Monthly
Cross-workspace credential IDOR in Flowise versions up to and including 3.1.3 allows an authenticated low-privilege user in one workspace to invoke third-party provider API calls using credential secrets belonging to a different workspace. The POST /api/v1/node-load-method/:name endpoint is mounted without route-level permission checks and resolves credentials by raw database ID via getCredentialData() without verifying that the credential's workspaceId matches the caller's active workspace - a check that all other credential-read paths in Flowise correctly enforce. Statically confirmed affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables; the raw decrypted credential secret is not returned to the attacker, but provider-returned resource metadata is. Fixed in version 3.1.4; no public exploit identified at time of analysis.
Cross-site request forgery in Site Kit by Google WordPress plugin version 1.186.0 and earlier allows an unauthenticated remote attacker to perform unauthorized actions on behalf of authenticated site administrators or editors. The flaw (CWE-352) exists because the plugin fails to properly validate request origin tokens, enabling forged state-changing requests to succeed when an authenticated victim interacts with attacker-controlled content. No public exploit has been identified at time of analysis, and real-world impact is constrained by the UI:R requirement - a legitimate privileged user must be socially engineered into triggering the request.
Stored cross-site scripting in the Easy Google Fonts WordPress plugin (versions ≤ 2.0.4) allows authenticated attackers with Author-level access to inject arbitrary JavaScript that executes in victims' browsers. The flaw stems from the plugin registering the `control_selectors` post meta field with `show_in_rest: true` and no `sanitize_callback`, then writing that unsanitized value directly into `<style>` tags rendered on the frontend. No public exploit or KEV listing is present at time of analysis, but the low privilege bar (Author) and automatic execution on page load make this an elevated concern for multi-author WordPress deployments.
Uncontrolled memory allocation in cel-go, Google's Go implementation of the Common Expression Language, allows remote unauthenticated attackers to trigger heap allocation proportional to the size of a submitted expression before the configured ParserExpressionSizeLimit is checked or enforced. Affected are all versions of cpe:2.3:a:google:cel-go:*:*:*:*:*:*:*:* whose Compile() and Parse() code paths call the pre-fix NewTextSource() without first bounding the input length. No public exploit code exists and this vulnerability has not been added to CISA KEV, but the trivially automatable nature of the attack makes it a meaningful denial-of-service risk for any service that exposes a CEL evaluation endpoint to user input.
CSV formula injection in Snipe-IT through 8.6.3 allows authenticated low-privilege users to plant spreadsheet formulas in the unaccepted assets acceptance report export, which execute in the spreadsheet client of any privileged user who downloads and opens the file. The ReportsController::postAssetAcceptanceReport method builds its CSV output by hand without applying the League\Csv\EscapeFormula sanitizer already wired into the six sibling exports in the same controller, permitting injection of =, +, -, @, tab, or CR-prefixed values into free-text fields such as asset name, company name, category, model, or assignee. When a reports.view-privileged user opens the resulting file in Excel, LibreOffice Calc, or Google Sheets, injected functions such as HYPERLINK or WEBSERVICE can exfiltrate spreadsheet context to an attacker-controlled server; on legacy Windows Excel configurations with DDE enabled, arbitrary command execution on the victim's workstation is also achievable. Fixed in version 8.7.0; no public exploit identified at time of analysis.
Time-based SQL injection in the WP Product Feed Manager WordPress plugin (marketed as WPMR Google Feed Manager for WooCommerce) exposes sensitive database contents to authenticated administrators. The 'feed' parameter is insufficiently escaped and passed without prepared statements across at least four PHP data-layer classes - enabling blind, time-delay-based SQL exfiltration from any WordPress installation running plugin versions up to and including 2.23.7. A remediation commit (SVN changeset 3677452) is confirmed in the plugin's WordPress repository; an officially tagged patched release version has not been independently confirmed from available references.
Uncontrolled recursion in Google go-attestation's Windows SIPA event log parser allows an unauthenticated remote attacker to crash any verifier application built on versions up to and including 0.6.1. The `readELAMAggregation` function in `attest/win_events.go` recurses for every nested `elamAggregation` sub-event without enforcing a maximum depth, and a size-guard bypass on recursive execution paths means even bounded input can drive unbounded stack growth. Submitting a crafted Windows event log with deeply nested ELAM headers exhausts the goroutine call stack, triggering an unrecoverable Go runtime panic that immediately terminates the verifier process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though a working proof-of-concept test case is embedded in the upstream fix PR.
Sensitive information disclosure in Google Chrome's Editing subsystem allows a remote unauthenticated attacker to exfiltrate browser-accessible data by luring a user to a crafted HTML page. All Chrome versions prior to 153.0.8010.36 on desktop are affected. No public exploit has been identified and SSVC assigns no active exploitation, making this a low operational priority despite the CVSS 6.5 score.
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer on Windows (prior to 153.0.8010.36) can expose limited memory content outside the Chrome sandbox to a remote attacker via a crafted HTML page. The vulnerability is platform-specific to Windows and requires user interaction to trigger, carrying a Chromium-assigned severity of Low and a CVSS score of 4.7. No public exploit or active exploitation has been identified; EPSS at 0.16% (6th percentile) confirms very low real-world exploitation probability, making this a routine patch priority rather than an emergency.
Sensitive information leak via the Frames component in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to obtain cross-origin data by enticing a user to visit a crafted HTML page. Exploitation requires user interaction but no privileges, delivering high confidentiality impact (C:H) despite Chromium's own 'Low' internal severity rating - a notable discrepancy suggesting the leaked data may be narrowly scoped in practice. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS sits at 0.27% (19th percentile), indicating low current exploitation pressure.
CORS origin-policy bypass in Google Chrome before 153.0.8010.36 allows a remote attacker, via social engineering and crafted network traffic, to circumvent the browser's web origin policy due to improper certificate validation in the CORS implementation (CWE-295). The impact is constrained to low-integrity effects - Chrome may treat cross-origin requests as authorized when they should be rejected - with no confidentiality or availability impact. No public exploit code exists, EPSS is 0.18% (7th percentile), and Chromium's own severity designation is 'Low', collectively confirming this as a low-priority but real integrity flaw.
Sensitive information leak in the Core component of Google Chrome prior to version 153.0.8010.36 allows a remote unauthenticated attacker to exfiltrate confidential browser or cross-origin data by inducing a user to visit a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H), yet Chromium's own internal severity is 'Low,' suggesting the leaked data may be bounded in scope or practical exploitability is constrained by the mandatory user-interaction requirement. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS probability is well below average at 0.27%.
Improper certificate validation in Google Chrome's Loader component (prior to 153.0.8010.36) enables remote attackers to bypass the browser's web origin policy via crafted network traffic combined with social engineering. The flaw (CWE-295) permits partial cross-origin data access and integrity impact, rated Low severity by Chromium's own classification despite a CVSS base score of 5.4. No public exploit exists and EPSS sits at 0.13% (3rd percentile), indicating very low exploitation probability at this time.
Incorrect authorization in Chrome's Loader component allows a remote attacker to bypass system access restrictions with limited confidentiality and integrity impact. Affected versions are all Chrome releases prior to 153.0.8010.36, and exploitation requires user interaction via a crafted HTML page combined with social engineering. No public exploit or active exploitation (CISA KEV) has been identified; the EPSS score of 0.17% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a low-priority issue relative to the broader Chrome vulnerability landscape.
Improper input validation in Google Chrome's Extensions component before version 153.0.8010.36 lets a remote attacker bypass web origin policy and reach content in a privileged page using crafted network traffic, but the attack requires the victim to interact with the malicious content (CVSS UI:R). Google's own Chromium security severity is rated Low and the NVD vector scores only 4.3 with integrity-only impact (C:N/I:L/A:N) and no confidentiality or availability loss. EPSS sits at just 0.22% (13th percentile), there is no CISA KEV listing and no public exploit identified, so this is best treated as a routine patch-cycle item rather than an emergency.
Missing authorization in Chrome's DOM implementation prior to version 153.0.8010.36 allows remote attackers to potentially leak sensitive information by luring a victim to a crafted HTML page. Rooted in CWE-862 (Missing Authorization), the flaw permits script or page contexts to access DOM nodes or properties without proper access-control enforcement, potentially bypassing intended cross-context isolation. No public exploit code exists and CISA has not listed this in KEV; EPSS of 0.22% (12th percentile) and SSVC Exploitation:none confirm negligible current threat activity.
Cross-origin data leakage in Google Chrome's Core component (all versions prior to 153.0.8010.36) enables a remote attacker to exfiltrate data from origins other than the attacker-controlled context via a specially crafted Chrome extension. The extension acts as the delivery mechanism, causing Chrome's Core to expose cross-origin content it should otherwise isolate. EPSS sits at 0.15% and Chromium's own severity rating is Low, consistent with the limited, read-only confidentiality impact and the user-interaction requirement for extension installation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Let me synthesize. CVE-2026-87473: Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. CWE-863. Note the inconsistency: Chromium severity Low vs CVSS 6.5 medium. No KEV, no POC mentioned. EPSS 0.27% (low, 20th percentile). Patch available. Affected versions: EUVD says ["Chrome 153.0.8010.36 <153.0.8010.36"] which is weird/nonsensical — version range malformed. Should flag? That's a data quality thing but "Do NOT flag severity/CVSS/version disagreements here". Hmm, malformed version range — it's about version disagreement. I'll mention in confidence_notes but not flag as data_quality_flag (the types allowed are mislabeled_tag/wrong_vendor/wrong_product/missing_tag). So version issues go to confidence_notes. Tags: "Authentication Bypass, Google". CWE-863 is incorrect authorization — "Authentication Bypass" is arguably a mislabeled tag but it's close... Actually CWE-863 is Incorrect Authorization, not authentication bypass. Is this a "mislabeled_tag"? The allowed types: mislabeled_tag with target being exact wrong value and suggested correct slug. Hmm, "Authentication Bypass" — the CVE is an authorization bypass, which is similar. I'd say it's borderline; the instructions say only emit when clearly wrong and verifiable. I think I should be cautious — leave it empty or flag it? The tag "Authentication Bypass" for a CWE-863 incorrect authorization... "Authorization Bypass" would be more accurate. But it's arguably acceptable colloquially. Also "Google" is the vendor which is correct for Chrome. Missing tag: "chrome" or "google-chrome"? The product is Chrome. Tags list has "Google" which is vendor. Could flag missing_tag for "Chrome" → suggested "chrome". That's plausible and high confidence. Hmm, is "chrome" tag clearly applicable? The product is Google Chrome; tags
UI spoofing in Google Chrome's Passwords component on Android (prior to 153.0.8010.36) enables a remote attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. The CVSS 5.4 (Medium) rating contrasts with Chromium's own 'Low' severity classification, a common divergence for UI-redressing issues. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS of 0.16% (6th percentile) confirms negligible near-term exploitation probability.
