Monthly
Privilege escalation in the Contest Gallery WordPress plugin (versions ≤ 30.0.2) allows authenticated Contributor/Author-level users to overwrite the stored RegistryUserRole option to 'administrator', causing newly registered Google sign-in accounts to be promoted to Administrator. The flaw was disclosed by Wordfence and stems from a missing capability check in the option-saving handler; no public exploit identified at time of analysis.
Local privilege escalation in Google Android's telephony subsystem (PhoneInterfaceManager) allows attackers to disable carrier restrictions without any user interaction or additional execution privileges. The flaw stems from a logic error in the setAllowedCarriers handler and is addressed in the Android Security Bulletin for Android 17. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Local information disclosure in Android's MmsSmsProvider component allows installed applications to read sensitive SMS/MMS data without holding the required permissions. The flaw stems from a missing permission check inside MmsSmsProvider.java, enabling any local app to query the content provider and exfiltrate message data without user interaction. No public exploit identified at time of analysis, and the issue is addressed in the Android Security Bulletin for Android 17.
Local privilege escalation in Google Android's Telecomm component allows applications to initiate unauthorized phone calls by bypassing permission checks, with no user interaction required. The flaw is reported through the Android Security Bulletin for Android 17 and carries a CVSS 4.0 score of 10.0, though no public exploit identified at time of analysis. Despite the network-vector CVSS rating, the description characterizes this as local escalation of privilege, suggesting realistic exploitation requires a malicious app already installed on the device.
Local privilege escalation in Google Android's NFC subsystem stems from a use-after-free condition in Nfc::eventCallback() within Nfc.h, triggerable via a race condition without user interaction or additional execution privileges. Affected devices covered by the Android Security Bulletin for Android 17 can have an unprivileged local process win the race and elevate to higher-privileged context. No public exploit identified at time of analysis; the vulnerability was disclosed by Google through the Android security bulletin process.
Local privilege escalation in Google Android's NFC subsystem allows unprivileged local apps to gain special app access permissions without user interaction, due to an insecure default value in NfcDispatcher.tryStartActivity. Affected Android builds are covered by the Android Security Bulletin (android-17 reference). No public exploit identified at time of analysis; tagged as Privilege Escalation by the Android reporter.
Local privilege escalation in Google Android's NFC subsystem allows an unprivileged local app to spoof NFC events because of a missing permission check, granting capabilities normally reserved for privileged components. No user interaction is required, and no public exploit has been identified at time of analysis, though the issue is tracked in the Android Security Bulletin for Android 17. Despite the CVSS 4.0 vector encoding AV:N, the description clearly describes a local Android attack surface.
Local privilege escalation in Android's SettingsLib component stems from a missing permission check caused by a logic error, allowing on-device attackers to elevate privileges without user interaction or additional execution rights. No public exploit identified at time of analysis, and the issue is addressed in the Android Security Bulletin for Android 17. The CVSS 4.0 vector supplied (AV:N) conflicts with the description's 'local escalation' wording and should be treated as a discrepancy.
Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.transfer() that allows a local app to trigger memory exhaustion of the system package installer. The flaw, addressed in the Android Security Bulletin for Android 17, can be triggered without user interaction and without elevated privileges, but its impact is confined to denial of service rather than code execution. No public exploit identified at time of analysis.
Persistent denial of service in Google Android allows local attackers to exhaust device resources in multiple code paths, rendering functionality unavailable until manual intervention. The flaw requires no privileges and no user interaction, and is addressed in the Android Security Bulletin for android-17. No public exploit identified at time of analysis and no EPSS or KEV signal is provided.
Local privilege escalation in Google Android's Package Manager allows on-device attackers to bypass the device lock controller due to a missing permission check, with no user interaction required. The flaw, disclosed in the Android Security Bulletin for Android 17, carries a vendor CVSS 4.0 score of 10.0 but is described as a local escalation. No public exploit identified at time of analysis.
Local privilege escalation in Android's PackageInstallerService allows a malicious app to remove a Device Policy Controller (DPC) from a managed device without Device Owner consent, breaking the enterprise management boundary. The flaw stems from a desynchronization between in-memory state and persisted state in createSessionInternal, and no public exploit has been identified at time of analysis. User interaction is required, but no additional execution privileges are needed beyond installing the malicious app.
Local privilege escalation in Google Android 17's SettingsLib component allows a low-privileged local app to disable system components through a logic error, potentially elevating to higher privileges with no user interaction. The flaw is a CWE-269 improper privilege management issue reported through the Android Security Bulletin process, with no public exploit identified at time of analysis and a low EPSS of 0.13%. SSVC scores technical impact as total but exploitation as none, indicating a serious-if-reached but not currently exploited weakness.
Sandbox escape in Google Chrome on macOS before 149.0.7827.155 lets an attacker who has already compromised the renderer process abuse a race condition (CWE-362) in the Updater component to break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 8.3 and scope-changing impact, but exploitation requires a pre-existing renderer compromise plus user interaction, making it a second-stage bug rather than a single-shot RCE. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC lists exploitation as none.
Sandbox escape in Google Chrome's Extensions component (versions prior to 149.0.7827.155 on desktop) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it is a second-stage bug requiring a prior renderer compromise plus user interaction. There is no public exploit identified at time of analysis, EPSS is low (0.27%), and SSVC records exploitation status as none.
Remote code execution in Google Chrome on Windows (versions prior to 149.0.7827.155) allows a remote attacker to run arbitrary code within the browser process by luring a victim to a crafted HTML page that triggers a heap buffer overflow in the WebRTC component. Rated High severity by Chromium and scored CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis; EPSS is low at 0.40% and CISA SSVC records exploitation status as 'none'.
Sandbox escape in Google Chrome desktop prior to 149.0.7827.155 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, exploiting an object-lifecycle flaw in the Metrics component. It is a second-stage bug that turns renderer-level code execution into fuller compromise of the browser host, rated High by Chromium and scored CVSS 8.3. There is no public exploit identified at time of analysis, EPSS is low (0.30%, 21st percentile), and CISA/SSVC records no observed exploitation.
Sandbox escape in Google Chrome desktop before 149.0.7827.155 lets an attacker who has already compromised the renderer process leverage a use-after-free in the privileged Browser process to break out of the renderer sandbox via a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a second-stage exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS is low (0.27%), consistent with SSVC exploitation status of 'none'.
Arbitrary code execution in Google Chrome's Media component (versions prior to 149.0.7827.155) lets an attacker who has already compromised the renderer process run code within the sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 7.5, the flaw is a use-after-free (CWE-416); there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.37%, 28th percentile), consistent with the SSVC 'Exploitation: none' status. In practice it functions as a second-stage bug useful for extending a renderer foothold rather than an initial-access vulnerability.
Use-after-free in the Tab Strip component of Google Chrome before 149.0.7827.155 allows a remote attacker to trigger heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to code execution in the renderer. Google rated it High severity and a vendor patch is available, but no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.30% (21st percentile), and SSVC records exploitation status as none.
Sandbox escape in Google Chrome on macOS before 149.0.7827.155 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a race condition (CWE-362) in the Safe Browsing component. Rated High by Chromium with CVSS 8.3, it is a second-stage exploit-chain primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, CISA SSVC marks exploitation as none, and EPSS is low at 0.24% (15th percentile).
Heap corruption in the Downloads component of Google Chrome for Android before 149.0.7827.155 lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially achieving code execution in the renderer. Rated High severity by Chromium with an 8.8 CVSS, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.30%, 21st percentile), consistent with a patched browser bug not yet weaponized.
Sandbox escape in Google Chrome's DigitalCredentials component before 149.0.7827.155 lets a remote attacker who has already compromised the renderer process break out of the sandbox and gain broader host access via a crafted HTML page. Reported internally by Google's Chrome security team and rated High severity; no public exploit is identified at time of analysis, and EPSS remains low (0.27%, 19th percentile). CISA SSVC lists exploitation status as none, indicating no observed in-the-wild use despite total technical impact.
Local privilege escalation in Google Chrome for Windows before 149.0.7827.155 stems from a use-after-free in the Chromoting (Chrome Remote Desktop) component, letting a local attacker who convinces a user to open a malicious file execute code at OS-level privilege. Chromium rates the severity High and a vendor patch is available; currently there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (6th percentile). SSVC lists exploitation as none but technical impact as total.
Privilege escalation in Google Chrome's WebView component on Android (versions prior to 149.0.7827.155) allows a remote attacker to break out of intended privilege boundaries when a victim opens a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw yields high confidentiality, integrity, and availability impact but requires user interaction. No public exploit is identified at time of analysis, and the low EPSS (0.27%) plus SSVC 'Exploitation: none' indicate it is not currently being exploited despite the severe technical impact.
Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 149.0.7827.155) lets a remote attacker execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as High and a fixed Stable channel build is available; there is no public exploit identified at time of analysis, and the EPSS score of 0.36% (28th percentile) reflects low near-term exploitation probability. CISA's SSVC framework records exploitation status as 'none,' so this is patch-worthy but not yet an emergency.
