Google

Heap corruption in Google Chrome for iOS prior to 149.0.7827.53 allows remote attackers to potentially execute arbitrary code by luring a user to a crafted HTML page that triggers a use-after-free condition. Google has rated this as High severity and a vendor patch is available, though no public exploit has been identified at time of analysis. The CVSS 8.8 score reflects network-reachable exploitation with low complexity but requires user interaction (visiting a malicious page).

Heap corruption in Google Chrome on iOS before version 149.0.7827.53 enables remote attackers to potentially execute arbitrary code by enticing a user to interact with a malicious HTML page that triggers a use-after-free in the Autofill component. Chromium rates the underlying flaw as High severity, and while a vendor patch is available, no public exploit has been identified at time of analysis and EPSS remains very low at 0.03%.

Cross-origin data leakage in Google Chrome on iOS (versions prior to 149.0.7827.53) stems from insufficient policy enforcement in the Autofill component, enabling a remote unauthenticated attacker to read sensitive cross-origin data by directing a victim to a crafted HTML page. The CVSS score of 6.5 (Medium) reflects high confidentiality impact with no integrity or availability loss; the attack requires user interaction but no attacker privileges. EPSS probability sits at 0.03% (11th percentile), SSVC reports no current exploitation, and the CVE is absent from CISA KEV, collectively indicating low real-world threat urgency despite the medium severity classification.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 stems from a heap buffer overflow in the Video component, allowing a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Chromium rates the severity as High and a vendor patch is available; no public exploit identified at time of analysis. The CVSS 8.3 score reflects the scope change (S:C) that occurs when sandbox boundaries are crossed, though the attack requires high complexity and user interaction.

Remote code execution in Google Chrome prior to 149.0.7827.53 allows a remote attacker to trigger a use-after-free condition in the WebRTC component by enticing a victim to visit a crafted HTML page, resulting in arbitrary code execution within the renderer sandbox. Google rated this as High severity and a vendor patch is available; no public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the WebRTC component, enabling a remote attacker to execute arbitrary code within the renderer sandbox when a victim visits a crafted HTML page. Google rates the underlying Chromium severity as High, and the CVSS 3.1 score of 8.8 reflects network-reachable, low-complexity exploitation requiring only user interaction (visiting a page). No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.

Heap buffer overflow in the Media component of Google Chrome before 149.0.7827.53 enables remote attackers to achieve arbitrary code execution within the renderer sandbox after luring a user to a crafted HTML page and tricking them into performing specific UI gestures. Google rates the underlying Chromium issue as High severity, and while publicly available exploit code exists is not confirmed, vendor patches have been released through the Stable channel update. No active exploitation has been reported via CISA KEV at time of analysis.

Sandboxed arbitrary code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the browser's PDF component, exploitable when a remote attacker convinces a user to perform specific UI gestures after loading a crafted PDF. Chromium rates the severity as High and a vendor patch is available, though no public exploit has been identified at time of analysis and CISA SSVC marks exploitation status as none.

Cross-origin data exfiltration via Autofill in Google Chrome on iOS (prior to 149.0.7827.53) allows a remote attacker to leak sensitive data across origin boundaries by directing a victim to a crafted HTML page. The flaw stems from insufficient policy enforcement in the Autofill subsystem - a protection mechanism failure (CWE-693) that bypasses same-origin boundary controls exclusive to the iOS platform build of Chrome. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (11th percentile) indicates very low observed exploitation probability. A vendor-released patch is available.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the WebRTC component that allows a remote attacker to execute arbitrary code within the renderer sandbox via a crafted HTML page. Exploitation requires user interaction (UI:R) such as visiting a malicious site, and while no public exploit has been identified at time of analysis, Google rates the underlying Chromium severity as High and a vendor patch is available.

Local privilege escalation in Google Chrome on Windows prior to 149.0.7827.53 enables an attacker who can deliver a malicious file to a victim to elevate privileges via an inappropriate UI implementation. Google's Chromium team rated the severity as High and a stable channel patch has been released, but no public exploit has been identified at time of analysis and the issue is not currently listed in CISA KEV.