Sensitive information disclosure in Google Chrome's Transactions Platform component prior to version 153.0.8010.36 enables remote attackers to extract unspecified sensitive data by directing a user to a crafted HTML page. The Transactions Platform is likely tied to Chrome's Web Payments API or payment handler subsystem, making transaction-context data a plausible disclosure surface. No public exploit code exists and EPSS sits at 0.16% (6th percentile); however, the vendor-assigned CVSS C:H metric indicates the leaked data carries meaningful sensitivity, creating a tension with Chromium's own 'Low' internal severity classification.
Missing authorization in the Contacts component of Google Chrome before 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to extract sensitive contact data by delivering a crafted HTML page through social engineering. This is a secondary, post-renderer-compromise vulnerability - not an initial access vector - and Chromium's own team rates it 'Low' severity, reflecting the elevated prerequisite chain. No public exploit has been identified, EPSS sits at 0.16% (5th percentile), and CISA SSVC rates exploitation likelihood as none, collectively indicating minimal real-world risk at this time.
UI spoofing in the Passwords component of Google Chrome on Android (versions prior to 153.0.8010.36) enables an attacker who has already compromised the renderer process to display falsified password-manager interface elements via a crafted HTML page. Exploitation is constrained by a hard prerequisite - a separate renderer compromise must precede this attack - and requires user interaction with the malicious page. No public exploit code exists and EPSS sits at 0.16% (6th percentile), in line with Chromium's own 'Low' severity classification.
Address bar spoofing in Google Chrome's CustomTabs feature on Android (prior to 153.0.8010.36) allows a remote attacker to display a falsified URL by leveraging a co-installed application on the victim's device. The flaw, rooted in CWE-451 (User Interface Misrepresentation of Critical Information), enables phishing attacks where users are deceived into believing they are visiting a trusted origin while interacting with attacker-controlled content. Chromium rates this 'Low' severity; EPSS is 0.16% (6th percentile), no public exploits are identified, and no active exploitation is confirmed.
Sensitive credential information leak in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36) enables a remote unauthenticated attacker to extract password data by luring a victim to a crafted HTML page. Despite Chromium classifying the severity as 'Low', the NVD CVSS vector assigns C:H reflecting that full credential disclosure is possible. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.21% (11th percentile) signals low automated exploitation pressure at time of analysis.
Information disclosure in Google Chrome's DataTransfer API via a TOCTOU race condition allows a remote attacker to obtain sensitive data from a victim's browser session. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. Exploitation requires social engineering to induce user interaction with a crafted HTML page - no active exploitation has been identified and EPSS sits at the 9th percentile, indicating very low real-world exploitation probability at this time.
Sensitive information disclosure in Google Chrome's Mobile component on iOS (versions prior to 153.0.8010.36) allows remote unauthenticated attackers to leak confidential browser data by luring victims to a crafted HTML page through social engineering. The flaw is platform-specific - affecting only the iOS Mobile code path, not desktop or Android - and is fixed in the 153.0.8010.36 stable channel release. No active exploitation is confirmed (not in CISA KEV) and EPSS probability is 0.17% (7th percentile), consistent with Chromium's own 'Low' severity rating, which contrasts with the NVD CVSS 6.5 Medium score.
Clickjacking via UI spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to overlay deceptive UI elements through a crafted HTML page, requiring additional social engineering to complete the attack. The vulnerability (CWE-1021) affects all desktop Chrome builds before the September 2026 stable-channel release. No public exploit code exists and no active exploitation has been identified; EPSS of 0.20% (10th percentile) reflects the low probability of opportunistic exploitation given the demanding prerequisites.
Incorrect type conversion (CWE-704) in Chrome's Safebrowsing component on macOS allows remote attackers to bypass system access restrictions by delivering a specially crafted file, requiring user interaction to trigger. All Chrome for Mac versions prior to 153.0.8010.36 are affected; Google released the fix in the September 2026 stable channel update. No public exploit code exists and EPSS sits at 0.17% (7th percentile), consistent with Chromium's own 'Low' severity designation.
Address bar spoofing in Google Chrome for Android (all versions before 153.0.8010.36) exploits incorrect certificate authorization logic (CWE-863), allowing a remote attacker who can deliver crafted network traffic - such as via a man-in-the-middle position - to cause the browser to display a false origin in the address bar. The primary risk is phishing: users who trust the spoofed address bar may submit credentials or sensitive data to an attacker-controlled endpoint. Chromium's own team rated this Low severity, consistent with its CVSS 4.8 score and AC:H rating; no public exploit code and no active exploitation have been identified, and the EPSS score of 0.12% (2nd percentile) confirms very low real-world exploitation probability at time of analysis.
Cross-origin information leakage in Google Chrome's Select element (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to infer sensitive user state by observing behavioral discrepancies in how the `<select>` element renders when a victim browses to a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), a classic browser side-channel class that enables cross-site information inference - for example, whether a user is authenticated to a third-party origin or has visited specific URLs. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with the Chromium team's own 'Low' severity rating despite NVD's CVSS 6.5.
UI spoofing via a confused deputy flaw in Google Chrome's Fullscreen API (all versions prior to 153.0.8010.36) enables a remote attacker who has already compromised the renderer process to impersonate browser-trusted UI elements using a crafted HTML page and social engineering. This is a secondary exploitation step - it does not provide initial access - and becomes relevant only after a separate, higher-severity renderer compromise has been achieved. No public exploit code or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects very low automated exploitation probability consistent with the chained, human-dependent attack path.
Observable SVG discrepancy in Google Chrome prior to 153.0.8010.36 enables remote attackers to infer sensitive cross-origin information by inducing measurable rendering behavioral differences via a crafted HTML page. The root cause is CWE-203, a side-channel class where an attacker observes system behavior variations to deduce protected state. No public exploit code or active exploitation is identified; Chromium's own 'Low' severity designation and an EPSS of 0.17% (7th percentile) together indicate limited real-world exploitation likelihood despite the NVD's C:H confidentiality metric.
Out-of-bounds read in the Tint WGSL shader compiler in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to read limited memory contents within the browser's renderer sandbox by directing a victim to a crafted HTML page. Scope is confined to the sandbox (S:U/C:L), with no integrity or availability impact and no sandbox escape; Chromium rates this 'Low' severity, consistent with the CVSS 4.3 score. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), indicating low exploitation probability; a vendor-released patch is available in Chrome 153.0.8010.36.
An interpretation conflict (CWE-436) in Google Chrome's Safe Browsing handling on macOS allows a remote attacker to bypass system access restrictions by convincing a victim to open a crafted file, all the way up to and including Chrome 153.0.8010.36. Exploitation requires the victim to interact with the file (CVSS UI:R) and yields an integrity-only impact (C:N/I:H/A:N), which is consistent with Chromium's own 'Low' severity rating despite the 6.5 base score. There is no CISA KEV listing and no public exploit identified; EPSS is only 0.17% (7th percentile), and Google has shipped a fix in version 153.0.8010.36.
Missing authorization checking in the DevTools component of Google Chrome before 153.0.8010.36 lets a crafted Chrome extension read cross-origin data that should be protected by the browser's same-origin policy. Only confidentiality is affected (CVSS 4.3, C:L/I:N/A:N), and exploitation requires the victim to install the malicious extension (UI:R), so impact is limited to information disclosure from other sites the user has open. Google has shipped a fix in the 153.0.8010.36 stable channel release; EPSS is 0.21% (12th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a low-priority hardening update rather than an emergency patch.
Safebrowsing in Google Chrome prior to 153.0.8010.36 fails to properly validate internal state transitions (CWE-754), enabling a remote attacker to bypass the browser's URL-based access restriction mechanism via a crafted HTML page. Successful exploitation requires the victim to visit the attacker-controlled page (UI:R) and yields limited confidentiality and integrity impacts (C:L/I:L) with no availability impact. Chromium's own severity rating of 'Low' is consistent with the constrained impact scope; no public exploit code and no KEV listing have been identified at time of analysis.
UI spoofing in Google Chrome prior to 153.0.8010.36 permits a remote attacker who has already compromised the renderer process to present falsified browser interface elements to the user through crafted network traffic. The root cause is improper input validation (CWE-20) in the Chromium rendering engine, allowing a compromised renderer to influence UI presentation in ways the browser should reject. No public exploit or CISA KEV listing exists; an EPSS of 0.16% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a second-stage, chained capability rather than a standalone high-risk flaw.
Missing authorization (CWE-862) in Chrome's WebView component on Android prior to 153.0.8010.36 allows remote attackers to bypass Android system access restrictions through crafted network traffic. Exploitation is gated behind social engineering - the attacker must trick a user into interacting with malicious content, yielding a high integrity impact but no confidentiality or availability consequence. Chromium's own team rated this 'Low' severity, a notable divergence from the NVD CVSS 6.5, and no public exploit or active exploitation has been identified.
Site isolation bypass in Google Chrome Core prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to cross site isolation boundaries via a crafted HTML page. This is not a standalone exploit - it is a post-renderer-compromise escalation step that leverages a missing authorization check (CWE-862) in Chrome's Core component to violate the cross-origin process separation that site isolation guarantees. No public exploit code exists and EPSS is 0.18% (7th percentile), consistent with Chromium's own 'Low' severity rating; the practical bar for exploitation is high.
Incorrect authorization in Chrome's Safebrowsing component allows a remote, unauthenticated attacker to bypass system access restrictions by tricking a user into visiting a crafted HTML page via social engineering. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. No public exploit code has been identified, EPSS sits at 0.25%, and CISA SSVC rates exploitation as none - consistent with Chromium's own 'Low' severity designation, which contrasts with the NVD CVSS 6.5 Medium rating.
ServiceWorker incorrect authorization in Google Chrome prior to 153.0.8010.36 permits remote attackers to bypass the web origin policy by delivering a crafted HTML page to a target user. The root cause is CWE-863 (Incorrect Authorization) within Chrome's ServiceWorker subsystem, which fails to properly enforce cross-origin access boundaries. No active exploitation has been identified; Chrome's own security team rated the severity Low, consistent with the limited confidentiality-only impact reflected in the CVSS 4.3 score.
Incorrect authorization in the Web Authentication (WebAuthn) API implementation of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension. The bypass permits unauthorized cross-origin interaction with WebAuthn credentials, resulting in limited integrity impact. Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit code exists and EPSS stands at 0.21% (11th percentile), indicating minimal exploitation activity.