Heap corruption in Google Chrome's Extensions component (versions prior to 149.0.7827.155) allows an attacker who convinces a victim to install a malicious extension to trigger a use-after-free and potentially achieve arbitrary code execution within the renderer or browser process. Rated High by Chromium and scored CVSS 7.5, the flaw was reported internally by the Chrome team and is patched in the stable channel; no public exploit identified at time of analysis and EPSS is low at 0.19%.
Remote code execution in Google Chrome (desktop) versions prior to 149.0.7827.155 stems from a use-after-free in the Web Authentication (WebAuthn) component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code. Chromium rates the flaw Critical severity; it carries CVSS 8.8 and requires user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and EPSS remains low at 0.44%, but the SSVC 'total' technical impact and the memory-corruption class make it a high-priority browser patch.
Remote code execution in Google Chrome on Android before 149.0.7827.155 stems from a use-after-free in the Passwords component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser process. Chromium rates the flaw Critical, though the assigned CVSS is 8.8; there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low at 0.39% (30th percentile), consistent with a patched, not-yet-exploited memory bug.
Heap corruption via use-after-free in Google Chrome's File Input component on Linux affects all versions prior to 149.0.7827.155, allowing a remote attacker to exploit memory corruption through a crafted HTML page that the victim visits. Chromium rates this Critical severity and a vendor patch is available; no public exploit has been identified at time of analysis and the SSVC framework records exploitation status as none. EPSS is low at 0.29% (21st percentile), consistent with a freshly patched, not-yet-weaponized browser flaw.
Sandbox escape in Google Chrome on Windows before 149.0.7827.155 stems from a use-after-free in the DigitalCredentials component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. Rated Critical by Chromium with a CVSS of 9.6 and a scope-changing vector, though there is no public exploit identified at time of analysis and EPSS remains low at 0.31%. Exploitation requires user interaction (visiting a malicious page) but no privileges or authentication.
Heap corruption in Google Chrome's Digital Credentials component (versions prior to 149.0.7827.155) allows remote attackers to trigger a use-after-free condition by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution within the renderer process. Chromium rates this issue as Critical severity, and Google has released a patched stable-channel build; no public exploit identified at time of analysis and EPSS sits at 0.31% (23rd percentile), indicating low predicted near-term exploitation pressure despite the high CVSS of 8.8.
Sandbox escape in Google Chrome for Android's WebView allows a remote attacker who has already compromised the renderer process to break out to the more privileged browser process via a crafted HTML page, in all versions prior to 149.0.7827.155. Rated Critical by Chromium and CVSS 8.3 (scope-changing) by NVD, it is a second-stage exploit primitive rather than a standalone entry point. No public exploit is identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome's WebShare component on Windows (versions before 149.0.7827.155) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a critical-severity use-after-free (CWE-416) rated CVSS 8.3; there is no public exploit identified at time of analysis, CISA SSVC lists exploitation status as none, and EPSS is low at 0.31%. It is a second-stage bug meant to be chained after an initial renderer compromise rather than a standalone remote takeover.
Unauthenticated server-side request forgery in Crawl4AI's Docker API server (versions < 0.8.9) lets remote attackers reach internal services and cloud-metadata endpoints by supplying a proxy address that bypasses the crawl-URL validation. Because the Docker API is unauthenticated by default and the SSRF check was only applied to the crawl target - not to the proxy destination - an attacker can route Chromium's egress through an internal IP (e.g. AWS IMDSv1 at 169.254.169.254) and read the response verbatim from the crawl result. No public exploit is identified at time of analysis, but the reporter supplied a working PoC and EPSS risk is low (0.29%, 20th percentile).
Universal cross-site scripting (UXSS) in Adobe Acrobat PDF Extension for Chrome (versions 26.5.2.2 and earlier) allows remote attackers to disclose cross-origin session data when a victim visits a malicious URL or interacts with a compromised page. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N indicates high confidentiality impact across security boundaries, and no public exploit identified at time of analysis. The flaw is browser-extension scoped, so impact is limited to users who have installed this Chrome extension.
Address bar spoofing in The Browser Company's Arc Search for Android allows remote attackers to render attacker-controlled content beneath a legitimate-looking URL in the address bar, enabling high-fidelity phishing against mobile users. The flaw maps to CWE-1021 (improper restriction of rendered UI layers) and carries a CVSS 7.4 due to the integrity impact on user trust decisions, though successful exploitation requires user interaction. No public exploit identified at time of analysis, but a HackerOne report (#3705306) suggests reproducible POC details exist within the disclosure program.
Remote code execution in the Android Modem component (per the Pixel 2026-06-01 security bulletin) is possible via an out-of-bounds write triggered without user interaction. Authenticated remote attackers (PR:L per CVSS) can corrupt memory to execute arbitrary code at the same privilege level as the Modem process. No public exploit identified at time of analysis, EPSS is low at 0.23% (13th percentile), and the issue is not listed in CISA KEV.
Remote code execution in Google Android's AudioSdpParser component (AudioSdpParser.cpp) allows attackers to corrupt memory through a type-confusion flaw (CWE-843) triggered while parsing SDP payloads in ParsePayloads, with no user interaction required. The bug affects Android across Pixel and AOSP-derived devices and is addressed in the June 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' with a low EPSS score of 0.23%, so risk is currently theoretical despite the total technical impact.
Out-of-bounds heap write in Android's native RTP stack (numberOfReportBlocks handling in RtpSession.cpp) allows a network-adjacent attacker to corrupt memory and achieve remote escalation of privilege without user interaction. The flaw stems from an integer overflow when counting RTCP report blocks, and it affects Android/Pixel builds prior to the June 2026 security patch level. There is no public exploit identified at time of analysis, EPSS risk is low (0.23%), and CISA has not listed it in KEV.
Remote code execution in Android's ImsMedia native stack stems from a missing bounds check in TextRtpPayloadDecoderNode::DecodeT140, where a crafted T.140 real-time text RTP payload triggers an out-of-bounds write (CWE-120). Any Android/Pixel device processing malicious RTP during an IMS RTT session can be compromised with no user interaction and, per the description, no additional execution privileges. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and SSVC records exploitation as none, indicating no observed in-the-wild activity despite total technical impact.
Remote denial of service in Android (Pixel) RTP stack arises from a missing null check in checkSsrcCollisionOnRcv within RtpSession.cpp, allowing unauthenticated attackers to crash the affected media component over the network. The flaw carries CVSS 7.5 with availability-only impact, and at the time of analysis there is no public exploit identified and the EPSS exploitation probability is very low (0.14%, 4th percentile).
Remote code execution in the cellular baseband (modem) firmware of Google Android/Pixel devices is possible through a memory-corruption flaw triggered while parsing a SIP REFER request, with no user interaction required. An attacker able to deliver a crafted SIP REFER message over the IMS/VoLTE signaling path can corrupt modem memory to crash the baseband or execute arbitrary code within the modem context. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records exploitation status as none, indicating no observed in-the-wild use.
Local privilege escalation in the Android kernel's msg_to_host_buffer.cc component allows a low-privileged local process to corrupt memory via an out-of-bounds write, gaining elevated privileges without user interaction. The flaw stems from an incorrect bounds check on a host buffer write path and carries a CVSS 7.8 (High) rating with total technical impact. No public exploit has been identified at time of analysis, and CISA's SSVC framework marks exploitation as none, consistent with the very low EPSS score (0.11%).
Local privilege escalation in the Android kernel affects Pixel and other Android devices through a logic error in OSMMapPMRGeneric within pmr_os.c, the PowerVR/Imagination-style PMR (Physical Memory Resource) memory-management code. A local attacker chaining system calls can maliciously expand a Virtual Memory Area (VMA) out of bounds, corrupting kernel memory to gain root-equivalent privileges. Rated CVSS 7.8 with no public exploit identified at time of analysis; EPSS is 0.07% and CISA SSVC reports no observed exploitation, indicating this is a patched-early, not-yet-weaponized issue.
Remote code execution in Android's RTP/RTCP media stack (RtpSession::rtpSendRtcpPacket) allows a remote peer to trigger a CWE-122 heap buffer overflow and gain arbitrary code execution within the affected media/telephony component without user interaction. Addressed in the June 2026 Android/Pixel security bulletin, the flaw carries total technical impact (SSVC) and CVSS 8.8, though CISA SSVC currently records exploitation status as 'none' and EPSS is low at 0.28% (19th percentile). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds read in the cellular Modem (baseband) of Google Pixel/Android devices allows an unauthenticated attacker within cellular radio range to crash the modem by sending a crafted radio-layer or signaling message, causing loss of cellular connectivity (denial of service). The flaw is a missing bounds check during message parsing (CWE-125) and requires no user interaction; only availability is impacted, with no code execution, privilege gain, or data disclosure. No public exploit code identified at time of analysis; EPSS is low at 0.25% and CISA SSVC shows no active exploitation.
