Monthly
UI spoofing in Google Chrome's FedCM (Federated Credential Management) implementation allows an attacker who has already compromised the renderer process to inject malformed identity-provider dialog elements via a crafted HTML page, potentially deceiving users into submitting credentials to an attacker-controlled endpoint. All Chrome desktop versions prior to 153.0.8010.36 are affected. The attack is two-stage: an independent renderer-compromise vulnerability must first be exploited, making this a chained post-exploitation capability rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
UI misrepresentation in Google Chrome prior to 153.0.8010.36 allows a remote attacker to spoof browser UI elements - such as the address bar, security indicators, or permission dialogs - via a specially crafted HTML page, requiring social engineering to lure the victim. Exploiting CWE-451, the attacker can deceive users into trusting a malicious or phishing page as legitimate, potentially leading to credential theft or other user-driven disclosures. No public exploit code has been identified and EPSS is 0.24% (15th percentile), consistent with the Chromium team's 'Medium' severity rating and the high-complexity social engineering prerequisite.
UI misrepresentation in Google Chrome's Downloads panel prior to version 153.0.8010.36 allows a remote attacker to spoof download-related UI elements, potentially deceiving users into accepting or running malicious content they believe to be legitimate. The vulnerability is triggered by a crafted HTML page and requires social engineering to lure a victim into visiting the attacker-controlled page. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) places real-world exploitation risk low; however, Chrome's ubiquitous deployment keeps the absolute exposure surface significant.
Improper input validation in Chrome's Interstitials component - the full-page security warning screens shown for SSL errors, Safe Browsing alerts, and download warnings - allows a remote attacker to spoof UI elements by delivering a crafted HTML page to an unsuspecting user. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No public exploit code has been identified and EPSS stands at 0.17% (7th percentile), reflecting low near-term exploitation probability, though successful abuse could undermine user trust in browser security indicators and facilitate phishing or credential harvesting.
Cross-origin data leakage in Google Chrome's Navigation component prior to version 153.0.8010.36 exposes partial information about cross-origin resources through an observable behavioral discrepancy (CWE-203 side-channel). Remote unauthenticated attackers can exploit this by serving a crafted HTML page that a victim visits, allowing inference of cross-origin data that should be protected by the Same-Origin Policy. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS at the 15th percentile confirms limited real-world exploitation pressure. Vendor-released patch is available as Chrome 153.0.8010.36.
Incorrect GPU authorization in Google Chrome on macOS (prior to 153.0.8010.36) allows an attacker who has already compromised the renderer process to read cross-origin data by directing the victim to a crafted HTML page. This is a second-stage, chained vulnerability - not an initial access primitive - requiring prior renderer compromise and user interaction, which constrains its practical exploitability. Chromium rates this Medium, consistent with the CVSS 3.1 base score and the strictly limited confidentiality-only impact.
UI spoofing in Google Chrome's Passwords component (versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. Classified as CWE-451 (UI Misrepresentation of Critical Information), this flaw could deceive users into believing they are interacting with a legitimate password prompt or credential management interface when they are not, potentially facilitating credential phishing or confusion attacks. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Improper state validation in Google Chrome's Installer component (prior to 153.0.8010.36) allows remote attackers to bypass system access restrictions by serving a crafted HTML page to a user. The vulnerability carries a Chromium-assigned severity of Medium and an NVD CVSS base score of 4.3, with limited integrity impact and no confidentiality or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places exploitation probability at a low 0.30%.
Web origin policy bypass in Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to circumvent Same-Origin Policy (SOP) restrictions by exploiting improper input validation in the Network component via a crafted HTML page. The CVSS 4.3 Medium rating is consistent with Chromium's own 'Medium' severity classification, with impact limited to partial confidentiality loss and no integrity or availability consequence. No public exploit code is identified and EPSS sits at 0.18% (8th percentile), indicating very low near-term exploitation probability.
Web origin policy bypass in Google Chrome's Loader component (versions prior to 153.0.8010.36) lets a remote attacker circumvent same-origin protections by serving a crafted HTML page, potentially reading cross-origin resources the attacker should not have access to. The CVSS score of 4.3 and Chromium's own 'Medium' severity rating are consistent, reflecting a confidentiality-only impact with no integrity or availability consequence and no sandbox escape. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS places exploitation probability at 0.26% (18th percentile), indicating low real-world exploitation likelihood.