Cross-origin data leakage in Google Chrome's Prefetch subsystem (versions prior to 153.0.8010.36) enables a remote attacker to infer information about cross-origin resources via an observable discrepancy side-channel triggered by a crafted HTML page. The vulnerability affects unauthenticated users who visit the malicious page, requiring only passive user interaction (browsing). Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit or active exploitation has been identified at time of analysis.
Incorrect authorization in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to bypass the browser's web origin policy via a crafted HTML page. Exploitation is constrained by two hard prerequisites: a prior renderer process compromise and user interaction, reflected accurately in the CVSS 3.1 Low score and Chromium's own 'Low' severity classification. No public exploit code or active exploitation (CISA KEV) has been identified; SSVC rates exploitation status as none and automatable as no.
ServiceWorker missing authorization in Google Chrome prior to 153.0.8010.36 enables a renderer-compromised attacker to bypass system access restrictions via a crafted HTML page. The flaw (CWE-862) sits as the second step in a chained exploit: an attacker who has already achieved renderer process compromise leverages the ServiceWorker authorization gap to escalate beyond the renderer sandbox and tamper with integrity-sensitive system resources. Chromium internally rated this 'Low' severity, contrasting with the NVD CVSS base score of 6.5; no public exploit or CISA KEV listing exists at time of analysis.
UI misrepresentation in Google Chrome's FullScreen mode on Windows allows a remote attacker to spoof browser chrome and security-relevant UI elements by directing a victim to a crafted HTML page. Affected are all Chrome versions on Windows prior to 153.0.8010.36. This is a phishing-class attack vector: by hijacking the fullscreen rendering to simulate trusted UI (OS dialogs, address bar, lock icons, or other sites), an attacker can deceive users into performing unsafe actions or disclosing credentials. No public exploit has been identified and EPSS is 0.22%, reflecting low near-term exploitation probability.
Sensitive information disclosure in Google Chrome's Sources component exposes arbitrary sensitive data to remote attackers who can direct a user to a crafted HTML page. The flaw, fixed in Chrome 153.0.8010.36, stems from incorrect authorization checks (CWE-863) in the Sources subsystem - notably the same release that patched a cluster of higher-severity sandbox-escape RCEs. Despite the NVD CVSS score of 6.5 and C:H confidentiality rating, Chromium's own team rates this as Low severity, suggesting limited real-world exposure or constrained scope of the leaked data. No public exploit or active exploitation has been identified at time of analysis.
Incorrect authorization in the DeviceBoundSessionCredentials component of Google Chrome prior to 153.0.8010.36 allows remote attackers to bypass the web origin policy via crafted network traffic, producing a high-integrity impact with no confidentiality or availability effect. The DeviceBoundSessionCredentials feature, which binds authentication sessions to specific devices to reduce credential theft, fails to correctly enforce origin restrictions under this condition. No public exploit code exists and no active exploitation has been confirmed; the Chromium team rated this 'Medium' and EPSS stands at 0.21%.
Incorrect authorization in Chrome's Omnibox (address bar) prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions and gain unauthorized access to privileged browser pages. Exploitation requires luring a victim to visit a crafted HTML page, making this a social-engineering-dependent integrity attack. No public exploit code has been identified and EPSS sits at 0.18%, consistent with Chromium's own 'Medium' severity rating despite the NVD CVSS score of 6.5.
Incorrect authorization in Google Chrome's Extensions subsystem (prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension to a victim who interacts with it. The flaw, rooted in CWE-863 (Incorrect Authorization), enables integrity violations - specifically circumventing the permissions and access controls that govern what extension code can do on the host system. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% (9th percentile), consistent with Chromium's own 'Medium' severity classification.
Observable discrepancy in Chrome's Layout engine prior to version 153.0.8010.36 allows a remote attacker to infer sensitive cross-origin information by measuring rendering differences triggered by a crafted HTML page. The CWE-203 root cause - an attacker-observable behavioral difference that correlates with secret state - places this in the browser side-channel (XSLeak) family, where layout timing or geometry variations can reveal whether a user is authenticated to a third-party origin or whether specific cross-origin resources exist. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest.
Observable DOM discrepancy in Google Chrome prior to 153.0.8010.36 enables cross-origin information leakage via a CWE-203 side-channel, allowing a remote attacker to infer sensitive data from a victim's browser state. Exploitation requires social engineering to lure the target to a crafted HTML page, satisfying the required user interaction. No public exploit code or CISA KEV listing is associated with this vulnerability, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest at time of analysis.
Cross-site scripting in Google Chrome's SanitizerAPI (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to bypass the browser's web origin policy by serving a crafted HTML page to a victim. The SanitizerAPI is Chrome's browser-native HTML sanitization interface; a flaw in its processing allows certain crafted inputs to violate same-origin restrictions, enabling limited cross-origin data exposure. With CVSS 4.3 (Medium), an EPSS of 0.27%, no KEV listing, and no public exploit code identified, this is a low-urgency but confirmed patch target.
Incorrect authorization in Chrome's WebUI component allows a remote unauthenticated attacker to bypass system access restrictions and gain unauthorized access to privileged internal Chrome pages by luring a victim to visit a crafted HTML page. All Chrome desktop versions prior to 153.0.8010.36 are affected; Google patched this in the stable channel released September 2026. No public exploit has been identified at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects minimal current exploitation pressure.
Out-of-bounds read in ANGLE (Chrome's OpenGL ES translation layer) in Google Chrome prior to 153.0.8010.36 enables a remote unauthenticated attacker to read limited memory content outside the renderer sandbox by luring a user to a crafted HTML page. Unlike co-patched ANGLE issues in the same Chrome 153.0.8010.36 release that achieve full sandbox escape and remote code execution, this flaw is bounded to confidentiality impact only with no scope change - the read does not escape the renderer process. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.17% reflects minimal current attacker interest.
Cross-origin data exfiltration in Google Chrome's CORS implementation prior to 153.0.8010.36 is exploitable only as a second-stage technique by an attacker who has already compromised the renderer process, allowing them to read data from foreign origins the victim is authenticated to via a crafted HTML page. With a CVSS of 3.1, EPSS of 0.17% (7th percentile), no CISA KEV listing, and no public exploit code identified, this represents a low standalone risk - its relevance is as a data-harvesting primitive chained after a renderer RCE. Chromium rated it 'Medium,' consistent with the constrained exploitation path.
ControlledFrame in Google Chrome prior to 153.0.8010.36 exposes sensitive information to an attacker who has already achieved renderer process compromise, exploitable via a crafted HTML page (UI:R). This is a chained post-exploitation primitive rather than an initial access vector: it extends the damage of a separate renderer exploit by enabling cross-origin data exfiltration from the victim's session. No public exploit code exists, EPSS stands at 0.29% (21st percentile), and no CISA KEV listing is present, consistent with the high effective exploitation barrier imposed by the renderer pre-compromise requirement.
Cross-origin data disclosure in Google Chrome's Paint rendering component (versions prior to 153.0.8010.36) enables a remote attacker to read data belonging to a different web origin by directing a victim to a crafted HTML page. The root cause is an origin validation error (CWE-346) in the Paint pipeline, which under certain rendering conditions fails to enforce the Same-Origin Policy, leaking partial cross-origin data to the attacker-controlled page. EPSS is 0.14% (3rd percentile), Chromium rates this 'Medium,' and no public exploit or CISA KEV listing exists at time of analysis - placing this squarely in standard patch-cadence rather than emergency response territory.
Site isolation bypass in Google Chrome prior to 153.0.8010.36 allows a remote attacker to subvert cross-origin integrity guarantees by directing a victim to visit a crafted HTML page, exploiting incorrect authorization checks (CWE-863) in Chrome's Isolated component. The CVSS score rates integrity impact as High with no privileges required, but user interaction is necessary and confidentiality impact is assessed as none. No public exploit code exists and SSVC marks exploitation as none; EPSS stands at 0.18%, suggesting low observed threat activity despite the patch being available.
Missing authorization in Chrome's FileSystem component allows a remote attacker to bypass system access restrictions via a crafted HTML page, requiring social engineering to achieve user interaction. Affects all Chrome versions prior to 153.0.8010.36 across desktop platforms. With PR:N and I:H in the CVSS vector, an unauthenticated attacker who tricks a user into visiting a malicious page can achieve high-integrity impact against the local filesystem without confidentiality or availability consequences.
Race condition in the Browser component of Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by inducing a victim to visit a crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L) reflects limited, non-scope-changing impact - this is not a sandbox escape but a partial access-control bypass within the Browser process. EPSS at 0.20% (10th percentile), Chromium's own 'Medium' severity rating, and the absence of KEV listing or public exploit code all converge on low near-term exploitation risk.
UI misrepresentation in Google Chrome's Payments component prior to 153.0.8010.36 allows a remote attacker to spoof payment-related interface elements by serving a crafted HTML page. The spoofed UI can deceive users into believing they are interacting with legitimate Chrome payment dialogs, potentially facilitating credential or payment-data disclosure. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), placing real-world exploitation risk as low at this time.
Safebrowsing information omission in Google Chrome on macOS prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by delivering a crafted HTML page that causes Chrome's Safe Browsing subsystem to silently suppress or lose security-relevant signals. The CVSS vector (PR:N/UI:R/I:H) reflects that a victim need only visit a malicious page, after which Safebrowsing protections fail to surface warnings - exposing users to malicious downloads or sites without Chrome's normal safety guardrails. No public exploit code exists and EPSS is very low (0.20%, 10th percentile); no CISA KEV listing at time of analysis.
Sensitive information disclosure in the Enterprise component of Google Chrome on Windows allows a remote attacker to obtain protected data by luring a user to a crafted HTML page. All Chrome releases on Windows prior to 153.0.8010.36 are affected. No public exploit has been identified at the time of analysis, and with an EPSS of 0.17% (7th percentile), opportunistic mass exploitation is unlikely in the near term despite the high confidentiality impact rating.
Incorrect authorization in Google Chrome's Browser component on Android allows a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. Affected versions are all Chrome for Android releases prior to 153.0.8010.36. The vulnerability carries a CVSS score of 6.5 (Medium), consistent with Chromium's own 'Medium' severity classification, and no public exploit code or active exploitation has been identified at time of analysis.
CSS output encoding failure in Google Chrome prior to 153.0.8010.36 allows an unauthenticated remote attacker to potentially bypass the same-origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin information disclosure. The CVSS score of 4.3 aligns with Chromium's own 'Medium' severity classification, reflecting that the impact is scoped to partial confidentiality loss with no integrity or availability consequence. No active exploitation has been confirmed and EPSS remains low at 0.26%, indicating this is currently a theoretical risk addressed by the September 2026 stable channel update.