Remote code execution in the WC-Radio component on Google Android (Pixel) devices allows network-adjacent attackers to corrupt memory via an out-of-bounds write with no authentication or user interaction. The flaw carries a CVSS 9.8 rating and is addressed in the Pixel security bulletin dated 2026-06-01; no public exploit identified at time of analysis and EPSS is low at 0.15%.
Remote code execution in Vitest Browser Mode (npm @vitest/browser 3.0.0-3.2.4, 4.0.0-4.1.7, 5.0.0-beta.0-5.0.0-beta.3) allows remote attackers to overwrite the project's vite.config.ts and execute arbitrary Node.js code on the host when the browser API server is bound to a network-reachable interface (e.g. --browser.api.host=0.0.0.0). The flaw stems from the cdp() API forwarding raw Chrome DevTools Protocol calls over the browser WebSocket RPC without honoring the allowWrite/allowExec gates that normally restrict Browser Mode. Publicly available exploit code exists in the GHSA-g8mr-85jm-7xhm advisory's step-by-step reproduction, though no CISA KEV listing has been issued.
Denial of service in protobuf.js occurs when untrusted protobuf binary data containing deeply nested google.protobuf.Any values is converted to JSON, leading to stack overflow. This affects applications using affected versions (≤7.6.0 and 8.0.0–8.4.0) that decode user-controlled protobuf and then trigger JSON conversion. At time of analysis, no public exploit is identified, and CISA KEV does not list this issue.
Sensitive header leakage in @angular/service-worker allows remote attackers to capture Authorization tokens, Proxy-Authorization credentials, and session cookies when a credentialed asset fetch is redirected cross-origin, because the worker preserved request headers instead of stripping them per the Fetch redirect algorithm. Affected versions span Angular 20.x, 21.x, and 22.x prereleases (and all 19.x and earlier), and no public exploit identified at time of analysis. The flaw was discovered by Google DeepMind's CodeMender and patched in 22.0.1, 21.2.17, and 20.3.25.
Cache key collision in Angular's @angular/common HttpTransferCache allows remote attackers to poison Server-Side Rendering (SSR) cache entries and replace responses for sensitive endpoints with attacker-controlled content. The weak 32-bit DJB2-like polynomial rolling hash used for TransferState cache keys is trivially brute-forceable, enabling state poisoning, DOM-based XSS, and information leakage when a victim follows a crafted link. No public exploit identified at time of analysis, but the vulnerability was discovered and reported by Google DeepMind's CodeMender and is patched in Angular 22.0.1, 21.2.17, and 20.3.25.
Denial of service in Angular's @angular/common package allows attackers to exhaust CPU and memory by passing crafted digitsInfo strings (e.g., '1.200000000-200000000') to formatNumber, DecimalPipe, PercentPipe, or CurrencyPipe. On SSR deployments this crashes the Node.js process with a heap-out-of-memory error, while client-side rendering freezes the browser tab. No public exploit identified at time of analysis, though the patched code and triggering input strings are documented in PR #68840.
Local privilege escalation in Microvirt MEmu Android Emulator 9.2.7.0 allows a low-privileged local user to abuse the MemuService.exe component to gain elevated rights on the host Windows system. Mapped to CWE-269 (Improper Privilege Management), with no public exploit identified at time of analysis and an EPSS score of 0.21% indicating low predicted exploitation likelihood. Researcher PoC repository exists on GitHub (sec-zone/CVE-2026-36213) but active exploitation has not been reported.
Missing Origin/Host header validation in Google's MCP Toolbox for Databases (Model Context Protocol server) prior to v0.25.0 allows remote attackers to reach the locally-bound HTTP server via DNS rebinding from a victim's browser, abusing the bridge to issue arbitrary tool/database commands. The fix introduces a new --allowed-hosts startup flag (companion to the existing --allowed-origins) that validates inbound Host headers, though both flags retain an insecure-by-default '*' value with only a startup warning. No public exploit identified at time of analysis; the issue was reported internally by Google.
Improper access control in File Browser (filebrowser/filebrowser, Go) versions <= 2.63.6 lets a user with share/download permissions create a public share for a path that does not yet exist; because the share record stores only a path string and is never bound to a concrete object, the link silently begins exposing whatever file later appears at that path via GET /api/public/dl/<hash>. The flaw mirrors the Android MediaProvider issue CVE-2026-0035 — the create handler omits an existence check before persisting the share. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, but a step-by-step PoC is included in the GitHub Security Advisory.
Stored cross-site scripting in the @apostrophecms/seo plugin (versions ≤1.4.2) allows any user holding the default editor role to inject arbitrary JavaScript that executes in every visitor's browser. The seoGoogleTrackingId and seoGoogleTagManager fields are interpolated directly into inline <script> tag bodies via template literals with no sanitization, turning legitimate analytics configuration into a persistent payload delivery channel. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler for a custom URL scheme, allowing a remote attacker to elevate privileges over network access. The CVSS 8.1 rating reflects high confidentiality and integrity impact with low-complexity exploitation, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Privilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler that processes the app's custom URL scheme, allowing an unauthenticated actor to elevate privileges via network access. Zoom self-reported and patched the flaw, and no public exploit identified at time of analysis; EPSS remains very low (0.04%, 12th percentile) and CISA SSVC marks exploitation as none, indicating no observed activity despite the 9.8 CVSS score.
Hard-coded cryptographic keys in the Aqara Home Android app (com.lumiunited.aqarahome) 6.0.0 and white-label clients embedding the same liblumidevsdk.so let attackers who extract the static keys from the shipped binary decrypt protected data and forge or tamper with device/cloud communications. Because every install ships the identical embedded keys, a single extraction compromises confidentiality and integrity across the entire installed base. Reported by runZero (CVE-2026-50091 / EUVD-2026-36481); publicly available exploit code exists (GitHub PoC 'theres-no-place-like-home'), but it is not on CISA KEV and EPSS is very low at 0.03%.
Hard-coded MQTT broker credentials in Yarbo Android and iOS applications allow remote unauthenticated attackers to subscribe to and publish on the cloud MQTT brokers serving the entire global Yarbo robot fleet. Because the credentials are identical across all users and devices and trivially extractable via APK decompilation, anyone knowing a target robot's serial number can read its telemetry or send arbitrary commands. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and CISA ICS advisory reflect the systemic, fleet-wide nature of the exposure.
Origin validation failure in CyberArk's Idira Identity Browser Extension for Chrome, Firefox, and Edge (versions prior to 26.8.1) allows a remote attacker to abuse an authenticated user's browser session by luring them to a malicious page. Per CyberArk bulletin CA26-21, the extension's internal web-page verification routine fails to correctly enforce origin checks (CWE-346), enabling unauthorized application interaction in the victim's identity context. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high confidentiality impact and subsequent-system impact via the identity SaaS the extension brokers.
Heap corruption in Google Chrome's Views UI framework on Windows (versions prior to 149.0.7827.115) lets a remote attacker exploit a use-after-free by luring a victim to a crafted HTML page. Google rates the Chromium severity High, and the CVSS 8.8 vector reflects full compromise of the renderer/browser process, though exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and EPSS is very low (0.03%), indicating no observed weaponization yet.
Sandbox escape in Google Chrome on Linux (versions prior to 149.0.7827.115) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a malicious file, through insufficient input validation in the Linux Toolkit (GTK) Theming component. Rated High severity by Chromium and CVSS 8.3, this is a second-stage escalation primitive rather than an initial entry point. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%, 21st percentile), with CISA SSVC scoring exploitation as 'none'.
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox via a crafted HTML page abusing the Views UI framework. Chromium rates the severity High, and no public exploit is identified at time of analysis, but sandbox-escape primitives are routinely chained with renderer RCE bugs into full browser compromise on Windows endpoints.
Sandbox escape in Google Chrome on Android prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox through a heap-based out-of-bounds write in the GPU process triggered by a crafted HTML page. Chromium rates the severity High and a vendor patch is available, but no public exploit has been identified at time of analysis. The CVSS 8.3 score reflects the chained nature of the attack (compromised renderer required) combined with full impact across confidentiality, integrity, and availability.
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.115 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the Video component. Rated High by Chromium and CVSS 8.3 with a scope change (S:C), it requires user interaction (visiting a malicious page) and is typically the second stage of a full RCE chain. There is no public exploit identified at time of analysis, and the low EPSS score (0.07%, 21st percentile) plus SSVC 'Exploitation: none' indicate no observed in-the-wild activity yet.
Sandbox escape in the GPU process of Google Chrome for Android before 149.0.7827.115 lets a remote attacker who has already compromised the renderer process break out of the sandbox and potentially achieve code execution in a higher-privileged context via a crafted HTML page. This is a memory-corruption (use-after-free) bug rated High by Chromium and fixed in the June 2026 stable channel; there is no public exploit identified at time of analysis and EPSS is very low (0.07%), but the total technical impact makes it a meaningful second-stage primitive in a browser exploit chain.