Out-of-bounds memory access in the Skia graphics library shipped with Google Chrome before 149.0.7827.53 allows a remote attacker to execute arbitrary code within Chrome's renderer sandbox when a victim visits a malicious page. Google rates the Chromium severity as High and a vendor patch is available; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a race condition in the Codecs component. Chromium rates this High severity, and while no public exploit was identified at time of analysis, the bug fits the classic renderer-to-sandbox-escape pattern frequently chained in real-world Chrome exploit kits. CVSS is 8.3 reflecting high attack complexity, required user interaction, and a scope change.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page that triggers a use-after-free in the WebRTC component. The flaw carries a CVSS 3.1 score of 8.8 (High) and Chromium rates the security severity as High; no public exploit has been identified at time of analysis and the issue is not currently listed in CISA KEV.

Site isolation bypass in Google Chrome prior to 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to escape cross-origin protections via a crafted HTML page. The vulnerability stems from inappropriate handling of the Input component (CWE-20: Improper Input Validation) within Chromium's renderer, allowing crafted input to undermine the site isolation security boundary and produce high-integrity impact against cross-origin resources. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.02% (6th percentile), consistent with the renderer pre-compromise prerequisite that constrains standalone exploitation.

Same-origin policy bypass in Google Chrome's Passwords component prior to version 149.0.7827.53 allows remote attackers to access cross-origin resources via a crafted HTML page that a victim must visit. Rated High severity by Chromium with a CVSS of 8.1, the flaw enables exposure or modification of sensitive data across origin boundaries when a user is lured to attacker-controlled content. EPSS probability is very low (0.02%, 4th percentile) and no public exploit identified at time of analysis, but a vendor patch is available.

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.53 allows attackers to execute arbitrary code within the renderer sandbox by luring a user to a malicious web page. The flaw stems from a type confusion bug rated High severity by Chromium's security team, and while no public exploit has been identified at time of analysis, V8 type confusion bugs are historically high-value targets for browser exploitation chains. A vendor patch is available.

Remote code execution in Google Chrome V8 JavaScript engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the renderer sandbox by serving a crafted HTML page to a victim. The flaw is a type confusion bug (CWE-843) in V8 rated High severity by Chromium, with no public exploit identified at time of analysis and SSVC indicating exploitation status 'none' from CISA's framework.

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who already controls the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the Autofill component. Chromium rates the severity High and a vendor patch is available; no public exploit identified at time of analysis and the issue is not listed in CISA KEV.

Sandbox escape in Google Chrome on Windows before 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out via a use-after-free in the Audio component when a victim loads a crafted HTML page. Chromium rates the issue High severity and Google has shipped a stable-channel fix, but no public exploit identified at time of analysis and the bug is not listed in CISA KEV.

Heap corruption in Google Chrome on Android before 149.0.7827.53 enables remote attackers to exploit a use-after-free condition in the browser's UI component through a malicious web page. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a crafted page), with no public exploit identified at time of analysis. Google rates the underlying Chromium severity as High, and a vendor patch is available in the stable channel update.

Sandbox escape in Google Chrome's FileSystem component prior to version 149.0.7827.53 allows a remote attacker to break out of the renderer sandbox via a crafted HTML page that triggers a use-after-free condition. Successful exploitation requires the victim to interact with attacker-controlled web content, but yields a scope change from the constrained renderer process to higher-privileged host context. EPSS is currently low (0.03%) and no public exploit has been identified at time of analysis, though Google rates the underlying Chromium severity as High.

Out-of-bounds memory read in Google Chrome's ANGLE graphics layer on macOS versions prior to 149.0.7827.53 allows remote attackers to disclose memory contents or crash the renderer by enticing a user to visit a crafted HTML page. Google rates the underlying Chromium issue as High severity, and while no public exploit is identified at time of analysis, the EPSS score of 0.03% suggests low near-term mass exploitation likelihood. The flaw requires user interaction (visiting a page) but no authentication, making drive-by web attacks the realistic threat model.