UI misrepresentation in Google Chrome's Geometry component (versions prior to 153.0.8010.36) enables remote attackers to spoof browser interface elements through a crafted HTML page, requiring social engineering to achieve user interaction. The flaw (CWE-451) permits an attacker to visually deceive victims about the true origin or nature of displayed content, creating a pathway for phishing and credential harvesting. No public exploit has been identified at time of analysis; vendor-released patch is available in the September 2026 stable channel update.
SiteIsolation incorrect authorization in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to bypass cross-origin access restrictions via a crafted HTML page. The flaw (CWE-863) carries a CVSS 6.5 with high integrity impact and no confidentiality or availability dimension, consistent with a second-stage sandbox-escape component rather than a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects very low observed exploitation probability; Chromium's own severity rating of 'Medium' aligns with this assessment.
Observable discrepancy (CWE-203) in the Safebrowsing component of Google Chrome on iOS prior to 153.0.8010.36 enables a remote attacker with a pre-compromised renderer process to leak sensitive information through behavioral differences when processing a crafted HTML page. The vulnerability is iOS-platform-specific and is chained after renderer compromise rather than exploited standalone. No public exploit exists and EPSS probability is 0.24%, consistent with the multi-stage exploitation requirement.
Incorrect authorization in Chrome's DataTransfer API (prior to 153.0.8010.36) permits an attacker who has already achieved renderer process compromise to read sensitive data via a crafted HTML page. The flaw (CWE-863) bypasses intended access-control checks on clipboard or drag-and-drop data within the renderer context, enabling information disclosure rather than code execution. No public exploit code exists and EPSS sits at 0.17% (6th percentile), reflecting this as a chained, second-stage attack primitive rather than a standalone initial-access vector.
Incorrect authorization in Chrome's Isolated component (all versions prior to 153.0.8010.36) enables remote attackers to spoof UI elements by directing users to a crafted HTML page. The flaw stems from CWE-863 authorization failures within Chrome's isolation architecture, allowing cross-boundary deception without requiring attacker authentication. No public exploit exists and EPSS is 0.17% (6th percentile), placing this firmly in the routine-patching tier despite the network-accessible attack vector.
Missing authorization in Google Chrome's FedCM (Federated Credential Management) component, versions prior to 153.0.8010.36, enables a remote attacker to bypass the web origin policy by luring a user to a crafted HTML page. The flaw (CWE-862) results in limited confidentiality impact - an origin-policy bypass that could expose data scoped to that cross-origin context. No public exploit exists and EPSS sits at 0.19% (9th percentile), consistent with Chromium's own 'Medium' severity rating and the requirement for user interaction.
ServiceWorker information leak in Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to extract sensitive information via a crafted HTML page. This is a chained exploitation technique rather than a standalone attack - requiring prior renderer process control as a hard prerequisite, making it a second-stage capability within a broader browser exploit chain. No public exploit code exists and EPSS sits at 0.29% (21st percentile), indicating low observed exploitation activity; the vulnerability is not listed in CISA KEV.
Safebrowsing in Google Chrome prior to 153.0.8010.36 can be bypassed through improper state validation (CWE-754), enabling a remote attacker to suppress Chrome's phishing and malware protection warnings by delivering a crafted HTML page to a victim. The integrity-only impact (CVSS I:H, C:N, A:N) reflects that successful exploitation undermines Chrome's access restriction enforcement rather than directly exfiltrating data, but it clears the path for downstream malware delivery or credential harvesting that Safebrowsing would otherwise have blocked. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.18% (8th percentile) corroborates low current weaponization probability.
Improper input validation in the Safebrowsing component of Google Chrome on Android prior to 153.0.8010.36 enables a remote attacker to bypass system access restrictions through a crafted HTML page. Exploitation requires social engineering to direct an Android Chrome user to the malicious page (UI:R), limiting opportunistic attack surface. No public exploit code has been identified and EPSS is very low (0.22%, 13th percentile), though the integrity-only CVSS 6.5 accurately reflects a meaningful access restriction bypass on a ubiquitously deployed browser. Vendor-released patch is available in Chrome 153.0.8010.36.
Uninitialized GPU resource use in Google Chrome on Android (prior to 153.0.8010.36) allows remote attackers to read process memory across the sandbox boundary via a crafted HTML page. The CVSS S:C (scope changed) metric confirms the vulnerability crosses Chrome's GPU sandbox, leaking partial memory contents outside the sandboxed GPU process to a network-positioned attacker. No public exploit or CISA KEV listing exists; EPSS of 0.31% (24th percentile) indicates low observed exploitation probability, consistent with Chromium's 'Medium' severity rating.
Cross-origin data leakage in the Chrome Downloads subsystem exposes sensitive information to attackers who have already established renderer process compromise. Chrome versions prior to 153.0.8010.36 are affected; exploitation requires a renderer-compromised context combined with user interaction via a crafted HTML page. Google rated this 'Medium' internally; the CVSS 3.1 score of 3.1 reflects its role as a second-stage exploitation step rather than a standalone critical flaw. No public exploit code or CISA KEV listing exists at time of analysis.
Navigation component information leak in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass site isolation and exfiltrate cross-origin data via a crafted HTML page. This is a second-stage exploit component: it cannot be chained without a prior renderer compromise, which significantly elevates the effective attack complexity despite the AV:N/AC:L CVSS surface reading. Chromium's own severity rating is 'Medium', consistent with the prerequisite constraint. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) reflects the elevated bar for exploitation.
Cross-origin data exposure in Google Chrome's Scroll component (all versions prior to 153.0.8010.36) enables an attacker who has already achieved renderer process compromise to exfiltrate sensitive data from other web origins via a crafted HTML page. This is a secondary-stage vulnerability - it does not provide initial access but extends an existing renderer compromise into a cross-origin information leak. Chromium rated this Medium severity, consistent with the 4.3 CVSS score; no public exploit exists and EPSS at 0.17% (7th percentile) reflects the narrow, chained exploitation scenario.
Cross-origin data leakage via Google Chrome's ServiceWorker implementation allows remote attackers to obtain information from other origins by serving a crafted HTML page to a victim. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.21% reflects low real-world exploitation activity.
UI element spoofing in Google Chrome's Geometry rendering component (versions prior to 153.0.8010.36) enables a remote attacker to misrepresent browser chrome and UI elements through a crafted HTML page, requiring the victim to visit the malicious page via social engineering. The vulnerability, classified under CWE-451 (User Interface Misrepresentation of Critical Information), allows an attacker to render fake address bars, security dialogs, or browser-level indicators in a way that deceives users into disclosing credentials or taking unintended actions. No public exploit code has been identified and no CISA KEV listing exists; EPSS at 0.21% (11th percentile) reflects negligible observed exploitation activity.
Incomplete cleanup in the Downloads component of Google Chrome prior to 153.0.8010.36 enables remote attackers to bypass system-level access restrictions, achieving high integrity impact without requiring any privileges. Exploitation requires social engineering: the victim must be lured to a crafted HTML page that triggers leftover state or residual artifacts from the Downloads subsystem, which Chrome fails to fully sanitize. EPSS is low (0.28%, 20th percentile) and no confirmed active exploitation or public proof-of-concept has been identified at time of analysis; Chromium's own internal severity rating of 'Medium' aligns with the NVD CVSS 6.5 score.
Missing authorization in the Downloads component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system-level access restrictions using a crafted Chrome extension. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects that user interaction is required to trigger the flaw, limiting automated mass exploitation. No public exploit has been identified, EPSS sits at 0.27% (19th percentile), and the Chromium team independently rates this as 'Medium' severity - all signals consistent with no confirmed active exploitation.
Google Chrome's browser UI component (all versions prior to 153.0.8010.36) is vulnerable to visual spoofing attacks where an attacker can manipulate how the browser presents security-critical interface elements to users. By serving a specially crafted HTML page combined with social engineering, a remote unauthenticated attacker can make Chrome display misleading UI indicators - such as deceptive origin representations or manipulated security signals - potentially enabling credential theft or unauthorized permission grants. No public exploit code exists and the EPSS score of 0.21% (11th percentile) indicates low near-term exploitation probability, consistent with Chromium's own Medium severity classification.
Address bar spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker to misrepresent the displayed URL via a specially crafted domain name, exploiting a flaw in the UrlFormatting subsystem. The attack requires social engineering to direct a victim to the attacker-controlled domain, after which the browser renders a deceptive address bar that masks the true origin. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low observed exploitation interest, consistent with the medium severity and UI:R requirement.
UI spoofing in Google Chrome's Session component (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent browser UI elements - such as session state indicators or security context - by delivering a crafted HTML page to a victim. The impact is deception-oriented: a user can be misled about the true security or session context of an interaction, enabling downstream phishing or session confusion attacks. No public exploit code has been identified and EPSS probability is 0.29% (21st percentile), consistent with no active exploitation at time of analysis.
UI misrepresentation in Google Chrome's Downloads component prior to 153.0.8010.36 allows remote attackers to bypass system access restrictions by deceiving users through a crafted HTML page. The flaw (CWE-451) causes Chrome to display misleading information about files being downloaded, enabling social-engineering attacks that trick users into accepting or executing content they would otherwise reject. Chromium rates this Medium severity, consistent with the CVSS 5.4; no public exploit code exists and EPSS at 0.24% (15th percentile) reflects low exploitation probability at time of analysis.
UI misrepresentation in Google Chrome's FedCM (Federated Credential Management) API prior to 153.0.8010.36 enables remote attackers to spoof identity-provider sign-in dialogs via crafted HTML pages, requiring user interaction. The flaw (CWE-451) allows a malicious page to manipulate how FedCM presents credential prompts, potentially misleading users into authorizing the wrong identity provider or disclosing credential context to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified; EPSS is 0.17%, consistent with Chromium's 'Medium' severity classification.
Clickjacking in Google Chrome's Downloads component (all versions prior to 153.0.8010.36) enables a remote attacker to spoof Chrome's download UI elements by luring a victim to a crafted HTML page. Through UI overlay or frame-stacking techniques, the attacker can make a user believe they are interacting with legitimate Chrome download controls while actually triggering attacker-defined actions. No public exploit code exists and EPSS of 0.24% (15th percentile) reflects low real-world exploitation probability; Chromium's own severity rating of Medium aligns with the CVSS 5.4 score.
Clickjacking via TrustedWebActivities (TWA) in Google Chrome on Android prior to 153.0.8010.36 allows a local attacker with a co-installed malicious app to spoof the browser address bar, enabling deceptive phishing scenarios where the user believes they are on a trusted domain. The attack leverages CWE-1021 (UI layer redressing) in Chrome's TWA feature, which is designed to let Android apps surface web content with reduced browser chrome. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), consistent with the local-access requirement and high attack complexity. Google has released the fix in the stable channel update to 153.0.8010.36.