Sandbox escape in Google Chrome prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the Headless component sandbox via a crafted HTML page. The flaw is rated High severity by Chromium and carries CVSS 9.6 due to scope change and user interaction, though EPSS remains very low (0.03%) and there is no public exploit identified at time of analysis. A vendor patch is available in the stable channel update published June 2026.
Sandbox escape in Google Chrome on macOS (versions prior to 149.0.7827.115) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the GPU component. This is a chain-stage bug rather than a standalone entry point - it presumes prior renderer compromise - and Google rates the Chromium severity as High. No public exploit identified at time of analysis, and the EPSS probability is low (0.07%, 21st percentile).
Sandbox escape in Google Chrome on macOS prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a race condition in Safe Browsing handling of a malicious file. Chromium rates the issue High severity and a vendor patch is available, though no public exploit has been identified at time of analysis.
Heap corruption in Google Chrome's Autofill component on macOS (versions prior to 149.0.7827.115) lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer. Google rates the Chromium severity as High and has shipped a fix in the stable channel. There is no public exploit identified at time of analysis, and EPSS is very low at 0.07%.
Sandbox escape in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a heap buffer overflow in the Codecs component triggered by a crafted HTML page. Google rates the underlying issue as High severity and a vendor patch is available, but no public exploit is identified at time of analysis and the bug is not listed in CISA KEV. Exploitation is conditional on chaining with a prior renderer compromise, which raises real-world complexity.
Local privilege escalation in Google Chrome on Windows prior to 149.0.7827.115 stems from an inappropriate implementation in the Mojo IPC layer, allowing a local attacker who can place a malicious file on the system to elevate to OS-level privileges. The flaw is rated High severity by Chromium and carries CVSS 8.8, with a vendor patch available and no public exploit identified at time of analysis.
Sandbox escape in Google Chrome's DevTools component before version 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.3, this is a second-stage vulnerability typically chained with a renderer RCE bug. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's Cast component (versions prior to 149.0.7827.115) lets an attacker positioned on the same local network segment corrupt memory via crafted network traffic and potentially break out of the renderer sandbox. Rated High by Chromium with a CVSS 8.3 (scope-changed, total impact), it is patched in the June 2026 Stable channel. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but a successful escape yields total control over the affected process.
Heap corruption via a use-after-free in the Media component of Google Chrome on Windows before 149.0.7827.115 allows a remote attacker to potentially achieve code execution when a victim opens a crafted HTML page. Rated High by Chromium with CVSS 8.8, it requires user interaction (loading a malicious page) but no authentication. There is no public exploit identified at time of analysis, EPSS is low (0.07%), and CISA SSVC lists exploitation as none.
Heap corruption in Google Chrome's Network component (versions prior to 149.0.7827.115) allows an attacker in a privileged network position to trigger a use-after-free via malicious network traffic, potentially leading to memory corruption and code execution within the browser process. Google rates the Chromium severity as High, and a fixed stable-channel build is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%), while CISA's SSVC framework records exploitation status as none.
Use-after-free in Chrome's WebMIDI implementation on Windows lets a remote attacker who has already compromised the renderer process escape the sandbox via a crafted HTML page, elevating a renderer-level foothold toward host-level control. Rated Critical by Chromium and affecting all Chrome builds prior to 149.0.7827.115, the flaw has a patch available from Google but shows no public exploit identified at time of analysis and a very low EPSS of 0.06%.
Sandbox escape in Google Chrome on Android prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a heap buffer overflow in the GPU process. Chromium rates this severity Critical, and while no public exploit identified at time of analysis, the bug is part of a classic two-stage exploitation chain typically used in browser zero-day exploits. Patch is available from vendor in Chrome 149.0.7827.115 and later.
Sandbox escape in Google Chrome on macOS prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that exercises the Accessibility subsystem. Chromium rates the issue Critical severity; no public exploit identified at time of analysis, and the flaw is not on the CISA KEV list. The bug is reachable only after a prior renderer compromise and requires user interaction, which limits drive-by exploitation but makes it a key second-stage primitive in a full browser chain.
Sandbox escape in Google Chrome's DigitalCredentials component (versions prior to 149.0.7827.115) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, it is a use-after-free memory-corruption bug used as the second stage of an exploit chain. There is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is very low (0.07%), consistent with a fix shipped before disclosure.
Remote code execution in Google Chrome on Windows prior to 149.0.7827.115 allows remote attackers to trigger a use-after-free condition in the Core component via a crafted HTML page, leading to arbitrary code execution within the renderer process. Chromium rates the severity as Critical, and no public exploit has been identified at time of analysis, but the bug class (UAF in Core) is historically a frequent target for in-the-wild exploitation against Chrome. The vulnerability requires the victim to visit attacker-controlled content (UI:R).
Information disclosure in Element Call 0.5.17 through 0.19.3 causes the application to send full visited URLs (including URL fragments) to a configured PostHog analytics server via the `$initial_person_info`, `$session_entry_url`, and `$current_url` fields. On standalone SPA deployments such as call.element.io that encode call encryption passwords in the URL fragment, this can leak those passwords to anyone with access to the PostHog data, enabling decryption of the associated E2EE media streams. No public exploit identified at time of analysis; the issue was disclosed and patched by the vendor in 0.19.4.
Privilege escalation in Google Cloud Dialogflow CX allows authenticated users holding specific IAM roles to abuse the playbook import functionality and potentially take over the entire GCP project. Google has confirmed the issue was patched server-side on 15 March 2026 with no customer action required, and no public exploit has been identified at time of analysis.
Cross-site request forgery in the Nezha monitoring dashboard (versions >= 1.0.0, < 2.0.14) allows remote attackers to force a logged-in user's browser to trigger any of the victim's existing cron tasks via a GET navigation to /api/v1/cron/:id/manual, causing the stored command to be dispatched to the victim's online agents. The flaw stems from a state-changing GET endpoint protected only by a SameSite=Lax JWT cookie with no CSRF token, Origin/Referer check, or Fetch Metadata guard. No public exploit identified at time of analysis beyond the reporter's safe Go-test proof; the issue is not in CISA KEV.
Detection bypass in @hulumi/policies versions prior to 1.4.0 allows IAM trust policies that list multiple OIDC federated providers to evade the G_OIDC_1 and G_OIDC_2 policy checks for GitHub Actions OIDC roles. Consumers of HulumiHardeningPack or HulumiGithubHardeningPack can therefore ship roles with wildcard sub: conditions - assumable by untrusted forked-PR workflows - while the validator falsely reports compliance, including missing the AdministratorAccess blast-radius flag. No public exploit identified at time of analysis, and there is no CISA KEV listing.
Local spoofing in Microsoft Office for Android lets an unauthorized attacker manipulate trust-affecting content or identity indicators after a user interacts with malicious input on the device. The CVSS 7.1 score reflects high confidentiality and integrity impact with no special privileges required, though the local attack vector and required user interaction limit remote exploitability. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Information disclosure in Microsoft Teams for Android allows an authenticated remote attacker to extract sensitive data via an injection flaw (CWE-74) in output passed to a downstream component. The CVSS 8.1 rating reflects high confidentiality and availability impact over the network with low privileges and no user interaction, though no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Sandbox escape in Google Chrome prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a use-after-free flaw in the Tracing component, triggered through a crafted HTML page. No public exploit identified at time of analysis, and SSVC indicates exploitation status is 'none', but the technical impact is rated total because a successful escape grants code execution at browser-process privileges. Google has shipped a fix and rates the underlying Chromium severity as Medium, while the assigned CVSS is 8.3 due to scope change and high CIA impact.
Privilege escalation in the Contest Gallery WordPress plugin (versions ≤ 30.0.2) allows authenticated Contributor/Author-level users to overwrite the stored RegistryUserRole option to 'administrator', causing newly registered Google sign-in accounts to be promoted to Administrator. The flaw was disclosed by Wordfence and stems from a missing capability check in the option-saving handler; no public exploit identified at time of analysis.
Local privilege escalation in Google Android's telephony subsystem (PhoneInterfaceManager) allows attackers to disable carrier restrictions without any user interaction or additional execution privileges. The flaw stems from a logic error in the setAllowedCarriers handler and is addressed in the Android Security Bulletin for Android 17. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.
Local information disclosure in Android's MmsSmsProvider component allows installed applications to read sensitive SMS/MMS data without holding the required permissions. The flaw stems from a missing permission check inside MmsSmsProvider.java, enabling any local app to query the content provider and exfiltrate message data without user interaction. No public exploit identified at time of analysis, and the issue is addressed in the Android Security Bulletin for Android 17.