Sandbox escape in Google Chrome on Android prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a crafted HTML page that triggers a heap buffer overflow in ANGLE. Chromium rates the severity as High, and although no public exploit is identified at time of analysis, the CVSS 8.3 score with scope change reflects the cross-boundary impact when chained with a renderer RCE. This is a classic second-stage bug used in browser exploit chains rather than a standalone one-click compromise.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code through a crafted HTML page that triggers script injection in the Headless component. The flaw is rated High severity by Chromium and carries a CVSS 3.1 base score of 8.8, requiring only that a victim load attacker-controlled web content. No public exploit identified at time of analysis, but Google has released a fix in the Stable channel update for desktop.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 can be achieved by remote attackers who have already compromised the renderer process, leveraging an out-of-bounds read in the Dawn WebGPU implementation via a crafted HTML page. Google rates this as High severity and a vendor patch is available, though no public exploit has been identified at time of analysis. The bug is part of a multi-stage exploitation chain rather than a single-step RCE, but successful chaining yields full escape from Chrome's renderer sandbox.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 allows an attacker on the same local network segment (adjacent network) to execute arbitrary code by sending malicious traffic to the browser's Cast component. The flaw stems from a use-after-free memory corruption issue in the Cast feature (used for media streaming to devices like Chromecast) and is rated High severity by Chromium with a CVSS score of 8.8. No public exploit identified at time of analysis, though a vendor patch has been released.

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 lets a remote attacker who has already compromised the renderer process break out of the Chromium sandbox via a crafted HTML page that triggers an out-of-bounds write in Skia. Google rates the underlying Chromium issue High severity and a vendor patch is available, though no public exploit code has been identified at time of analysis.

Sandbox escape in Google Chrome's Chromecast component prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High severity by the Chromium project with a CVSS of 8.3, the flaw requires a prior renderer compromise and user interaction, and no public exploit identified at time of analysis. Successful exploitation gives attackers code execution outside the renderer's restricted context, dramatically expanding impact on the host.

Arbitrary code execution in Google Chrome for Android prior to 149.0.7827.53 stems from a use-after-free flaw in the WebAppInstalls component, triggered when a victim opens a malicious file. Although the CVSS vector lists a network attack vector with high impact across confidentiality, integrity, and availability, exploitation requires user interaction and no public exploit identified at time of analysis. EPSS probability is very low (0.01%) and SSVC indicates no observed exploitation, suggesting the immediate threat is limited despite the High severity rating from Chromium.

Same-origin policy bypass in Google Chrome's DevTools component prior to version 149.0.7827.53 allows remote attackers to violate browser security boundaries when victims perform specific UI gestures on attacker-controlled pages. The flaw stems from insufficient validation of untrusted input within DevTools and is rated High severity by Chromium with a CVSS of 8.8, though no public exploit identified at time of analysis and EPSS is very low at 0.02%.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 is possible via an integer overflow in the Dawn WebGPU implementation, allowing a remote attacker who has already compromised the renderer process to break out of the browser sandbox using a crafted HTML page. Google rates the Chromium severity as High and a vendor patch is available; no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Sandbox escape in Google Chrome on macOS prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the WebShare component. The bug is rated High severity by Chromium and carries a CVSS 8.3 with scope change reflecting the sandbox boundary crossing, though no public exploit has been identified at time of analysis.

Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High severity by Chromium and CVSS 8.3, and while no public exploit is identified at time of analysis, sandbox escapes in ANGLE have historically been chained with renderer RCE bugs to achieve full system compromise.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free flaw in the Viz compositor component. Exploitation requires a crafted HTML page and victim interaction, and Google has rated the underlying Chromium security severity as High. No public exploit has been identified at time of analysis, but this class of bug is historically chained with renderer RCE bugs to achieve full browser compromise.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting insufficient input validation in the Media component. Google rates the Chromium security severity as High, and no public exploit has been identified at time of analysis. Successful exploitation requires chaining with a separate renderer compromise plus user interaction, raising attack complexity but yielding full host-level impact if achieved.

Universal Cross-Site Scripting (UXSS) in Google Chrome's DevTools component allows an attacker who has already compromised the renderer process to inject arbitrary scripts or HTML across security origins via a crafted HTML page, bypassing the same-origin policy. Affected versions are all Chrome releases prior to 149.0.7827.53. No public exploit code exists and no active exploitation has been observed; this vulnerability functions as a second-stage capability within a broader attack chain requiring prior renderer compromise.