Cross-workspace credential IDOR in Flowise versions up to and including 3.1.3 allows an authenticated low-privilege user in one workspace to invoke third-party provider API calls using credential secrets belonging to a different workspace. The POST /api/v1/node-load-method/:name endpoint is mounted without route-level permission checks and resolves credentials by raw database ID via getCredentialData() without verifying that the credential's workspaceId matches the caller's active workspace - a check that all other credential-read paths in Flowise correctly enforce. Statically confirmed affected load methods include Google Drive listFiles, Google Sheets listSpreadsheets, and AWS DynamoDB KV Storage listTables; the raw decrypted credential secret is not returned to the attacker, but provider-returned resource metadata is. Fixed in version 3.1.4; no public exploit identified at time of analysis.
Cross-site request forgery in Site Kit by Google WordPress plugin version 1.186.0 and earlier allows an unauthenticated remote attacker to perform unauthorized actions on behalf of authenticated site administrators or editors. The flaw (CWE-352) exists because the plugin fails to properly validate request origin tokens, enabling forged state-changing requests to succeed when an authenticated victim interacts with attacker-controlled content. No public exploit has been identified at time of analysis, and real-world impact is constrained by the UI:R requirement - a legitimate privileged user must be socially engineered into triggering the request.
Stored cross-site scripting in the Easy Google Fonts WordPress plugin (versions ≤ 2.0.4) allows authenticated attackers with Author-level access to inject arbitrary JavaScript that executes in victims' browsers. The flaw stems from the plugin registering the `control_selectors` post meta field with `show_in_rest: true` and no `sanitize_callback`, then writing that unsanitized value directly into `<style>` tags rendered on the frontend. No public exploit or KEV listing is present at time of analysis, but the low privilege bar (Author) and automatic execution on page load make this an elevated concern for multi-author WordPress deployments.
Uncontrolled memory allocation in cel-go, Google's Go implementation of the Common Expression Language, allows remote unauthenticated attackers to trigger heap allocation proportional to the size of a submitted expression before the configured ParserExpressionSizeLimit is checked or enforced. Affected are all versions of cpe:2.3:a:google:cel-go:*:*:*:*:*:*:*:* whose Compile() and Parse() code paths call the pre-fix NewTextSource() without first bounding the input length. No public exploit code exists and this vulnerability has not been added to CISA KEV, but the trivially automatable nature of the attack makes it a meaningful denial-of-service risk for any service that exposes a CEL evaluation endpoint to user input.
CSV formula injection in Snipe-IT through 8.6.3 allows authenticated low-privilege users to plant spreadsheet formulas in the unaccepted assets acceptance report export, which execute in the spreadsheet client of any privileged user who downloads and opens the file. The ReportsController::postAssetAcceptanceReport method builds its CSV output by hand without applying the League\Csv\EscapeFormula sanitizer already wired into the six sibling exports in the same controller, permitting injection of =, +, -, @, tab, or CR-prefixed values into free-text fields such as asset name, company name, category, model, or assignee. When a reports.view-privileged user opens the resulting file in Excel, LibreOffice Calc, or Google Sheets, injected functions such as HYPERLINK or WEBSERVICE can exfiltrate spreadsheet context to an attacker-controlled server; on legacy Windows Excel configurations with DDE enabled, arbitrary command execution on the victim's workstation is also achievable. Fixed in version 8.7.0; no public exploit identified at time of analysis.
Time-based SQL injection in the WP Product Feed Manager WordPress plugin (marketed as WPMR Google Feed Manager for WooCommerce) exposes sensitive database contents to authenticated administrators. The 'feed' parameter is insufficiently escaped and passed without prepared statements across at least four PHP data-layer classes - enabling blind, time-delay-based SQL exfiltration from any WordPress installation running plugin versions up to and including 2.23.7. A remediation commit (SVN changeset 3677452) is confirmed in the plugin's WordPress repository; an officially tagged patched release version has not been independently confirmed from available references.
Uncontrolled recursion in Google go-attestation's Windows SIPA event log parser allows an unauthenticated remote attacker to crash any verifier application built on versions up to and including 0.6.1. The `readELAMAggregation` function in `attest/win_events.go` recurses for every nested `elamAggregation` sub-event without enforcing a maximum depth, and a size-guard bypass on recursive execution paths means even bounded input can drive unbounded stack growth. Submitting a crafted Windows event log with deeply nested ELAM headers exhausts the goroutine call stack, triggering an unrecoverable Go runtime panic that immediately terminates the verifier process. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though a working proof-of-concept test case is embedded in the upstream fix PR.
Sensitive information disclosure in Google Chrome's Editing subsystem allows a remote unauthenticated attacker to exfiltrate browser-accessible data by luring a user to a crafted HTML page. All Chrome versions prior to 153.0.8010.36 on desktop are affected. No public exploit has been identified and SSVC assigns no active exploitation, making this a low operational priority despite the CVSS 6.5 score.
Out-of-bounds read in Chrome's ANGLE graphics abstraction layer on Windows (prior to 153.0.8010.36) can expose limited memory content outside the Chrome sandbox to a remote attacker via a crafted HTML page. The vulnerability is platform-specific to Windows and requires user interaction to trigger, carrying a Chromium-assigned severity of Low and a CVSS score of 4.7. No public exploit or active exploitation has been identified; EPSS at 0.16% (6th percentile) confirms very low real-world exploitation probability, making this a routine patch priority rather than an emergency.
Sensitive information leak via the Frames component in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to obtain cross-origin data by enticing a user to visit a crafted HTML page. Exploitation requires user interaction but no privileges, delivering high confidentiality impact (C:H) despite Chromium's own 'Low' internal severity rating - a notable discrepancy suggesting the leaked data may be narrowly scoped in practice. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS sits at 0.27% (19th percentile), indicating low current exploitation pressure.
CORS origin-policy bypass in Google Chrome before 153.0.8010.36 allows a remote attacker, via social engineering and crafted network traffic, to circumvent the browser's web origin policy due to improper certificate validation in the CORS implementation (CWE-295). The impact is constrained to low-integrity effects - Chrome may treat cross-origin requests as authorized when they should be rejected - with no confidentiality or availability impact. No public exploit code exists, EPSS is 0.18% (7th percentile), and Chromium's own severity designation is 'Low', collectively confirming this as a low-priority but real integrity flaw.
Sensitive information leak in the Core component of Google Chrome prior to version 153.0.8010.36 allows a remote unauthenticated attacker to exfiltrate confidential browser or cross-origin data by inducing a user to visit a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H), yet Chromium's own internal severity is 'Low,' suggesting the leaked data may be bounded in scope or practical exploitability is constrained by the mandatory user-interaction requirement. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS probability is well below average at 0.27%.
Improper certificate validation in Google Chrome's Loader component (prior to 153.0.8010.36) enables remote attackers to bypass the browser's web origin policy via crafted network traffic combined with social engineering. The flaw (CWE-295) permits partial cross-origin data access and integrity impact, rated Low severity by Chromium's own classification despite a CVSS base score of 5.4. No public exploit exists and EPSS sits at 0.13% (3rd percentile), indicating very low exploitation probability at this time.
Incorrect authorization in Chrome's Loader component allows a remote attacker to bypass system access restrictions with limited confidentiality and integrity impact. Affected versions are all Chrome releases prior to 153.0.8010.36, and exploitation requires user interaction via a crafted HTML page combined with social engineering. No public exploit or active exploitation (CISA KEV) has been identified; the EPSS score of 0.17% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a low-priority issue relative to the broader Chrome vulnerability landscape.
Improper input validation in Google Chrome's Extensions component before version 153.0.8010.36 lets a remote attacker bypass web origin policy and reach content in a privileged page using crafted network traffic, but the attack requires the victim to interact with the malicious content (CVSS UI:R). Google's own Chromium security severity is rated Low and the NVD vector scores only 4.3 with integrity-only impact (C:N/I:L/A:N) and no confidentiality or availability loss. EPSS sits at just 0.22% (13th percentile), there is no CISA KEV listing and no public exploit identified, so this is best treated as a routine patch-cycle item rather than an emergency.
Missing authorization in Chrome's DOM implementation prior to version 153.0.8010.36 allows remote attackers to potentially leak sensitive information by luring a victim to a crafted HTML page. Rooted in CWE-862 (Missing Authorization), the flaw permits script or page contexts to access DOM nodes or properties without proper access-control enforcement, potentially bypassing intended cross-context isolation. No public exploit code exists and CISA has not listed this in KEV; EPSS of 0.22% (12th percentile) and SSVC Exploitation:none confirm negligible current threat activity.
Cross-origin data leakage in Google Chrome's Core component (all versions prior to 153.0.8010.36) enables a remote attacker to exfiltrate data from origins other than the attacker-controlled context via a specially crafted Chrome extension. The extension acts as the delivery mechanism, causing Chrome's Core to expose cross-origin content it should otherwise isolate. EPSS sits at 0.15% and Chromium's own severity rating is Low, consistent with the limited, read-only confidentiality impact and the user-interaction requirement for extension installation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Let me synthesize. CVE-2026-87473: Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. CWE-863. Note the inconsistency: Chromium severity Low vs CVSS 6.5 medium. No KEV, no POC mentioned. EPSS 0.27% (low, 20th percentile). Patch available. Affected versions: EUVD says ["Chrome 153.0.8010.36 <153.0.8010.36"] which is weird/nonsensical — version range malformed. Should flag? That's a data quality thing but "Do NOT flag severity/CVSS/version disagreements here". Hmm, malformed version range — it's about version disagreement. I'll mention in confidence_notes but not flag as data_quality_flag (the types allowed are mislabeled_tag/wrong_vendor/wrong_product/missing_tag). So version issues go to confidence_notes. Tags: "Authentication Bypass, Google". CWE-863 is incorrect authorization — "Authentication Bypass" is arguably a mislabeled tag but it's close... Actually CWE-863 is Incorrect Authorization, not authentication bypass. Is this a "mislabeled_tag"? The allowed types: mislabeled_tag with target being exact wrong value and suggested correct slug. Hmm, "Authentication Bypass" — the CVE is an authorization bypass, which is similar. I'd say it's borderline; the instructions say only emit when clearly wrong and verifiable. I think I should be cautious — leave it empty or flag it? The tag "Authentication Bypass" for a CWE-863 incorrect authorization... "Authorization Bypass" would be more accurate. But it's arguably acceptable colloquially. Also "Google" is the vendor which is correct for Chrome. Missing tag: "chrome" or "google-chrome"? The product is Chrome. Tags list has "Google" which is vendor. Could flag missing_tag for "Chrome" → suggested "chrome". That's plausible and high confidence. Hmm, is "chrome" tag clearly applicable? The product is Google Chrome; tags
UI spoofing in Google Chrome's Passwords component on Android (prior to 153.0.8010.36) enables a remote attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. The CVSS 5.4 (Medium) rating contrasts with Chromium's own 'Low' severity classification, a common divergence for UI-redressing issues. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS of 0.16% (6th percentile) confirms negligible near-term exploitation probability.