Local privilege escalation in Google Android's Telecomm component allows applications to initiate unauthorized phone calls by bypassing permission checks, with no user interaction required. The flaw is reported through the Android Security Bulletin for Android 17 and carries a CVSS 4.0 score of 10.0, though no public exploit identified at time of analysis. Despite the network-vector CVSS rating, the description characterizes this as local escalation of privilege, suggesting realistic exploitation requires a malicious app already installed on the device.
Local privilege escalation in Google Android's NFC subsystem stems from a use-after-free condition in Nfc::eventCallback() within Nfc.h, triggerable via a race condition without user interaction or additional execution privileges. Affected devices covered by the Android Security Bulletin for Android 17 can have an unprivileged local process win the race and elevate to higher-privileged context. No public exploit identified at time of analysis; the vulnerability was disclosed by Google through the Android security bulletin process.
Local privilege escalation in Google Android's NFC subsystem allows unprivileged local apps to gain special app access permissions without user interaction, due to an insecure default value in NfcDispatcher.tryStartActivity. Affected Android builds are covered by the Android Security Bulletin (android-17 reference). No public exploit identified at time of analysis; tagged as Privilege Escalation by the Android reporter.
Local privilege escalation in Google Android's NFC subsystem allows an unprivileged local app to spoof NFC events because of a missing permission check, granting capabilities normally reserved for privileged components. No user interaction is required, and no public exploit has been identified at time of analysis, though the issue is tracked in the Android Security Bulletin for Android 17. Despite the CVSS 4.0 vector encoding AV:N, the description clearly describes a local Android attack surface.
Local privilege escalation in Android's SettingsLib component stems from a missing permission check caused by a logic error, allowing on-device attackers to elevate privileges without user interaction or additional execution rights. No public exploit identified at time of analysis, and the issue is addressed in the Android Security Bulletin for Android 17. The CVSS 4.0 vector supplied (AV:N) conflicts with the description's 'local escalation' wording and should be treated as a discrepancy.
Local denial of service in Android's PackageInstaller subsystem stems from a logic error in PackageInstallerSession.transfer() that allows a local app to trigger memory exhaustion of the system package installer. The flaw, addressed in the Android Security Bulletin for Android 17, can be triggered without user interaction and without elevated privileges, but its impact is confined to denial of service rather than code execution. No public exploit identified at time of analysis.
Persistent denial of service in Google Android allows local attackers to exhaust device resources in multiple code paths, rendering functionality unavailable until manual intervention. The flaw requires no privileges and no user interaction, and is addressed in the Android Security Bulletin for android-17. No public exploit identified at time of analysis and no EPSS or KEV signal is provided.
Local privilege escalation in Google Android's Package Manager allows on-device attackers to bypass the device lock controller due to a missing permission check, with no user interaction required. The flaw, disclosed in the Android Security Bulletin for Android 17, carries a vendor CVSS 4.0 score of 10.0 but is described as a local escalation. No public exploit identified at time of analysis.
Local privilege escalation in Android's PackageInstallerService allows a malicious app to remove a Device Policy Controller (DPC) from a managed device without Device Owner consent, breaking the enterprise management boundary. The flaw stems from a desynchronization between in-memory state and persisted state in createSessionInternal, and no public exploit has been identified at time of analysis. User interaction is required, but no additional execution privileges are needed beyond installing the malicious app.
Local privilege escalation in Google Android 17's SettingsLib component allows a low-privileged local app to disable system components through a logic error, potentially elevating to higher privileges with no user interaction. The flaw is a CWE-269 improper privilege management issue reported through the Android Security Bulletin process, with no public exploit identified at time of analysis and a low EPSS of 0.13%. SSVC scores technical impact as total but exploitation as none, indicating a serious-if-reached but not currently exploited weakness.
Sandbox escape in Google Chrome on macOS before 149.0.7827.155 lets an attacker who has already compromised the renderer process abuse a race condition (CWE-362) in the Updater component to break out of the sandbox via a crafted HTML page. Rated High by Chromium with a CVSS 8.3 and scope-changing impact, but exploitation requires a pre-existing renderer compromise plus user interaction, making it a second-stage bug rather than a single-shot RCE. No public exploit identified at time of analysis; EPSS is low (0.27%) and CISA SSVC lists exploitation as none.
Sandbox escape in Google Chrome's Extensions component (versions prior to 149.0.7827.155 on desktop) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free (CWE-416). Rated High by Chromium and CVSS 8.3, it is a second-stage bug requiring a prior renderer compromise plus user interaction. There is no public exploit identified at time of analysis, EPSS is low (0.27%), and SSVC records exploitation status as none.
Remote code execution in Google Chrome on Windows (versions prior to 149.0.7827.155) allows a remote attacker to run arbitrary code within the browser process by luring a victim to a crafted HTML page that triggers a heap buffer overflow in the WebRTC component. Rated High severity by Chromium and scored CVSS 8.8, it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis; EPSS is low at 0.40% and CISA SSVC records exploitation status as 'none'.
Sandbox escape in Google Chrome desktop prior to 149.0.7827.155 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, exploiting an object-lifecycle flaw in the Metrics component. It is a second-stage bug that turns renderer-level code execution into fuller compromise of the browser host, rated High by Chromium and scored CVSS 8.3. There is no public exploit identified at time of analysis, EPSS is low (0.30%, 21st percentile), and CISA/SSVC records no observed exploitation.
Sandbox escape in Google Chrome desktop before 149.0.7827.155 lets an attacker who has already compromised the renderer process leverage a use-after-free in the privileged Browser process to break out of the renderer sandbox via a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a second-stage exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS is low (0.27%), consistent with SSVC exploitation status of 'none'.
Arbitrary code execution in Google Chrome's Media component (versions prior to 149.0.7827.155) lets an attacker who has already compromised the renderer process run code within the sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 7.5, the flaw is a use-after-free (CWE-416); there is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.37%, 28th percentile), consistent with the SSVC 'Exploitation: none' status. In practice it functions as a second-stage bug useful for extending a renderer foothold rather than an initial-access vulnerability.
Use-after-free in the Tab Strip component of Google Chrome before 149.0.7827.155 allows a remote attacker to trigger heap corruption when a victim visits a crafted HTML page and performs specific UI gestures, potentially leading to code execution in the renderer. Google rated it High severity and a vendor patch is available, but no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.30% (21st percentile), and SSVC records exploitation status as none.
Sandbox escape in Google Chrome on macOS before 149.0.7827.155 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a race condition (CWE-362) in the Safe Browsing component. Rated High by Chromium with CVSS 8.3, it is a second-stage exploit-chain primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, CISA SSVC marks exploitation as none, and EPSS is low at 0.24% (15th percentile).
Heap corruption in the Downloads component of Google Chrome for Android before 149.0.7827.155 lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially achieving code execution in the renderer. Rated High severity by Chromium with an 8.8 CVSS, but there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low (0.30%, 21st percentile), consistent with a patched browser bug not yet weaponized.
Sandbox escape in Google Chrome's DigitalCredentials component before 149.0.7827.155 lets a remote attacker who has already compromised the renderer process break out of the sandbox and gain broader host access via a crafted HTML page. Reported internally by Google's Chrome security team and rated High severity; no public exploit is identified at time of analysis, and EPSS remains low (0.27%, 19th percentile). CISA SSVC lists exploitation status as none, indicating no observed in-the-wild use despite total technical impact.
Local privilege escalation in Google Chrome for Windows before 149.0.7827.155 stems from a use-after-free in the Chromoting (Chrome Remote Desktop) component, letting a local attacker who convinces a user to open a malicious file execute code at OS-level privilege. Chromium rates the severity High and a vendor patch is available; currently there is no public exploit identified at time of analysis, and EPSS is low at 0.17% (6th percentile). SSVC lists exploitation as none but technical impact as total.
Privilege escalation in Google Chrome's WebView component on Android (versions prior to 149.0.7827.155) allows a remote attacker to break out of intended privilege boundaries when a victim opens a crafted HTML page. Rated High by Chromium with a CVSS of 8.8, the flaw yields high confidentiality, integrity, and availability impact but requires user interaction. No public exploit is identified at time of analysis, and the low EPSS (0.27%) plus SSVC 'Exploitation: none' indicate it is not currently being exploited despite the severe technical impact.
Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 149.0.7827.155) lets a remote attacker execute arbitrary code inside the browser's renderer sandbox by luring a victim to a crafted HTML page. Google rates the Chromium severity as High and a fixed Stable channel build is available; there is no public exploit identified at time of analysis, and the EPSS score of 0.36% (28th percentile) reflects low near-term exploitation probability. CISA's SSVC framework records exploitation status as 'none,' so this is patch-worthy but not yet an emergency.
Heap corruption in Google Chrome's Extensions component (versions prior to 149.0.7827.155) allows an attacker who convinces a victim to install a malicious extension to trigger a use-after-free and potentially achieve arbitrary code execution within the renderer or browser process. Rated High by Chromium and scored CVSS 7.5, the flaw was reported internally by the Chrome team and is patched in the stable channel; no public exploit identified at time of analysis and EPSS is low at 0.19%.