Sandbox escape in Google Chrome on iOS prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free in the Core component rated High severity by Chromium, and no public exploit identified at time of analysis. Exploitation requires user interaction (visiting a malicious page) and chaining with a prior renderer compromise, raising the practical bar despite the 8.3 CVSS score.

Remote code execution in Google Chrome's ANGLE graphics layer on Windows prior to version 149.0.7827.53 allows attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is a use-after-free (CWE-416) memory corruption issue rated High severity by Chromium, requires user interaction to trigger, and no public exploit has been identified at time of analysis.

Remote code execution in Google Chrome on Windows (versions prior to 149.0.7827.53) is possible through a use-after-free vulnerability in the ANGLE graphics translation layer, triggered when a victim visits a crafted HTML page. Successful exploitation yields arbitrary code execution constrained to the Chrome renderer sandbox, with Chromium rating the severity as High and CVSS scored at 8.8. There is no public exploit identified at time of analysis and CISA SSVC marks exploitation status as none, but the bug class (UAF in GPU translation) is historically a popular target for chained sandbox escapes.

Same-origin policy bypass in Google Chrome's Extensions component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to perform unauthorized cross-origin actions via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Extensions subsystem and carries a CVSS integrity impact of High with no confidentiality or availability loss. No active exploitation has been confirmed - EPSS sits at 0.02% (6th percentile), SSVC exploitation status is 'none', and the CVE is not listed in CISA KEV - but a vendor-released patch is available.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page abusing the Media component. Google rates the issue High severity and a vendor patch is available, though no public exploit has been identified at time of analysis.

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code inside the renderer sandbox via a crafted HTML page. The flaw is a type confusion bug (CWE-843) rated High severity by Chromium with a CVSS 8.8 score; no public exploit identified at time of analysis and the vulnerability is not currently listed in CISA KEV. User interaction is required, as the victim must visit attacker-controlled or compromised content.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a use-after-free flaw in the Dawn WebGPU implementation. Exploitation requires luring a victim to a crafted HTML page and chaining this bug with a prior renderer compromise, but the impact is full sandbox escape with high confidentiality, integrity, and availability consequences. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV.

Sandbox escape in Google Chrome on Windows prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page exploiting a use-after-free condition in the FullScreen component. Rated High severity by Chromium with a CVSS of 8.3, the flaw requires user interaction and high attack complexity, and no public exploit identified at time of analysis. The vendor has issued a stable channel update addressing the issue.

Out-of-bounds write in the ANGLE graphics layer of Google Chrome versions prior to 149.0.7827.53 enables remote attackers to trigger heap corruption and potentially execute arbitrary code by luring a victim to a crafted HTML page. Chromium rates the severity as High and CVSS 8.8 reflects the network attack vector with required user interaction. No public exploit identified at time of analysis, though the bug class (memory corruption in a browser-exposed component) is historically a prime target for weaponization.

Heap corruption in Google Chrome's WebAuthentication component prior to version 149.0.7827.53 allows remote attackers to potentially execute arbitrary code through a crafted HTML page combined with user interaction. The flaw is a use-after-free (CWE-416) rated High severity by Chromium and carries a CVSS 7.5 score, though exploitation requires specific UI gestures from the victim. No public exploit identified at time of analysis, and the vulnerability is not currently listed in CISA KEV.

Sandbox escape in Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the sandbox via a use-after-free in the Network component, triggered by a crafted HTML page. Chromium rates the severity as High and a vendor patch is available; no public exploit identified at time of analysis.

Remote code execution in Google Chrome's V8 JavaScript engine prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. Rated High severity by Chromium with a CVSS 8.8, the flaw requires user interaction (visiting a malicious site) but no authentication or privileges. No public exploit has been identified at the time of analysis, and the issue is not currently listed in CISA KEV.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the WebRTC component that lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google rates the underlying Chromium issue as High severity, and no public exploit is identified at time of analysis, though publicly available patch metadata and Chromium bug tracker entries (issue 503422316) confirm the fix.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the Ozone graphics abstraction layer, rated Critical by Chromium's internal severity classification. Remote attackers can trigger arbitrary code execution within the browser's rendering context by enticing a victim to visit a crafted HTML page. There is no public exploit identified at time of analysis, and CISA SSVC scoring indicates no observed exploitation, though the technical impact is rated total.