Sensitive information disclosure in Google Chrome's Transactions Platform component prior to version 153.0.8010.36 enables remote attackers to extract unspecified sensitive data by directing a user to a crafted HTML page. The Transactions Platform is likely tied to Chrome's Web Payments API or payment handler subsystem, making transaction-context data a plausible disclosure surface. No public exploit code exists and EPSS sits at 0.16% (6th percentile); however, the vendor-assigned CVSS C:H metric indicates the leaked data carries meaningful sensitivity, creating a tension with Chromium's own 'Low' internal severity classification.
Missing authorization in the Contacts component of Google Chrome before 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to extract sensitive contact data by delivering a crafted HTML page through social engineering. This is a secondary, post-renderer-compromise vulnerability - not an initial access vector - and Chromium's own team rates it 'Low' severity, reflecting the elevated prerequisite chain. No public exploit has been identified, EPSS sits at 0.16% (5th percentile), and CISA SSVC rates exploitation likelihood as none, collectively indicating minimal real-world risk at this time.
UI spoofing in the Passwords component of Google Chrome on Android (versions prior to 153.0.8010.36) enables an attacker who has already compromised the renderer process to display falsified password-manager interface elements via a crafted HTML page. Exploitation is constrained by a hard prerequisite - a separate renderer compromise must precede this attack - and requires user interaction with the malicious page. No public exploit code exists and EPSS sits at 0.16% (6th percentile), in line with Chromium's own 'Low' severity classification.
Address bar spoofing in Google Chrome's CustomTabs feature on Android (prior to 153.0.8010.36) allows a remote attacker to display a falsified URL by leveraging a co-installed application on the victim's device. The flaw, rooted in CWE-451 (User Interface Misrepresentation of Critical Information), enables phishing attacks where users are deceived into believing they are visiting a trusted origin while interacting with attacker-controlled content. Chromium rates this 'Low' severity; EPSS is 0.16% (6th percentile), no public exploits are identified, and no active exploitation is confirmed.
Sensitive credential information leak in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36) enables a remote unauthenticated attacker to extract password data by luring a victim to a crafted HTML page. Despite Chromium classifying the severity as 'Low', the NVD CVSS vector assigns C:H reflecting that full credential disclosure is possible. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.21% (11th percentile) signals low automated exploitation pressure at time of analysis.
Information disclosure in Google Chrome's DataTransfer API via a TOCTOU race condition allows a remote attacker to obtain sensitive data from a victim's browser session. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. Exploitation requires social engineering to induce user interaction with a crafted HTML page - no active exploitation has been identified and EPSS sits at the 9th percentile, indicating very low real-world exploitation probability at this time.
Sensitive information disclosure in Google Chrome's Mobile component on iOS (versions prior to 153.0.8010.36) allows remote unauthenticated attackers to leak confidential browser data by luring victims to a crafted HTML page through social engineering. The flaw is platform-specific - affecting only the iOS Mobile code path, not desktop or Android - and is fixed in the 153.0.8010.36 stable channel release. No active exploitation is confirmed (not in CISA KEV) and EPSS probability is 0.17% (7th percentile), consistent with Chromium's own 'Low' severity rating, which contrasts with the NVD CVSS 6.5 Medium score.
Clickjacking via UI spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to overlay deceptive UI elements through a crafted HTML page, requiring additional social engineering to complete the attack. The vulnerability (CWE-1021) affects all desktop Chrome builds before the September 2026 stable-channel release. No public exploit code exists and no active exploitation has been identified; EPSS of 0.20% (10th percentile) reflects the low probability of opportunistic exploitation given the demanding prerequisites.
Incorrect type conversion (CWE-704) in Chrome's Safebrowsing component on macOS allows remote attackers to bypass system access restrictions by delivering a specially crafted file, requiring user interaction to trigger. All Chrome for Mac versions prior to 153.0.8010.36 are affected; Google released the fix in the September 2026 stable channel update. No public exploit code exists and EPSS sits at 0.17% (7th percentile), consistent with Chromium's own 'Low' severity designation.
Address bar spoofing in Google Chrome for Android (all versions before 153.0.8010.36) exploits incorrect certificate authorization logic (CWE-863), allowing a remote attacker who can deliver crafted network traffic - such as via a man-in-the-middle position - to cause the browser to display a false origin in the address bar. The primary risk is phishing: users who trust the spoofed address bar may submit credentials or sensitive data to an attacker-controlled endpoint. Chromium's own team rated this Low severity, consistent with its CVSS 4.8 score and AC:H rating; no public exploit code and no active exploitation have been identified, and the EPSS score of 0.12% (2nd percentile) confirms very low real-world exploitation probability at time of analysis.
Cross-origin information leakage in Google Chrome's Select element (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to infer sensitive user state by observing behavioral discrepancies in how the `<select>` element renders when a victim browses to a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), a classic browser side-channel class that enables cross-site information inference - for example, whether a user is authenticated to a third-party origin or has visited specific URLs. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with the Chromium team's own 'Low' severity rating despite NVD's CVSS 6.5.
UI spoofing via a confused deputy flaw in Google Chrome's Fullscreen API (all versions prior to 153.0.8010.36) enables a remote attacker who has already compromised the renderer process to impersonate browser-trusted UI elements using a crafted HTML page and social engineering. This is a secondary exploitation step - it does not provide initial access - and becomes relevant only after a separate, higher-severity renderer compromise has been achieved. No public exploit code or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects very low automated exploitation probability consistent with the chained, human-dependent attack path.
Observable SVG discrepancy in Google Chrome prior to 153.0.8010.36 enables remote attackers to infer sensitive cross-origin information by inducing measurable rendering behavioral differences via a crafted HTML page. The root cause is CWE-203, a side-channel class where an attacker observes system behavior variations to deduce protected state. No public exploit code or active exploitation is identified; Chromium's own 'Low' severity designation and an EPSS of 0.17% (7th percentile) together indicate limited real-world exploitation likelihood despite the NVD's C:H confidentiality metric.
Out-of-bounds read in the Tint WGSL shader compiler in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to read limited memory contents within the browser's renderer sandbox by directing a victim to a crafted HTML page. Scope is confined to the sandbox (S:U/C:L), with no integrity or availability impact and no sandbox escape; Chromium rates this 'Low' severity, consistent with the CVSS 4.3 score. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), indicating low exploitation probability; a vendor-released patch is available in Chrome 153.0.8010.36.
An interpretation conflict (CWE-436) in Google Chrome's Safe Browsing handling on macOS allows a remote attacker to bypass system access restrictions by convincing a victim to open a crafted file, all the way up to and including Chrome 153.0.8010.36. Exploitation requires the victim to interact with the file (CVSS UI:R) and yields an integrity-only impact (C:N/I:H/A:N), which is consistent with Chromium's own 'Low' severity rating despite the 6.5 base score. There is no CISA KEV listing and no public exploit identified; EPSS is only 0.17% (7th percentile), and Google has shipped a fix in version 153.0.8010.36.
Missing authorization checking in the DevTools component of Google Chrome before 153.0.8010.36 lets a crafted Chrome extension read cross-origin data that should be protected by the browser's same-origin policy. Only confidentiality is affected (CVSS 4.3, C:L/I:N/A:N), and exploitation requires the victim to install the malicious extension (UI:R), so impact is limited to information disclosure from other sites the user has open. Google has shipped a fix in the 153.0.8010.36 stable channel release; EPSS is 0.21% (12th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a low-priority hardening update rather than an emergency patch.
Safebrowsing in Google Chrome prior to 153.0.8010.36 fails to properly validate internal state transitions (CWE-754), enabling a remote attacker to bypass the browser's URL-based access restriction mechanism via a crafted HTML page. Successful exploitation requires the victim to visit the attacker-controlled page (UI:R) and yields limited confidentiality and integrity impacts (C:L/I:L) with no availability impact. Chromium's own severity rating of 'Low' is consistent with the constrained impact scope; no public exploit code and no KEV listing have been identified at time of analysis.
UI spoofing in Google Chrome prior to 153.0.8010.36 permits a remote attacker who has already compromised the renderer process to present falsified browser interface elements to the user through crafted network traffic. The root cause is improper input validation (CWE-20) in the Chromium rendering engine, allowing a compromised renderer to influence UI presentation in ways the browser should reject. No public exploit or CISA KEV listing exists; an EPSS of 0.16% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a second-stage, chained capability rather than a standalone high-risk flaw.
Missing authorization (CWE-862) in Chrome's WebView component on Android prior to 153.0.8010.36 allows remote attackers to bypass Android system access restrictions through crafted network traffic. Exploitation is gated behind social engineering - the attacker must trick a user into interacting with malicious content, yielding a high integrity impact but no confidentiality or availability consequence. Chromium's own team rated this 'Low' severity, a notable divergence from the NVD CVSS 6.5, and no public exploit or active exploitation has been identified.
Site isolation bypass in Google Chrome Core prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to cross site isolation boundaries via a crafted HTML page. This is not a standalone exploit - it is a post-renderer-compromise escalation step that leverages a missing authorization check (CWE-862) in Chrome's Core component to violate the cross-origin process separation that site isolation guarantees. No public exploit code exists and EPSS is 0.18% (7th percentile), consistent with Chromium's own 'Low' severity rating; the practical bar for exploitation is high.
Incorrect authorization in Chrome's Safebrowsing component allows a remote, unauthenticated attacker to bypass system access restrictions by tricking a user into visiting a crafted HTML page via social engineering. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. No public exploit code has been identified, EPSS sits at 0.25%, and CISA SSVC rates exploitation as none - consistent with Chromium's own 'Low' severity designation, which contrasts with the NVD CVSS 6.5 Medium rating.
ServiceWorker incorrect authorization in Google Chrome prior to 153.0.8010.36 permits remote attackers to bypass the web origin policy by delivering a crafted HTML page to a target user. The root cause is CWE-863 (Incorrect Authorization) within Chrome's ServiceWorker subsystem, which fails to properly enforce cross-origin access boundaries. No active exploitation has been identified; Chrome's own security team rated the severity Low, consistent with the limited confidentiality-only impact reflected in the CVSS 4.3 score.
Incorrect authorization in the Web Authentication (WebAuthn) API implementation of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension. The bypass permits unauthorized cross-origin interaction with WebAuthn credentials, resulting in limited integrity impact. Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit code exists and EPSS stands at 0.21% (11th percentile), indicating minimal exploitation activity.
