changing impact. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.22%, 12th percentile).
Remote code execution in Google Chrome prior to 150.0.7871.47 stems from a use-after-free (CWE-416) in the browser's HTML handling, letting a remote attacker who lures a victim to a crafted page execute arbitrary code, though execution is confined inside Chrome's renderer sandbox. Chromium rated the issue Medium severity precisely because the code runs within the sandbox rather than escaping it; no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) with SSVC exploitation status 'none'. Google has shipped a fixed Stable-channel build.
Sandboxed remote code execution in Google Chrome's Cast Receiver component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by luring a victim to a crafted HTML page. Google rates the Chromium severity as Medium because the resulting code execution is confined to the browser sandbox, though NVD scores it CVSS 8.8; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.27% (18th percentile).
Privilege escalation in Google Chrome's Chromecast component affects all desktop versions prior to 150.0.7871.47, where insufficient policy enforcement lets a remote attacker who lures a victim to a crafted HTML page escalate privileges within the browser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile). Note a signal conflict: the assigned CVSS is 8.8 (High) while Google/Chromium rated the underlying flaw only Medium severity.
Privilege escalation in Google Chrome's Extensions component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out via a crafted HTML page. Rated Medium by Chromium and CVSS 7.5, it stems from insufficient validation of untrusted input (CWE-20) and requires user interaction plus a pre-existing renderer foothold. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 12th percentile), and it is not on CISA KEV.
Use-after-free in the Extensions component of Google Chrome before 150.0.7871.47 lets a remote attacker execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Chromium rated the security severity Medium, though the associated CVSS score is 8.8 (High) due to network vector and high impact; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.26%. Google has shipped a fixed Stable channel build.
Sandboxed remote code execution in Google Chrome for Android before 150.0.7871.47, stemming from a use-after-free in the Skia graphics library, lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google rated the Chromium security severity as Medium, and no public exploit has been identified at time of analysis; the EPSS score is low (0.26%, 17th percentile), and the bug is not on CISA KEV. Exploitation requires user interaction (visiting the malicious page) but no authentication.
Heap-based integer overflow in Google Chrome's Chromecast component allows an adjacent-network attacker to achieve arbitrary code execution against browsers running versions prior to 150.0.7871.47. The flaw is reachable via crafted malicious network traffic and carries a high CVSS of 8.8; Google has shipped a stable-channel fix, and no public exploit has been identified at time of analysis. Chromium rates the underlying issue as Medium severity despite the high CVSS, reflecting the adjacency and interaction constraints.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) allows a remote attacker to potentially break out of the renderer sandbox when a victim loads a crafted HTML page. The flaw is a CWE-843 type confusion; while NVD scores it CVSS 9.6 (critical), Google's own Chromium team rated the security severity as Medium, and there is no public exploit identified at time of analysis. EPSS is low (0.23%, 13th percentile) and CISA SSVC records no known exploitation, so this is a patch-on-cycle browser bug rather than an emergency.
Sandbox escape in Google Chrome desktop prior to 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox by winning a race condition in the USB subsystem via a crafted HTML page. Chromium rated it Medium severity despite the 9.6 CVSS, reflecting that it is a second-stage bug requiring prior renderer compromise; there is no public exploit identified at time of analysis and it is not in CISA KEV, with EPSS at just 0.21% (11th percentile).
Sandbox escape in Google Chrome's USB subsystem on macOS (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and was reported by Google's own security team; Chromium rated it Medium severity despite the NVD CVSS of 9.6. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 11th percentile), consistent with a chained/second-stage bug rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, letting an attacker who has already compromised the renderer process break out of the sandbox and reach the higher-privileged browser process via a crafted HTML page. This is a second-stage exploitation primitive rather than an initial-access flaw, which is why Google rates the Chromium severity as Medium despite the 9.6 CVSS. No public exploit has been identified, there is no CISA KEV listing, and EPSS exploitation probability is low (0.21%, 11th percentile).
Sandbox escape in Google Chrome for Android before 150.0.7871.47 lets a local attacker break out of the renderer/browser sandbox by feeding a malicious file into the WebAppInstalls component, which insufficiently validates untrusted input (CWE-20). Chromium rates the security severity as Medium, and no public exploit has been identified at time of analysis; EPSS estimates only a 0.13% (3rd percentile) chance of exploitation in the next 30 days. A vendor patch is available in Chrome 150.0.7871.47.
Sandboxed remote code execution in the WebView component of Google Chrome for Android before 150.0.7871.47 lets a remote attacker run arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. Rated CVSS 8.8 (network vector, no privileges, requires user interaction), the flaw is a CWE-416 use-after-free, but code execution is confined to the sandbox and would require a separate escape to reach the host. No public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile), indicating limited near-term mass-exploitation pressure despite the high base score.