Remote code execution in Google Chrome (desktop) versions prior to 149.0.7827.155 stems from a use-after-free in the Web Authentication (WebAuthn) component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code. Chromium rates the flaw Critical severity; it carries CVSS 8.8 and requires user interaction (visiting a malicious page). No public exploit is identified at time of analysis, and EPSS remains low at 0.44%, but the SSVC 'total' technical impact and the memory-corruption class make it a high-priority browser patch.
Remote code execution in Google Chrome on Android before 149.0.7827.155 stems from a use-after-free in the Passwords component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser process. Chromium rates the flaw Critical, though the assigned CVSS is 8.8; there is no public exploit identified at time of analysis and CISA SSVC records exploitation status as none. EPSS is low at 0.39% (30th percentile), consistent with a patched, not-yet-exploited memory bug.
Heap corruption via use-after-free in Google Chrome's File Input component on Linux affects all versions prior to 149.0.7827.155, allowing a remote attacker to exploit memory corruption through a crafted HTML page that the victim visits. Chromium rates this Critical severity and a vendor patch is available; no public exploit has been identified at time of analysis and the SSVC framework records exploitation status as none. EPSS is low at 0.29% (21st percentile), consistent with a freshly patched, not-yet-weaponized browser flaw.
Sandbox escape in Google Chrome on Windows before 149.0.7827.155 stems from a use-after-free in the DigitalCredentials component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and potentially break out of the renderer sandbox. Rated Critical by Chromium with a CVSS of 9.6 and a scope-changing vector, though there is no public exploit identified at time of analysis and EPSS remains low at 0.31%. Exploitation requires user interaction (visiting a malicious page) but no privileges or authentication.
Heap corruption in Google Chrome's Digital Credentials component (versions prior to 149.0.7827.155) allows remote attackers to trigger a use-after-free condition by enticing a user to visit a crafted HTML page, potentially leading to arbitrary code execution within the renderer process. Chromium rates this issue as Critical severity, and Google has released a patched stable-channel build; no public exploit identified at time of analysis and EPSS sits at 0.31% (23rd percentile), indicating low predicted near-term exploitation pressure despite the high CVSS of 8.8.
Sandbox escape in Google Chrome for Android's WebView allows a remote attacker who has already compromised the renderer process to break out to the more privileged browser process via a crafted HTML page, in all versions prior to 149.0.7827.155. Rated Critical by Chromium and CVSS 8.3 (scope-changing) by NVD, it is a second-stage exploit primitive rather than a standalone entry point. No public exploit is identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.29% (21st percentile).
Sandbox escape in Google Chrome's WebShare component on Windows (versions before 149.0.7827.155) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. The flaw is a critical-severity use-after-free (CWE-416) rated CVSS 8.3; there is no public exploit identified at time of analysis, CISA SSVC lists exploitation status as none, and EPSS is low at 0.31%. It is a second-stage bug meant to be chained after an initial renderer compromise rather than a standalone remote takeover.
Unauthenticated server-side request forgery in Crawl4AI's Docker API server (versions < 0.8.9) lets remote attackers reach internal services and cloud-metadata endpoints by supplying a proxy address that bypasses the crawl-URL validation. Because the Docker API is unauthenticated by default and the SSRF check was only applied to the crawl target - not to the proxy destination - an attacker can route Chromium's egress through an internal IP (e.g. AWS IMDSv1 at 169.254.169.254) and read the response verbatim from the crawl result. No public exploit is identified at time of analysis, but the reporter supplied a working PoC and EPSS risk is low (0.29%, 20th percentile).
Universal cross-site scripting (UXSS) in Adobe Acrobat PDF Extension for Chrome (versions 26.5.2.2 and earlier) allows remote attackers to disclose cross-origin session data when a victim visits a malicious URL or interacts with a compromised page. The CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N indicates high confidentiality impact across security boundaries, and no public exploit identified at time of analysis. The flaw is browser-extension scoped, so impact is limited to users who have installed this Chrome extension.
Address bar spoofing in The Browser Company's Arc Search for Android allows remote attackers to render attacker-controlled content beneath a legitimate-looking URL in the address bar, enabling high-fidelity phishing against mobile users. The flaw maps to CWE-1021 (improper restriction of rendered UI layers) and carries a CVSS 7.4 due to the integrity impact on user trust decisions, though successful exploitation requires user interaction. No public exploit identified at time of analysis, but a HackerOne report (#3705306) suggests reproducible POC details exist within the disclosure program.
Remote code execution in the Android Modem component (per the Pixel 2026-06-01 security bulletin) is possible via an out-of-bounds write triggered without user interaction. Authenticated remote attackers (PR:L per CVSS) can corrupt memory to execute arbitrary code at the same privilege level as the Modem process. No public exploit identified at time of analysis, EPSS is low at 0.23% (13th percentile), and the issue is not listed in CISA KEV.
Remote code execution in Google Android's AudioSdpParser component (AudioSdpParser.cpp) allows attackers to corrupt memory through a type-confusion flaw (CWE-843) triggered while parsing SDP payloads in ParsePayloads, with no user interaction required. The bug affects Android across Pixel and AOSP-derived devices and is addressed in the June 2026 Android/Pixel security bulletin. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none' with a low EPSS score of 0.23%, so risk is currently theoretical despite the total technical impact.
Out-of-bounds heap write in Android's native RTP stack (numberOfReportBlocks handling in RtpSession.cpp) allows a network-adjacent attacker to corrupt memory and achieve remote escalation of privilege without user interaction. The flaw stems from an integer overflow when counting RTCP report blocks, and it affects Android/Pixel builds prior to the June 2026 security patch level. There is no public exploit identified at time of analysis, EPSS risk is low (0.23%), and CISA has not listed it in KEV.
Remote code execution in Android's ImsMedia native stack stems from a missing bounds check in TextRtpPayloadDecoderNode::DecodeT140, where a crafted T.140 real-time text RTP payload triggers an out-of-bounds write (CWE-120). Any Android/Pixel device processing malicious RTP during an IMS RTT session can be compromised with no user interaction and, per the description, no additional execution privileges. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and SSVC records exploitation as none, indicating no observed in-the-wild activity despite total technical impact.
Remote denial of service in Android (Pixel) RTP stack arises from a missing null check in checkSsrcCollisionOnRcv within RtpSession.cpp, allowing unauthenticated attackers to crash the affected media component over the network. The flaw carries CVSS 7.5 with availability-only impact, and at the time of analysis there is no public exploit identified and the EPSS exploitation probability is very low (0.14%, 4th percentile).
Remote code execution in the cellular baseband (modem) firmware of Google Android/Pixel devices is possible through a memory-corruption flaw triggered while parsing a SIP REFER request, with no user interaction required. An attacker able to deliver a crafted SIP REFER message over the IMS/VoLTE signaling path can corrupt modem memory to crash the baseband or execute arbitrary code within the modem context. There is no public exploit identified at time of analysis, EPSS is low (0.23%), and CISA SSVC records exploitation status as none, indicating no observed in-the-wild use.
Local privilege escalation in the Android kernel's msg_to_host_buffer.cc component allows a low-privileged local process to corrupt memory via an out-of-bounds write, gaining elevated privileges without user interaction. The flaw stems from an incorrect bounds check on a host buffer write path and carries a CVSS 7.8 (High) rating with total technical impact. No public exploit has been identified at time of analysis, and CISA's SSVC framework marks exploitation as none, consistent with the very low EPSS score (0.11%).
Local privilege escalation in the Android kernel affects Pixel and other Android devices through a logic error in OSMMapPMRGeneric within pmr_os.c, the PowerVR/Imagination-style PMR (Physical Memory Resource) memory-management code. A local attacker chaining system calls can maliciously expand a Virtual Memory Area (VMA) out of bounds, corrupting kernel memory to gain root-equivalent privileges. Rated CVSS 7.8 with no public exploit identified at time of analysis; EPSS is 0.07% and CISA SSVC reports no observed exploitation, indicating this is a patched-early, not-yet-weaponized issue.
Remote code execution in Android's RTP/RTCP media stack (RtpSession::rtpSendRtcpPacket) allows a remote peer to trigger a CWE-122 heap buffer overflow and gain arbitrary code execution within the affected media/telephony component without user interaction. Addressed in the June 2026 Android/Pixel security bulletin, the flaw carries total technical impact (SSVC) and CVSS 8.8, though CISA SSVC currently records exploitation status as 'none' and EPSS is low at 0.28% (19th percentile). No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Out-of-bounds read in the cellular Modem (baseband) of Google Pixel/Android devices allows an unauthenticated attacker within cellular radio range to crash the modem by sending a crafted radio-layer or signaling message, causing loss of cellular connectivity (denial of service). The flaw is a missing bounds check during message parsing (CWE-125) and requires no user interaction; only availability is impacted, with no code execution, privilege gain, or data disclosure. No public exploit code identified at time of analysis; EPSS is low at 0.25% and CISA SSVC shows no active exploitation.