Remote code execution in Google Chrome on macOS prior to version 149.0.7827.53 stems from a use-after-free condition in the Passwords component, allowing a remote attacker to execute arbitrary code if a victim is convinced to perform specific UI gestures on a crafted HTML page. Chromium rates the underlying severity as Critical, though CVSS scores it 7.5 due to high attack complexity and required user interaction. There is no public exploit identified at time of analysis and SSVC indicates exploitation status is none.

Remote heap corruption in Google Chrome on macOS prior to 149.0.7827.53 stems from a use-after-free in the Passwords component, letting a remote attacker who lures a user into specific UI interactions trigger memory corruption via a crafted HTML page. Chromium rates the underlying flaw Critical and a vendor patch is available, though no public exploit has been identified at time of analysis and active exploitation has not been confirmed by CISA KEV.

Heap corruption in Google Chrome's Ozone display layer on Linux versions prior to 149.0.7827.53 allows remote attackers to potentially achieve code execution by enticing a user to perform specific UI gestures on a crafted HTML page. Chromium rates the underlying issue as Critical severity, and no public exploit has been identified at time of analysis. The defect is a use-after-free (CWE-416) reachable from the renderer's interaction with the Linux display abstraction.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows remote attackers who have already compromised the renderer process to potentially break out of the sandbox via a stack buffer overflow in the GPU component triggered by a crafted HTML page. Chromium rates this as Critical severity, and while no public exploit has been identified at time of analysis, the vendor has released a patched stable channel build addressing the issue.

Sandbox escape in Google Chrome's GPU component prior to version 149.0.7827.53 allows remote attackers to break out of the renderer sandbox via a crafted HTML page when a user visits a malicious site. Google's Chromium team rated the underlying issue Critical severity, and while a patch is available, no public exploit identified at time of analysis and EPSS estimates exploitation probability at only 0.03%.

Remote code execution in Google Chrome for iOS prior to version 149.0.7827.53 allows a remote attacker to execute arbitrary code by enticing a user to visit a crafted HTML page. Chromium rates the underlying use-after-free as Critical severity, though SSVC currently shows no observed exploitation and no public exploit identified at time of analysis. The CVSS 8.8 rating reflects high impact across confidentiality, integrity, and availability, tempered by a required user interaction (visiting the malicious page).

Remote code execution in Google Chrome's Ozone display server layer affects all desktop versions prior to 149.0.7827.53, where a use-after-free memory corruption flaw can be triggered by a crafted HTML page. Chromium-internal severity is rated Critical and the CVSS 3.1 score of 8.8 reflects high impact across confidentiality, integrity, and availability, though exploitation requires user interaction (visiting an attacker-controlled page). No public exploit has been identified at time of analysis, and CISA SSVC currently lists Exploitation as 'none'.

Sandbox escape in Google Chrome on Linux prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page that triggers a use-after-free in the Printing component. Google rates the underlying Chromium issue as Critical severity, and no public exploit is identified at time of analysis. The CVSS 8.3 score reflects the chained nature of the attack and the scope change that results when sandbox boundaries are crossed.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the Chromoting (Chrome Remote Desktop) component, which Google rated Critical internally. A remote attacker can deliver malicious network traffic to a user with an active Chromoting session and execute arbitrary code in the browser context, though user interaction is required per the CVSS vector. No public exploit identified at time of analysis, and EPSS probability is very low (0.04%).

Sandbox escape in Google Chrome for Android versions prior to 149.0.7827.53 stems from an out-of-bounds write in the GPU process that a remote attacker can trigger via a crafted HTML page. Google rates the underlying Chromium issue as Critical severity, and while a vendor patch is available, no public exploit identified at time of analysis and EPSS sits at 0.03% (11th percentile). The CVSS scope-changed vector (S:C) reflects the impact of breaking out of Chrome's sandbox to affect the broader Android OS context.

Heap corruption in Google Chrome's GFX component on Linux prior to version 149.0.7827.53 allows remote attackers to potentially achieve code execution when a victim visits a crafted HTML page. Google rates the underlying Chromium issue as Critical severity, and a vendor patch is available; no public exploit identified at time of analysis.