Sandbox escape in Google Chrome's Device component on Windows (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416). Google rates the Chromium security severity as Medium, reflecting that it is a second-stage bug requiring prior renderer compromise, though the NVD CVSS of 9.6 is inflated by the sandbox scope change. There is no public exploit identified at time of analysis and EPSS is low (0.21%), indicating no current sign of widespread exploitation.
Privilege escalation in Google Chrome desktop prior to 150.0.7871.47 stems from insufficient policy enforcement in the WebHID subsystem, letting a maliciously crafted extension escape its intended boundaries and gain elevated access to human-interface devices and browser privileges. Exploitation first requires convincing a victim to install the malicious extension, after which a crafted Chrome Extension bypasses WebHID access controls. Chromium rates the issue Medium; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.13%, 3rd percentile).
Privilege escalation in Google Chrome for Android (CustomTabs) prior to 150.0.7871.47 allows a local attacker to escalate privileges by supplying a malicious file that CustomTabs fails to validate properly. Google rates the Chromium severity as Medium, and the requirement for user interaction plus local access limits remote mass exploitation. No public exploit has been identified at time of analysis and the EPSS score is very low (0.13%, 3rd percentile), so opportunistic exploitation appears unlikely.
Sandbox escape in Google Chrome before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page, exploiting a use-after-free (CWE-416) in the Core component. Google-assigned Chromium severity is Medium, though the NVD CVSS is 9.6 due to the cross-boundary scope change. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), indicating it is not yet a mass-exploitation target.
Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 150.0.7871.47) allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox, a critical trust-boundary bypass affecting the Windows/macOS/Linux desktop browser. The NVD scores this 9.6 (scope-changed) though Google rates the underlying Chromium issue as Medium severity, and there is no public exploit identified at time of analysis. EPSS is low (0.21%) and CISA SSVC records exploitation status as none, indicating no observed active abuse.
Privilege escalation in Google Chrome for Android before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out further by feeding a crafted HTML page into the Speech component, which fails to validate untrusted input (CWE-20). Google rated it Medium severity; a fix has shipped in the Stable channel, EPSS is low (0.21%, 11th percentile), and there is no public exploit identified at time of analysis. This is a sandbox-escape-class chaining bug rather than a standalone remote drive-by, since it presupposes a prior renderer compromise.
Remote code execution in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in the Ozone platform layer, allowing a remote attacker who lures a victim into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser context. Rated High by Chromium and CVSS 7.5, exploitation is gated by required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.26% (17th percentile).
Sandbox escape in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in Ozone, Chrome's platform abstraction layer for windowing and graphics. An attacker who has already compromised the renderer process can leverage a crafted HTML page to break out of the browser sandbox and gain code execution at the higher-privileged browser-process level. There is no public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a second-stage bug that requires a prior renderer compromise rather than a directly weaponizable single-shot flaw.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Journeys (browsing history) component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader code execution on the host via a crafted HTML page. Rated High severity by Chromium and CVSS 9.6, a fix is available from vendor; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Exploitation is meaningful only as the second stage of a chain, since it presupposes prior renderer compromise.
Discretionary access control bypass in Google Chrome for Android before 150.0.7871.47 lets a local attacker abuse the WebAppInstalls component through a crafted HTML page, undermining the platform's integrity and availability boundaries. Google rates the Chromium severity High and has shipped a fix in the Stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Access-control bypass in Google Chrome for Android before 150.0.7871.47 allows an attacker to subvert discretionary access controls through the WebAppInstalls component by serving a crafted HTML page, stemming from insufficient validation of untrusted input. Rated High by Chromium and scored CVSS 9.1, the flaw carries high integrity and availability impact but no confidentiality loss; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Sandboxed arbitrary code execution in Google Chrome for iOS before 150.0.7871.47 lets an attacker who convinces a user to open a malicious file run code inside the browser's sandbox due to insufficient validation of untrusted input. Google rates the Chromium severity High and ships the fix in 150.0.7871.47; EPSS is low (0.15%, 4th percentile) and there is no public exploit identified at time of analysis. The flaw requires user interaction (opening the file) and, per the description, the resulting execution is confined to the sandbox rather than the underlying OS.
Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows versions prior to 150.0.7871.47 allows a local attacker to break out of the browser sandbox by getting a victim to open a malicious file. Google rates the Chromium severity as High, and while a vendor patch is available, EPSS is low (0.13%) and CISA SSVC records no known exploitation, so this is no public exploit identified at time of analysis. The scope-changing, high-impact nature (full confidentiality, integrity and availability loss beyond the sandbox boundary) makes it a meaningful patch priority for Windows Chrome fleets despite requiring user interaction.