Remote code execution in the WC-Radio component on Google Android (Pixel) devices allows network-adjacent attackers to corrupt memory via an out-of-bounds write with no authentication or user interaction. The flaw carries a CVSS 9.8 rating and is addressed in the Pixel security bulletin dated 2026-06-01; no public exploit identified at time of analysis and EPSS is low at 0.15%.
Remote code execution in Vitest Browser Mode (npm @vitest/browser 3.0.0-3.2.4, 4.0.0-4.1.7, 5.0.0-beta.0-5.0.0-beta.3) allows remote attackers to overwrite the project's vite.config.ts and execute arbitrary Node.js code on the host when the browser API server is bound to a network-reachable interface (e.g. --browser.api.host=0.0.0.0). The flaw stems from the cdp() API forwarding raw Chrome DevTools Protocol calls over the browser WebSocket RPC without honoring the allowWrite/allowExec gates that normally restrict Browser Mode. Publicly available exploit code exists in the GHSA-g8mr-85jm-7xhm advisory's step-by-step reproduction, though no CISA KEV listing has been issued.
Denial of service in protobuf.js occurs when untrusted protobuf binary data containing deeply nested google.protobuf.Any values is converted to JSON, leading to stack overflow. This affects applications using affected versions (≤7.6.0 and 8.0.0–8.4.0) that decode user-controlled protobuf and then trigger JSON conversion. At time of analysis, no public exploit is identified, and CISA KEV does not list this issue.
Sensitive header leakage in @angular/service-worker allows remote attackers to capture Authorization tokens, Proxy-Authorization credentials, and session cookies when a credentialed asset fetch is redirected cross-origin, because the worker preserved request headers instead of stripping them per the Fetch redirect algorithm. Affected versions span Angular 20.x, 21.x, and 22.x prereleases (and all 19.x and earlier), and no public exploit identified at time of analysis. The flaw was discovered by Google DeepMind's CodeMender and patched in 22.0.1, 21.2.17, and 20.3.25.
Cache key collision in Angular's @angular/common HttpTransferCache allows remote attackers to poison Server-Side Rendering (SSR) cache entries and replace responses for sensitive endpoints with attacker-controlled content. The weak 32-bit DJB2-like polynomial rolling hash used for TransferState cache keys is trivially brute-forceable, enabling state poisoning, DOM-based XSS, and information leakage when a victim follows a crafted link. No public exploit identified at time of analysis, but the vulnerability was discovered and reported by Google DeepMind's CodeMender and is patched in Angular 22.0.1, 21.2.17, and 20.3.25.
Denial of service in Angular's @angular/common package allows attackers to exhaust CPU and memory by passing crafted digitsInfo strings (e.g., '1.200000000-200000000') to formatNumber, DecimalPipe, PercentPipe, or CurrencyPipe. On SSR deployments this crashes the Node.js process with a heap-out-of-memory error, while client-side rendering freezes the browser tab. No public exploit identified at time of analysis, though the patched code and triggering input strings are documented in PR #68840.
Local privilege escalation in Microvirt MEmu Android Emulator 9.2.7.0 allows a low-privileged local user to abuse the MemuService.exe component to gain elevated rights on the host Windows system. Mapped to CWE-269 (Improper Privilege Management), with no public exploit identified at time of analysis and an EPSS score of 0.21% indicating low predicted exploitation likelihood. Researcher PoC repository exists on GitHub (sec-zone/CVE-2026-36213) but active exploitation has not been reported.
Missing Origin/Host header validation in Google's MCP Toolbox for Databases (Model Context Protocol server) prior to v0.25.0 allows remote attackers to reach the locally-bound HTTP server via DNS rebinding from a victim's browser, abusing the bridge to issue arbitrary tool/database commands. The fix introduces a new --allowed-hosts startup flag (companion to the existing --allowed-origins) that validates inbound Host headers, though both flags retain an insecure-by-default '*' value with only a startup warning. No public exploit identified at time of analysis; the issue was reported internally by Google.
Improper access control in File Browser (filebrowser/filebrowser, Go) versions <= 2.63.6 lets a user with share/download permissions create a public share for a path that does not yet exist; because the share record stores only a path string and is never bound to a concrete object, the link silently begins exposing whatever file later appears at that path via GET /api/public/dl/<hash>. The flaw mirrors the Android MediaProvider issue CVE-2026-0035 — the create handler omits an existence check before persisting the share. EPSS is very low (0.02%, 6th percentile) and there is no public exploit identified at time of analysis, but a step-by-step PoC is included in the GitHub Security Advisory.
Stored cross-site scripting in the @apostrophecms/seo plugin (versions ≤1.4.2) allows any user holding the default editor role to inject arbitrary JavaScript that executes in every visitor's browser. The seoGoogleTrackingId and seoGoogleTagManager fields are interpolated directly into inline <script> tag bodies via template literals with no sanitization, turning legitimate analytics configuration into a persistent payload delivery channel. No public exploit identified at time of analysis, and no vendor-released patch identified at time of analysis.
Privilege escalation in Zoom Workplace mobile clients (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler for a custom URL scheme, allowing a remote attacker to elevate privileges over network access. The CVSS 8.1 rating reflects high confidentiality and integrity impact with low-complexity exploitation, though no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Privilege escalation in the Zoom Workplace mobile app (Android before 7.0.4, iOS before 7.0.3) stems from improper authorization in the handler that processes the app's custom URL scheme, allowing an unauthenticated actor to elevate privileges via network access. Zoom self-reported and patched the flaw, and no public exploit identified at time of analysis; EPSS remains very low (0.04%, 12th percentile) and CISA SSVC marks exploitation as none, indicating no observed activity despite the 9.8 CVSS score.
Hard-coded cryptographic keys in the Aqara Home Android app (com.lumiunited.aqarahome) 6.0.0 and white-label clients embedding the same liblumidevsdk.so let attackers who extract the static keys from the shipped binary decrypt protected data and forge or tamper with device/cloud communications. Because every install ships the identical embedded keys, a single extraction compromises confidentiality and integrity across the entire installed base. Reported by runZero (CVE-2026-50091 / EUVD-2026-36481); publicly available exploit code exists (GitHub PoC 'theres-no-place-like-home'), but it is not on CISA KEV and EPSS is very low at 0.03%.
Hard-coded MQTT broker credentials in Yarbo Android and iOS applications allow remote unauthenticated attackers to subscribe to and publish on the cloud MQTT brokers serving the entire global Yarbo robot fleet. Because the credentials are identical across all users and devices and trivially extractable via APK decompilation, anyone knowing a target robot's serial number can read its telemetry or send arbitrary commands. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 9.3 and CISA ICS advisory reflect the systemic, fleet-wide nature of the exposure.
Origin validation failure in CyberArk's Idira Identity Browser Extension for Chrome, Firefox, and Edge (versions prior to 26.8.1) allows a remote attacker to abuse an authenticated user's browser session by luring them to a malicious page. Per CyberArk bulletin CA26-21, the extension's internal web-page verification routine fails to correctly enforce origin checks (CWE-346), enabling unauthorized application interaction in the victim's identity context. No public exploit identified at time of analysis, but the CVSS 4.0 base score of 8.4 reflects high confidentiality impact and subsequent-system impact via the identity SaaS the extension brokers.
Heap corruption in Google Chrome's Views UI framework on Windows (versions prior to 149.0.7827.115) lets a remote attacker exploit a use-after-free by luring a victim to a crafted HTML page. Google rates the Chromium severity High, and the CVSS 8.8 vector reflects full compromise of the renderer/browser process, though exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and EPSS is very low (0.03%), indicating no observed weaponization yet.
Sandbox escape in Google Chrome on Linux (versions prior to 149.0.7827.115) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a malicious file, through insufficient input validation in the Linux Toolkit (GTK) Theming component. Rated High severity by Chromium and CVSS 8.3, this is a second-stage escalation primitive rather than an initial entry point. There is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%, 21st percentile), with CISA SSVC scoring exploitation as 'none'.
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the Chromium sandbox via a crafted HTML page abusing the Views UI framework. Chromium rates the severity High, and no public exploit is identified at time of analysis, but sandbox-escape primitives are routinely chained with renderer RCE bugs into full browser compromise on Windows endpoints.
Sandbox escape in Google Chrome on Android prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox through a heap-based out-of-bounds write in the GPU process triggered by a crafted HTML page. Chromium rates the severity High and a vendor patch is available, but no public exploit has been identified at time of analysis. The CVSS 8.3 score reflects the chained nature of the attack (compromised renderer required) combined with full impact across confidentiality, integrity, and availability.