Heap corruption in Google Chrome's Cast component prior to version 149.0.7827.53 allows adjacent-network attackers to trigger a use-after-free condition through crafted network traffic, potentially leading to arbitrary code execution within the renderer. Chromium rates the underlying severity as Critical, and no public exploit identified at time of analysis, though the AV:A vector means any attacker sharing the victim's LAN or Wi-Fi segment can attempt exploitation without authentication or user interaction.

Out-of-bounds read in the ANGLE graphics layer of Google Chrome before 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to potentially escape the browser sandbox via a crafted HTML page. Chromium rates the underlying issue Critical severity, and while no public exploit has been identified at time of analysis, the bug is in a historically targeted attack surface (GPU/ANGLE) frequently abused in renderer-to-broker escape chains.

Remote code execution in Google Chrome's Cast Streaming component (versions prior to 149.0.7827.53) allows an attacker on the same local network segment to execute arbitrary code by sending malicious network traffic to a vulnerable browser. The flaw is rated Critical by the Chromium project and carries a CVSS 3.1 score of 8.8, with no public exploit identified at time of analysis.

Remote code execution in Google Chrome on macOS prior to 149.0.7827.53 stems from a use-after-free flaw in the Chromoting (Chrome Remote Desktop) component, allowing remote attackers to execute arbitrary code by delivering malicious network traffic. Google's Chromium team rates the underlying defect as Critical severity, and no public exploit has been identified at time of analysis, though the bug class historically attracts in-the-wild exploitation against browser users.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 allows remote attackers to exploit a use-after-free condition in the FileSystem component via a crafted HTML page, with user interaction required. Google has rated the underlying Chromium issue as Critical severity, and a vendor patch is available; no public exploit identified at time of analysis, though the high CVSS score (9.6) and scope-changed impact warrant rapid patching.

Remote code execution in Google Chrome for iOS versions prior to 149.0.7827.53 allows a remote attacker to execute arbitrary code by luring a victim to a crafted HTML page that triggers a use-after-free condition. The flaw is rated Critical by Chromium and carries a CVSS 8.8 score, and while no public exploit is identified at time of analysis, the user-interaction-only barrier (visiting a page) makes drive-by exploitation a realistic concern for unpatched iOS Chrome users.

Sandbox escape in Google Chrome versions prior to 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page targeting a use-after-free flaw in the Chromecast component. Google classifies the underlying issue as Critical severity, and no public exploit has been identified at time of analysis. The bug requires chaining with a separate renderer compromise, which lowers standalone exploitability but makes it valuable as the second stage of a full browser exploit chain.

Heap corruption in Google Chrome's ANGLE graphics translation layer prior to version 149.0.7827.53 allows remote attackers to potentially achieve code execution by enticing a user to visit a crafted HTML page. Chromium rates the severity as Critical and the CVSS score is 8.8 (High), but no public exploit identified at time of analysis. The flaw is a type confusion issue that maps to CWE-787 (out-of-bounds write), affecting the browser's WebGL/graphics rendering path.

Remote code execution in Google Chrome versions prior to 149.0.7827.53 stems from a use-after-free flaw in the Network component, allowing a remote attacker to execute arbitrary code within the renderer process when a user visits a crafted HTML page. Google rated this issue Critical at the Chromium level, and a vendor patch is available; no public exploit identified at time of analysis.

Sandbox escape in Google Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows a remote attacker to trigger an out-of-bounds read and write via a crafted HTML page, with a CVSS 9.6 reflecting scope change and high impact across confidentiality, integrity, and availability. The flaw was rated Critical internally by Chromium and reported by Google's own CVE admin team; no public exploit identified at time of analysis, and CISA SSVC currently lists exploitation status as none.

Open redirect in WebOb (pip/webob <= 1.8.9) enables unauthenticated network attackers to redirect victims to arbitrary attacker-controlled domains by bypassing the prior CVE-2024-42353 patch. The bypass exploits Python 3.10+'s silent stripping of ASCII control characters (tab, CR, LF) from URLs before parsing, so a crafted path like /\t/attacker.com passes the previous // guard, then gets normalized by urlsplit into a protocol-relative URL pointing to attacker.com. No public exploit has been identified at time of analysis beyond the advisory's own proof-of-concept code, but the bypass technique is trivial and the full exploit path is published in the GitHub advisory GHSA-fh3h-vg37-cc95.