Cross-origin data leakage in Google Chrome's Prefetch subsystem (versions prior to 153.0.8010.36) enables a remote attacker to infer information about cross-origin resources via an observable discrepancy side-channel triggered by a crafted HTML page. The vulnerability affects unauthenticated users who visit the malicious page, requiring only passive user interaction (browsing). Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit or active exploitation has been identified at time of analysis.
Incorrect authorization in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to bypass the browser's web origin policy via a crafted HTML page. Exploitation is constrained by two hard prerequisites: a prior renderer process compromise and user interaction, reflected accurately in the CVSS 3.1 Low score and Chromium's own 'Low' severity classification. No public exploit code or active exploitation (CISA KEV) has been identified; SSVC rates exploitation status as none and automatable as no.
ServiceWorker missing authorization in Google Chrome prior to 153.0.8010.36 enables a renderer-compromised attacker to bypass system access restrictions via a crafted HTML page. The flaw (CWE-862) sits as the second step in a chained exploit: an attacker who has already achieved renderer process compromise leverages the ServiceWorker authorization gap to escalate beyond the renderer sandbox and tamper with integrity-sensitive system resources. Chromium internally rated this 'Low' severity, contrasting with the NVD CVSS base score of 6.5; no public exploit or CISA KEV listing exists at time of analysis.
UI misrepresentation in Google Chrome's FullScreen mode on Windows allows a remote attacker to spoof browser chrome and security-relevant UI elements by directing a victim to a crafted HTML page. Affected are all Chrome versions on Windows prior to 153.0.8010.36. This is a phishing-class attack vector: by hijacking the fullscreen rendering to simulate trusted UI (OS dialogs, address bar, lock icons, or other sites), an attacker can deceive users into performing unsafe actions or disclosing credentials. No public exploit has been identified and EPSS is 0.22%, reflecting low near-term exploitation probability.
Sensitive information disclosure in Google Chrome's Sources component exposes arbitrary sensitive data to remote attackers who can direct a user to a crafted HTML page. The flaw, fixed in Chrome 153.0.8010.36, stems from incorrect authorization checks (CWE-863) in the Sources subsystem - notably the same release that patched a cluster of higher-severity sandbox-escape RCEs. Despite the NVD CVSS score of 6.5 and C:H confidentiality rating, Chromium's own team rates this as Low severity, suggesting limited real-world exposure or constrained scope of the leaked data. No public exploit or active exploitation has been identified at time of analysis.
Incorrect authorization in the DeviceBoundSessionCredentials component of Google Chrome prior to 153.0.8010.36 allows remote attackers to bypass the web origin policy via crafted network traffic, producing a high-integrity impact with no confidentiality or availability effect. The DeviceBoundSessionCredentials feature, which binds authentication sessions to specific devices to reduce credential theft, fails to correctly enforce origin restrictions under this condition. No public exploit code exists and no active exploitation has been confirmed; the Chromium team rated this 'Medium' and EPSS stands at 0.21%.
Incorrect authorization in Chrome's Omnibox (address bar) prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions and gain unauthorized access to privileged browser pages. Exploitation requires luring a victim to visit a crafted HTML page, making this a social-engineering-dependent integrity attack. No public exploit code has been identified and EPSS sits at 0.18%, consistent with Chromium's own 'Medium' severity rating despite the NVD CVSS score of 6.5.
Incorrect authorization in Google Chrome's Extensions subsystem (prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension to a victim who interacts with it. The flaw, rooted in CWE-863 (Incorrect Authorization), enables integrity violations - specifically circumventing the permissions and access controls that govern what extension code can do on the host system. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% (9th percentile), consistent with Chromium's own 'Medium' severity classification.
Observable discrepancy in Chrome's Layout engine prior to version 153.0.8010.36 allows a remote attacker to infer sensitive cross-origin information by measuring rendering differences triggered by a crafted HTML page. The CWE-203 root cause - an attacker-observable behavioral difference that correlates with secret state - places this in the browser side-channel (XSLeak) family, where layout timing or geometry variations can reveal whether a user is authenticated to a third-party origin or whether specific cross-origin resources exist. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest.
Observable DOM discrepancy in Google Chrome prior to 153.0.8010.36 enables cross-origin information leakage via a CWE-203 side-channel, allowing a remote attacker to infer sensitive data from a victim's browser state. Exploitation requires social engineering to lure the target to a crafted HTML page, satisfying the required user interaction. No public exploit code or CISA KEV listing is associated with this vulnerability, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest at time of analysis.
Cross-site scripting in Google Chrome's SanitizerAPI (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to bypass the browser's web origin policy by serving a crafted HTML page to a victim. The SanitizerAPI is Chrome's browser-native HTML sanitization interface; a flaw in its processing allows certain crafted inputs to violate same-origin restrictions, enabling limited cross-origin data exposure. With CVSS 4.3 (Medium), an EPSS of 0.27%, no KEV listing, and no public exploit code identified, this is a low-urgency but confirmed patch target.
Incorrect authorization in Chrome's WebUI component allows a remote unauthenticated attacker to bypass system access restrictions and gain unauthorized access to privileged internal Chrome pages by luring a victim to visit a crafted HTML page. All Chrome desktop versions prior to 153.0.8010.36 are affected; Google patched this in the stable channel released September 2026. No public exploit has been identified at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects minimal current exploitation pressure.
Out-of-bounds read in ANGLE (Chrome's OpenGL ES translation layer) in Google Chrome prior to 153.0.8010.36 enables a remote unauthenticated attacker to read limited memory content outside the renderer sandbox by luring a user to a crafted HTML page. Unlike co-patched ANGLE issues in the same Chrome 153.0.8010.36 release that achieve full sandbox escape and remote code execution, this flaw is bounded to confidentiality impact only with no scope change - the read does not escape the renderer process. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.17% reflects minimal current attacker interest.
Cross-origin data exfiltration in Google Chrome's CORS implementation prior to 153.0.8010.36 is exploitable only as a second-stage technique by an attacker who has already compromised the renderer process, allowing them to read data from foreign origins the victim is authenticated to via a crafted HTML page. With a CVSS of 3.1, EPSS of 0.17% (7th percentile), no CISA KEV listing, and no public exploit code identified, this represents a low standalone risk - its relevance is as a data-harvesting primitive chained after a renderer RCE. Chromium rated it 'Medium,' consistent with the constrained exploitation path.
ControlledFrame in Google Chrome prior to 153.0.8010.36 exposes sensitive information to an attacker who has already achieved renderer process compromise, exploitable via a crafted HTML page (UI:R). This is a chained post-exploitation primitive rather than an initial access vector: it extends the damage of a separate renderer exploit by enabling cross-origin data exfiltration from the victim's session. No public exploit code exists, EPSS stands at 0.29% (21st percentile), and no CISA KEV listing is present, consistent with the high effective exploitation barrier imposed by the renderer pre-compromise requirement.
Cross-origin data disclosure in Google Chrome's Paint rendering component (versions prior to 153.0.8010.36) enables a remote attacker to read data belonging to a different web origin by directing a victim to a crafted HTML page. The root cause is an origin validation error (CWE-346) in the Paint pipeline, which under certain rendering conditions fails to enforce the Same-Origin Policy, leaking partial cross-origin data to the attacker-controlled page. EPSS is 0.14% (3rd percentile), Chromium rates this 'Medium,' and no public exploit or CISA KEV listing exists at time of analysis - placing this squarely in standard patch-cadence rather than emergency response territory.
Site isolation bypass in Google Chrome prior to 153.0.8010.36 allows a remote attacker to subvert cross-origin integrity guarantees by directing a victim to visit a crafted HTML page, exploiting incorrect authorization checks (CWE-863) in Chrome's Isolated component. The CVSS score rates integrity impact as High with no privileges required, but user interaction is necessary and confidentiality impact is assessed as none. No public exploit code exists and SSVC marks exploitation as none; EPSS stands at 0.18%, suggesting low observed threat activity despite the patch being available.
Missing authorization in Chrome's FileSystem component allows a remote attacker to bypass system access restrictions via a crafted HTML page, requiring social engineering to achieve user interaction. Affects all Chrome versions prior to 153.0.8010.36 across desktop platforms. With PR:N and I:H in the CVSS vector, an unauthenticated attacker who tricks a user into visiting a malicious page can achieve high-integrity impact against the local filesystem without confidentiality or availability consequences.
Race condition in the Browser component of Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by inducing a victim to visit a crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L) reflects limited, non-scope-changing impact - this is not a sandbox escape but a partial access-control bypass within the Browser process. EPSS at 0.20% (10th percentile), Chromium's own 'Medium' severity rating, and the absence of KEV listing or public exploit code all converge on low near-term exploitation risk.
UI misrepresentation in Google Chrome's Payments component prior to 153.0.8010.36 allows a remote attacker to spoof payment-related interface elements by serving a crafted HTML page. The spoofed UI can deceive users into believing they are interacting with legitimate Chrome payment dialogs, potentially facilitating credential or payment-data disclosure. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), placing real-world exploitation risk as low at this time.
Safebrowsing information omission in Google Chrome on macOS prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by delivering a crafted HTML page that causes Chrome's Safe Browsing subsystem to silently suppress or lose security-relevant signals. The CVSS vector (PR:N/UI:R/I:H) reflects that a victim need only visit a malicious page, after which Safebrowsing protections fail to surface warnings - exposing users to malicious downloads or sites without Chrome's normal safety guardrails. No public exploit code exists and EPSS is very low (0.20%, 10th percentile); no CISA KEV listing at time of analysis.
Sensitive information disclosure in the Enterprise component of Google Chrome on Windows allows a remote attacker to obtain protected data by luring a user to a crafted HTML page. All Chrome releases on Windows prior to 153.0.8010.36 are affected. No public exploit has been identified at the time of analysis, and with an EPSS of 0.17% (7th percentile), opportunistic mass exploitation is unlikely in the near term despite the high confidentiality impact rating.
Incorrect authorization in Google Chrome's Browser component on Android allows a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. Affected versions are all Chrome for Android releases prior to 153.0.8010.36. The vulnerability carries a CVSS score of 6.5 (Medium), consistent with Chromium's own 'Medium' severity classification, and no public exploit code or active exploitation has been identified at time of analysis.
CSS output encoding failure in Google Chrome prior to 153.0.8010.36 allows an unauthenticated remote attacker to potentially bypass the same-origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin information disclosure. The CVSS score of 4.3 aligns with Chromium's own 'Medium' severity classification, reflecting that the impact is scoped to partial confidentiality loss with no integrity or availability consequence. No active exploitation has been confirmed and EPSS remains low at 0.26%, indicating this is currently a theoretical risk addressed by the September 2026 stable channel update.