Sandbox escape in Google Chrome on Windows prior to 149.0.7827.115 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the Video component. Rated High by Chromium and CVSS 8.3 with a scope change (S:C), it requires user interaction (visiting a malicious page) and is typically the second stage of a full RCE chain. There is no public exploit identified at time of analysis, and the low EPSS score (0.07%, 21st percentile) plus SSVC 'Exploitation: none' indicate no observed in-the-wild activity yet.
Sandbox escape in the GPU process of Google Chrome for Android before 149.0.7827.115 lets a remote attacker who has already compromised the renderer process break out of the sandbox and potentially achieve code execution in a higher-privileged context via a crafted HTML page. This is a memory-corruption (use-after-free) bug rated High by Chromium and fixed in the June 2026 stable channel; there is no public exploit identified at time of analysis and EPSS is very low (0.07%), but the total technical impact makes it a meaningful second-stage primitive in a browser exploit chain.
Sandbox escape in Google Chrome prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the Headless component sandbox via a crafted HTML page. The flaw is rated High severity by Chromium and carries CVSS 9.6 due to scope change and user interaction, though EPSS remains very low (0.03%) and there is no public exploit identified at time of analysis. A vendor patch is available in the stable channel update published June 2026.
Sandbox escape in Google Chrome on macOS (versions prior to 149.0.7827.115) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the GPU component. This is a chain-stage bug rather than a standalone entry point - it presumes prior renderer compromise - and Google rates the Chromium severity as High. No public exploit identified at time of analysis, and the EPSS probability is low (0.07%, 21st percentile).
Sandbox escape in Google Chrome on macOS prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a race condition in Safe Browsing handling of a malicious file. Chromium rates the issue High severity and a vendor patch is available, though no public exploit has been identified at time of analysis.
Heap corruption in Google Chrome's Autofill component on macOS (versions prior to 149.0.7827.115) lets a remote attacker trigger a use-after-free by luring a victim to a crafted HTML page, potentially leading to arbitrary code execution in the renderer. Google rates the Chromium severity as High and has shipped a fix in the stable channel. There is no public exploit identified at time of analysis, and EPSS is very low at 0.07%.
Sandbox escape in Google Chrome on Linux and ChromeOS prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a heap buffer overflow in the Codecs component triggered by a crafted HTML page. Google rates the underlying issue as High severity and a vendor patch is available, but no public exploit is identified at time of analysis and the bug is not listed in CISA KEV. Exploitation is conditional on chaining with a prior renderer compromise, which raises real-world complexity.
Local privilege escalation in Google Chrome on Windows prior to 149.0.7827.115 stems from an inappropriate implementation in the Mojo IPC layer, allowing a local attacker who can place a malicious file on the system to elevate to OS-level privileges. The flaw is rated High severity by Chromium and carries CVSS 8.8, with a vendor patch available and no public exploit identified at time of analysis.
Sandbox escape in Google Chrome's DevTools component before version 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.3, this is a second-stage vulnerability typically chained with a renderer RCE bug. No public exploit identified at time of analysis, and it is not listed in CISA KEV.
Sandbox escape in Google Chrome's Cast component (versions prior to 149.0.7827.115) lets an attacker positioned on the same local network segment corrupt memory via crafted network traffic and potentially break out of the renderer sandbox. Rated High by Chromium with a CVSS 8.3 (scope-changed, total impact), it is patched in the June 2026 Stable channel. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but a successful escape yields total control over the affected process.
Heap corruption via a use-after-free in the Media component of Google Chrome on Windows before 149.0.7827.115 allows a remote attacker to potentially achieve code execution when a victim opens a crafted HTML page. Rated High by Chromium with CVSS 8.8, it requires user interaction (loading a malicious page) but no authentication. There is no public exploit identified at time of analysis, EPSS is low (0.07%), and CISA SSVC lists exploitation as none.
Heap corruption in Google Chrome's Network component (versions prior to 149.0.7827.115) allows an attacker in a privileged network position to trigger a use-after-free via malicious network traffic, potentially leading to memory corruption and code execution within the browser process. Google rates the Chromium severity as High, and a fixed stable-channel build is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.02%), while CISA's SSVC framework records exploitation status as none.
Use-after-free in Chrome's WebMIDI implementation on Windows lets a remote attacker who has already compromised the renderer process escape the sandbox via a crafted HTML page, elevating a renderer-level foothold toward host-level control. Rated Critical by Chromium and affecting all Chrome builds prior to 149.0.7827.115, the flaw has a patch available from Google but shows no public exploit identified at time of analysis and a very low EPSS of 0.06%.
Sandbox escape in Google Chrome on Android prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a heap buffer overflow in the GPU process. Chromium rates this severity Critical, and while no public exploit identified at time of analysis, the bug is part of a classic two-stage exploitation chain typically used in browser zero-day exploits. Patch is available from vendor in Chrome 149.0.7827.115 and later.
Sandbox escape in Google Chrome on macOS prior to 149.0.7827.115 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that exercises the Accessibility subsystem. Chromium rates the issue Critical severity; no public exploit identified at time of analysis, and the flaw is not on the CISA KEV list. The bug is reachable only after a prior renderer compromise and requires user interaction, which limits drive-by exploitation but makes it a key second-stage primitive in a full browser chain.
Sandbox escape in Google Chrome's DigitalCredentials component (versions prior to 149.0.7827.115) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Critical by Chromium and CVSS 8.3, it is a use-after-free memory-corruption bug used as the second stage of an exploit chain. There is no public exploit identified at time of analysis, it is not on CISA KEV, and EPSS is very low (0.07%), consistent with a fix shipped before disclosure.
Remote code execution in Google Chrome on Windows prior to 149.0.7827.115 allows remote attackers to trigger a use-after-free condition in the Core component via a crafted HTML page, leading to arbitrary code execution within the renderer process. Chromium rates the severity as Critical, and no public exploit has been identified at time of analysis, but the bug class (UAF in Core) is historically a frequent target for in-the-wild exploitation against Chrome. The vulnerability requires the victim to visit attacker-controlled content (UI:R).
Information disclosure in Element Call 0.5.17 through 0.19.3 causes the application to send full visited URLs (including URL fragments) to a configured PostHog analytics server via the `$initial_person_info`, `$session_entry_url`, and `$current_url` fields. On standalone SPA deployments such as call.element.io that encode call encryption passwords in the URL fragment, this can leak those passwords to anyone with access to the PostHog data, enabling decryption of the associated E2EE media streams. No public exploit identified at time of analysis; the issue was disclosed and patched by the vendor in 0.19.4.
Privilege escalation in Google Cloud Dialogflow CX allows authenticated users holding specific IAM roles to abuse the playbook import functionality and potentially take over the entire GCP project. Google has confirmed the issue was patched server-side on 15 March 2026 with no customer action required, and no public exploit has been identified at time of analysis.
Cross-site request forgery in the Nezha monitoring dashboard (versions >= 1.0.0, < 2.0.14) allows remote attackers to force a logged-in user's browser to trigger any of the victim's existing cron tasks via a GET navigation to /api/v1/cron/:id/manual, causing the stored command to be dispatched to the victim's online agents. The flaw stems from a state-changing GET endpoint protected only by a SameSite=Lax JWT cookie with no CSRF token, Origin/Referer check, or Fetch Metadata guard. No public exploit identified at time of analysis beyond the reporter's safe Go-test proof; the issue is not in CISA KEV.
Detection bypass in @hulumi/policies versions prior to 1.4.0 allows IAM trust policies that list multiple OIDC federated providers to evade the G_OIDC_1 and G_OIDC_2 policy checks for GitHub Actions OIDC roles. Consumers of HulumiHardeningPack or HulumiGithubHardeningPack can therefore ship roles with wildcard sub: conditions - assumable by untrusted forked-PR workflows - while the validator falsely reports compliance, including missing the AdministratorAccess blast-radius flag. No public exploit identified at time of analysis, and there is no CISA KEV listing.
Local spoofing in Microsoft Office for Android lets an unauthorized attacker manipulate trust-affecting content or identity indicators after a user interacts with malicious input on the device. The CVSS 7.1 score reflects high confidentiality and integrity impact with no special privileges required, though the local attack vector and required user interaction limit remote exploitability. No public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Information disclosure in Microsoft Teams for Android allows an authenticated remote attacker to extract sensitive data via an injection flaw (CWE-74) in output passed to a downstream component. The CVSS 8.1 rating reflects high confidentiality and availability impact over the network with low privileges and no user interaction, though no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.
Sandbox escape in Google Chrome prior to 149.0.7827.103 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a use-after-free flaw in the Tracing component, triggered through a crafted HTML page. No public exploit identified at time of analysis, and SSVC indicates exploitation status is 'none', but the technical impact is rated total because a successful escape grants code execution at browser-process privileges. Google has shipped a fix and rates the underlying Chromium severity as Medium, while the assigned CVSS is 8.3 due to scope change and high CIA impact.