WordPress Plugin Google Review Slider 6.1 contains a time-based blind SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

Denial of service in Securly Chrome Extension version 3.0.7 allows on-path network attackers to halt all browsing activity by injecting malicious regular expression patterns into an HTTP-delivered configuration file. The extension fetches config.json over plaintext HTTP and compiles attacker-controlled patterns with new RegExp() without complexity checks, enabling catastrophic backtracking (ReDoS). No public exploit identified at time of analysis, and EPSS is very low (0.02%), but the issue is reported by CERT/CC.

Information disclosure weakness in Securly Chrome Extension version 3.0.7 stems from continued reliance on the deprecated SHA-1 algorithm to hash and match 25,020 IWF CSAM URLs and 12,352 CIPA blocklist URLs. Because SHA-1 is vulnerable to collision attacks, an adversary with knowledge of the hash list could derive or guess matching URLs, exposing sensitive blocklist contents and undermining the integrity of the content-filtering mechanism. There is no public exploit identified at time of analysis and EPSS is very low (0.01%), but the issue was reported through CERT/CC (VU#595768), giving it credible vendor-coordinated provenance.

Cryptographic weakness in Securly Chrome Extension version 3.0.7 and earlier exposes AES-encrypted data to recovery attacks because the extension derives keys using EVP_BytesToKey with MD5 and only a single iteration. Remote attackers who can obtain ciphertext from the extension's storage or network exchanges can feasibly brute-force or precompute keys, leading to disclosure of protected information. EPSS is very low (0.01%), no public exploit has been identified, and the issue is not listed in CISA KEV.

Denial of service in Securly Chrome Extension 3.0.7 allows remote attackers to render all web browsing unusable when the extension's filtering service is unreachable. The extension dynamically registers an undeclared content script (content13.min.js) at runtime via chrome.scripting.registerContentScripts(), hiding every page behind a full-page overlay until the service worker validates the page; if Securly's servers fail or are blocked, pages remain indefinitely blank. No public exploit identified at time of analysis, and EPSS rates exploitation probability at 0.02% (5th percentile).

Information disclosure in Securly Chrome Extension version 3.0.7 allows remote unauthenticated attackers to retrieve SHA-1 hashes via publicly accessible endpoints, where the hashes are weakly protected by a reversible Caesar cipher. The flaw enables recovery of sensitive identifiers protecting filtered content data, with no public exploit identified at time of analysis and an EPSS score of 0.02% indicating very low predicted exploitation activity.

Hardcoded cryptographic secrets in Securly Chrome Extension version 3.0.7 allow remote attackers to decrypt sensitive crisis alert keyword lists and intervention site data shipped with the extension. The plaintext AES passphrases embedded in securly.min.js can be extracted by anyone who installs or inspects the extension, exposing the proprietary detection logic used to safeguard students. No public exploit has been identified at time of analysis, and EPSS rates exploitation probability at 0.02% (4th percentile), but the trivial extractability of the keys means any motivated actor can replicate the disclosure.

Cleartext transmission in Securly Chrome Extension version 3.0.7 exposes crisis alert keyword lists and content filtering rules to adjacent network attackers because the extension fetches these JSON configuration files over plaintext HTTP while other endpoints in the same extension correctly use HTTPS. An adjacent attacker on the same network segment can intercept or tamper with the filtering policy data, undermining the safety controls Securly is meant to enforce on managed Chromebooks. No public exploit identified at time of analysis and EPSS is very low at 0.01%, but a vendor patch is available.

Cross-site request forgery in the Google Plus One Bottom WordPress plugin (all versions ≤ 0.0.2) enables unauthenticated remote attackers to overwrite plugin settings stored in the WordPress database by tricking an authenticated administrator into clicking a crafted link. The root cause is missing nonce validation in the googlePlusOneAdmin function, exposing the plusone-lang, plusone-callback, and plusone-url options to unauthorized modification. No public exploit has been identified at time of analysis and the vulnerability is not listed in CISA KEV, though the social-engineering dependency is the primary limiting factor rather than any technical barrier.