UI misrepresentation in Google Chrome's Geometry component (versions prior to 153.0.8010.36) enables remote attackers to spoof browser interface elements through a crafted HTML page, requiring social engineering to achieve user interaction. The flaw (CWE-451) permits an attacker to visually deceive victims about the true origin or nature of displayed content, creating a pathway for phishing and credential harvesting. No public exploit has been identified at time of analysis; vendor-released patch is available in the September 2026 stable channel update.
SiteIsolation incorrect authorization in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to bypass cross-origin access restrictions via a crafted HTML page. The flaw (CWE-863) carries a CVSS 6.5 with high integrity impact and no confidentiality or availability dimension, consistent with a second-stage sandbox-escape component rather than a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects very low observed exploitation probability; Chromium's own severity rating of 'Medium' aligns with this assessment.
Observable discrepancy (CWE-203) in the Safebrowsing component of Google Chrome on iOS prior to 153.0.8010.36 enables a remote attacker with a pre-compromised renderer process to leak sensitive information through behavioral differences when processing a crafted HTML page. The vulnerability is iOS-platform-specific and is chained after renderer compromise rather than exploited standalone. No public exploit exists and EPSS probability is 0.24%, consistent with the multi-stage exploitation requirement.
Incorrect authorization in Chrome's DataTransfer API (prior to 153.0.8010.36) permits an attacker who has already achieved renderer process compromise to read sensitive data via a crafted HTML page. The flaw (CWE-863) bypasses intended access-control checks on clipboard or drag-and-drop data within the renderer context, enabling information disclosure rather than code execution. No public exploit code exists and EPSS sits at 0.17% (6th percentile), reflecting this as a chained, second-stage attack primitive rather than a standalone initial-access vector.
Incorrect authorization in Chrome's Isolated component (all versions prior to 153.0.8010.36) enables remote attackers to spoof UI elements by directing users to a crafted HTML page. The flaw stems from CWE-863 authorization failures within Chrome's isolation architecture, allowing cross-boundary deception without requiring attacker authentication. No public exploit exists and EPSS is 0.17% (6th percentile), placing this firmly in the routine-patching tier despite the network-accessible attack vector.
Missing authorization in Google Chrome's FedCM (Federated Credential Management) component, versions prior to 153.0.8010.36, enables a remote attacker to bypass the web origin policy by luring a user to a crafted HTML page. The flaw (CWE-862) results in limited confidentiality impact - an origin-policy bypass that could expose data scoped to that cross-origin context. No public exploit exists and EPSS sits at 0.19% (9th percentile), consistent with Chromium's own 'Medium' severity rating and the requirement for user interaction.
ServiceWorker information leak in Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to extract sensitive information via a crafted HTML page. This is a chained exploitation technique rather than a standalone attack - requiring prior renderer process control as a hard prerequisite, making it a second-stage capability within a broader browser exploit chain. No public exploit code exists and EPSS sits at 0.29% (21st percentile), indicating low observed exploitation activity; the vulnerability is not listed in CISA KEV.
Safebrowsing in Google Chrome prior to 153.0.8010.36 can be bypassed through improper state validation (CWE-754), enabling a remote attacker to suppress Chrome's phishing and malware protection warnings by delivering a crafted HTML page to a victim. The integrity-only impact (CVSS I:H, C:N, A:N) reflects that successful exploitation undermines Chrome's access restriction enforcement rather than directly exfiltrating data, but it clears the path for downstream malware delivery or credential harvesting that Safebrowsing would otherwise have blocked. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.18% (8th percentile) corroborates low current weaponization probability.
Improper input validation in the Safebrowsing component of Google Chrome on Android prior to 153.0.8010.36 enables a remote attacker to bypass system access restrictions through a crafted HTML page. Exploitation requires social engineering to direct an Android Chrome user to the malicious page (UI:R), limiting opportunistic attack surface. No public exploit code has been identified and EPSS is very low (0.22%, 13th percentile), though the integrity-only CVSS 6.5 accurately reflects a meaningful access restriction bypass on a ubiquitously deployed browser. Vendor-released patch is available in Chrome 153.0.8010.36.
Uninitialized GPU resource use in Google Chrome on Android (prior to 153.0.8010.36) allows remote attackers to read process memory across the sandbox boundary via a crafted HTML page. The CVSS S:C (scope changed) metric confirms the vulnerability crosses Chrome's GPU sandbox, leaking partial memory contents outside the sandboxed GPU process to a network-positioned attacker. No public exploit or CISA KEV listing exists; EPSS of 0.31% (24th percentile) indicates low observed exploitation probability, consistent with Chromium's 'Medium' severity rating.
Cross-origin data leakage in the Chrome Downloads subsystem exposes sensitive information to attackers who have already established renderer process compromise. Chrome versions prior to 153.0.8010.36 are affected; exploitation requires a renderer-compromised context combined with user interaction via a crafted HTML page. Google rated this 'Medium' internally; the CVSS 3.1 score of 3.1 reflects its role as a second-stage exploitation step rather than a standalone critical flaw. No public exploit code or CISA KEV listing exists at time of analysis.
Navigation component information leak in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass site isolation and exfiltrate cross-origin data via a crafted HTML page. This is a second-stage exploit component: it cannot be chained without a prior renderer compromise, which significantly elevates the effective attack complexity despite the AV:N/AC:L CVSS surface reading. Chromium's own severity rating is 'Medium', consistent with the prerequisite constraint. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) reflects the elevated bar for exploitation.
Cross-origin data exposure in Google Chrome's Scroll component (all versions prior to 153.0.8010.36) enables an attacker who has already achieved renderer process compromise to exfiltrate sensitive data from other web origins via a crafted HTML page. This is a secondary-stage vulnerability - it does not provide initial access but extends an existing renderer compromise into a cross-origin information leak. Chromium rated this Medium severity, consistent with the 4.3 CVSS score; no public exploit exists and EPSS at 0.17% (7th percentile) reflects the narrow, chained exploitation scenario.
Cross-origin data leakage via Google Chrome's ServiceWorker implementation allows remote attackers to obtain information from other origins by serving a crafted HTML page to a victim. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.21% reflects low real-world exploitation activity.
UI element spoofing in Google Chrome's Geometry rendering component (versions prior to 153.0.8010.36) enables a remote attacker to misrepresent browser chrome and UI elements through a crafted HTML page, requiring the victim to visit the malicious page via social engineering. The vulnerability, classified under CWE-451 (User Interface Misrepresentation of Critical Information), allows an attacker to render fake address bars, security dialogs, or browser-level indicators in a way that deceives users into disclosing credentials or taking unintended actions. No public exploit code has been identified and no CISA KEV listing exists; EPSS at 0.21% (11th percentile) reflects negligible observed exploitation activity.
Incomplete cleanup in the Downloads component of Google Chrome prior to 153.0.8010.36 enables remote attackers to bypass system-level access restrictions, achieving high integrity impact without requiring any privileges. Exploitation requires social engineering: the victim must be lured to a crafted HTML page that triggers leftover state or residual artifacts from the Downloads subsystem, which Chrome fails to fully sanitize. EPSS is low (0.28%, 20th percentile) and no confirmed active exploitation or public proof-of-concept has been identified at time of analysis; Chromium's own internal severity rating of 'Medium' aligns with the NVD CVSS 6.5 score.
Missing authorization in the Downloads component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system-level access restrictions using a crafted Chrome extension. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects that user interaction is required to trigger the flaw, limiting automated mass exploitation. No public exploit has been identified, EPSS sits at 0.27% (19th percentile), and the Chromium team independently rates this as 'Medium' severity - all signals consistent with no confirmed active exploitation.
Google Chrome's browser UI component (all versions prior to 153.0.8010.36) is vulnerable to visual spoofing attacks where an attacker can manipulate how the browser presents security-critical interface elements to users. By serving a specially crafted HTML page combined with social engineering, a remote unauthenticated attacker can make Chrome display misleading UI indicators - such as deceptive origin representations or manipulated security signals - potentially enabling credential theft or unauthorized permission grants. No public exploit code exists and the EPSS score of 0.21% (11th percentile) indicates low near-term exploitation probability, consistent with Chromium's own Medium severity classification.
Address bar spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker to misrepresent the displayed URL via a specially crafted domain name, exploiting a flaw in the UrlFormatting subsystem. The attack requires social engineering to direct a victim to the attacker-controlled domain, after which the browser renders a deceptive address bar that masks the true origin. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low observed exploitation interest, consistent with the medium severity and UI:R requirement.
UI spoofing in Google Chrome's Session component (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent browser UI elements - such as session state indicators or security context - by delivering a crafted HTML page to a victim. The impact is deception-oriented: a user can be misled about the true security or session context of an interaction, enabling downstream phishing or session confusion attacks. No public exploit code has been identified and EPSS probability is 0.29% (21st percentile), consistent with no active exploitation at time of analysis.
UI misrepresentation in Google Chrome's Downloads component prior to 153.0.8010.36 allows remote attackers to bypass system access restrictions by deceiving users through a crafted HTML page. The flaw (CWE-451) causes Chrome to display misleading information about files being downloaded, enabling social-engineering attacks that trick users into accepting or executing content they would otherwise reject. Chromium rates this Medium severity, consistent with the CVSS 5.4; no public exploit code exists and EPSS at 0.24% (15th percentile) reflects low exploitation probability at time of analysis.
UI misrepresentation in Google Chrome's FedCM (Federated Credential Management) API prior to 153.0.8010.36 enables remote attackers to spoof identity-provider sign-in dialogs via crafted HTML pages, requiring user interaction. The flaw (CWE-451) allows a malicious page to manipulate how FedCM presents credential prompts, potentially misleading users into authorizing the wrong identity provider or disclosing credential context to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified; EPSS is 0.17%, consistent with Chromium's 'Medium' severity classification.
Clickjacking in Google Chrome's Downloads component (all versions prior to 153.0.8010.36) enables a remote attacker to spoof Chrome's download UI elements by luring a victim to a crafted HTML page. Through UI overlay or frame-stacking techniques, the attacker can make a user believe they are interacting with legitimate Chrome download controls while actually triggering attacker-defined actions. No public exploit code exists and EPSS of 0.24% (15th percentile) reflects low real-world exploitation probability; Chromium's own severity rating of Medium aligns with the CVSS 5.4 score.
Clickjacking via TrustedWebActivities (TWA) in Google Chrome on Android prior to 153.0.8010.36 allows a local attacker with a co-installed malicious app to spoof the browser address bar, enabling deceptive phishing scenarios where the user believes they are on a trusted domain. The attack leverages CWE-1021 (UI layer redressing) in Chrome's TWA feature, which is designed to let Android apps surface web content with reduced browser chrome. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), consistent with the local-access requirement and high attack complexity. Google has released the fix in the stable channel update to 153.0.8010.36.