Cross-site scripting in the GeniexWebView component of Transsion's AI Assistant Lifestyle Android application (com.transsion.aiassistantlifestyle) enables unauthenticated remote attackers to execute arbitrary JavaScript within the app's WebView context by delivering a crafted web_action_data URL parameter to a victim. The Changed scope (S:C) in the CVSS vector indicates impact crosses the originating component boundary - a meaningful risk in Android WebViews where JavaScript-to-native bridges may be exposed. No public exploit identified at time of analysis, and the EPSS score of 0.12% at the 31st percentile signals low current exploitation interest.

Local privilege escalation in Google Android XR stems from a missing permission check in InputMethodManagerService.addInputMethodListener, allowing an app or local context to register input method listeners without the authorization the IME subsystem normally requires. The flaw needs no user interaction and no additional execution privileges, and is addressed in the June 2026 Android XR security bulletin; no public exploit identified at time of analysis.

Path traversal via improper access control in mcp-google-workspace's MCP Gmail Tool (all pre-patch commits through 831790e) allows an authenticated low-privileged MCP client to write files to arbitrary filesystem locations by supplying crafted relative paths containing directory traversal sequences to the saveToDisk function. Publicly available exploit code exists (GitHub issue #19), though the attack requires an active MCP session (CVSS PR:L). No public exploitation has been confirmed by CISA KEV, but the MCP deployment context introduces prompt-injection as a realistic delivery vector - a malicious email or document processed by an AI assistant could trigger the vulnerable tool without direct human interaction beyond the initial session setup.

PIN authentication bypass in the Nextcloud Files Android app (versions 33.0.0 through 33.0.x) allows a physically present attacker to circumvent the app's passcode lock screen by pressing the Android back button immediately after the host device is unlocked. The PassCodeActivity failed to intercept back-navigation events during PIN verification, granting direct file access without completing authentication. No public exploit identified at time of analysis and no CISA KEV listing; risk is tightly constrained by the physical access vector. Patched in version 33.1.0 via upstream PR #16896.

Cross-site scripting via sanitizer bypass affects DOMPurify 3.4.4, the widely used npm HTML sanitization library maintained by cure53. The flaw stems from `<selectedcontent>` being permitted by default, allowing attackers to leverage browser re-cloning behavior so that an XSS payload is reinjected into a subtree DOMPurify has already walked. No public exploit identified at time of analysis in the form of in-the-wild attacks, but a fully working PoC is published in the GHSA advisory and active exploitation status is not listed in CISA KEV.

SSRF deny-list bypass in Gotenberg v8 (<= 8.32.0) allows unauthenticated remote attackers to reach internal cloud metadata services (e.g., AWS/GCP/Azure IMDS at 169.254.169.254) by serving a crafted DNS AAAA record containing IPv6 6to4, NAT64, or deprecated site-local prefixes that the IsPublicIP allow-list fails to recognize. Publicly available exploit code exists via the GitHub Security Advisory PoC, and the Chromium URL-convert route returns the upstream response as a PDF, yielding a full-read SSRF that can leak IAM credentials. No vendor-released patch identified at time of analysis (advisory lists no fixed version).

Cross-origin JavaScript injection in Home Assistant Companion apps for Android (before 2026.4.4) and iOS (before 2026.4.1) allows a malicious iframe loaded inside the app's WebView to execute arbitrary JavaScript in the Home Assistant frontend's origin and steal the signed-in user's access token. The flaw stems from exposing the native JavaScript bridge (window.externalApp on Android, webkit.messageHandlers.getExternalAuth on iOS) to all frames combined with unsanitized callback identifier interpolation. No public exploit identified at time of analysis, and the issue is not in CISA KEV.

Type confusion in the V8 JavaScript engine of Google Chrome before 148.0.7778.216 enables sandboxed arbitrary code execution when a user is convinced to install a malicious browser extension that delivers a crafted payload. The flaw carries a CVSS 7.5 (AV:N/AC:H/PR:N/UI:R) and is reported by Google's Chrome team, with no public exploit identified at time of analysis and a very low EPSS of 0.02%. Impact remains constrained to the renderer sandbox, but full confidentiality, integrity, and availability loss inside that boundary is possible.