Missing authorization in Google Chrome's Browser component (prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions via a crafted HTML page. The CWE-862 root cause - an absent authorization check rather than a broken one - means the Browser component fails to enforce expected access control boundaries when processing certain HTML content. Chromium rated this 'Medium' severity, consistent with the CVSS 4.3 score reflecting limited integrity-only impact and a requirement for user interaction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
UI spoofing in Google Chrome's Accessibility subsystem on macOS (all versions prior to 153.0.8010.36) stems from incorrect reference resolution (CWE-706), enabling a remote unauthenticated attacker to mislead users into perceiving fraudulent UI elements via a crafted HTML page. The attack requires a user to visit a malicious page, and no active exploitation or public proof-of-concept code has been identified at time of analysis. Vendor-released patch 153.0.8010.36 is available via the Chrome stable channel update published on the Chrome Releases blog.
Cross-origin data leakage in Google Chrome's Network component prior to version 153.0.8010.36 allows remote attackers to infer information about cross-origin resources through observable behavioral discrepancies (CWE-203). Exploitation requires a victim to visit a crafted HTML page (UI:R) and involves high attack complexity (AC:H), indicating that reliable exploitation depends on meeting specific preconditions in the victim's browser or network environment. With an EPSS of 0.21% (11th percentile), no CISA KEV listing, and no confirmed public exploit, real-world risk is low despite the network-accessible attack vector.
Cross-origin data disclosure in Chrome's WebMCP component before 153.0.8010.36 enables a renderer-compromised attacker to exfiltrate cross-origin page data via a crafted HTML page. This is a second-stage vulnerability in a multi-step exploit chain - it does not enable initial access but amplifies the impact of a prior renderer compromise by breaking the same-origin boundary through the WebMCP interface. With a CVSS score of 3.1, EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, real-world risk is low except in targeted attack chains pairing this with a separate, more severe renderer exploit.
Missing authorization in Google Chrome's Browser component (versions prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions by directing users to a crafted HTML page. The flaw, classified as CWE-862 (Missing Authorization), carries a CVSS 4.3 Medium score with a limited integrity impact and no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.19% (9th percentile), placing real-world exploitation risk well below the threshold warranting emergency response.
Incorrect authorization in Chrome's Navigation component (versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to spoof browser UI elements - such as the address bar or security indicators - via a crafted HTML page. This is a chained exploit step, not a standalone vulnerability: renderer-level code execution via a separate flaw is a hard prerequisite. Chromium classifies severity as 'Medium,' consistent with the CVSS 4.2 score; no public exploit code and no active exploitation (CISA KEV) have been identified.
Missing authorization in Chrome's ControlledFrame component allows remote unauthenticated attackers to bypass system access restrictions by socially engineering a victim into visiting a crafted HTML page. Versions prior to 153.0.8010.36 are affected across desktop platforms; Google shipped a fix in the stable channel update. No public exploit or CISA KEV listing exists, and an EPSS of 0.29% confirms low real-world exploitation probability consistent with Chromium's own 'Medium' severity rating.
Incomplete cleanup in Google Chrome's Browser component (all versions prior to 153.0.8010.36) enables a remote attacker to bypass the web same-origin policy via a crafted Chrome extension, contingent on social engineering the victim into installing it. The integrity impact is high - a successful attacker can tamper with cross-origin web content - while confidentiality and availability are unaffected per the CVSS vector (C:N/A:N). No public exploit code or CISA KEV listing exists at time of analysis, and an EPSS score of 0.28% at the 21st percentile reflects low observed exploitation probability.
Omnibox in Google Chrome prior to 153.0.8010.36 permits a remote unauthenticated attacker to bypass system access restrictions and navigate into privileged internal browser pages through a crafted HTML page delivered via social engineering. The root cause is missing authorization (CWE-862) in the Omnibox component, meaning Chrome fails to enforce access controls before allowing navigation to restricted page contexts. No public exploit or active exploitation has been identified; Chromium rates this Medium, consistent with the CVSS 6.5 score and mandatory user interaction requirement.
Incorrect authorization in the Loader component of Google Chrome prior to 153.0.8010.36 enables a remote attacker to obtain sensitive information by luring a victim to a crafted HTML page. The CVSS base score of 6.5 and Chromium's own 'Medium' severity rating are consistent, reflecting the high confidentiality impact constrained by mandatory user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.23% places this in the 14th percentile for near-term exploitation likelihood.
Uninitialized GPU resource in Google Chrome for Android (prior to 153.0.8010.36) allows a renderer-compromised attacker to read memory outside the browser sandbox via a crafted HTML page. This is a second-stage vulnerability - it requires the renderer process to already be compromised, meaning it operates as a chained exploit component rather than an independent attack path. No public exploit has been identified; EPSS is 0.19% (9th percentile), and the Chromium team rates severity as Medium, consistent with the constrained impact and high prerequisite bar.
Uninitialized memory in the Codecs component of Google Chrome before 153.0.8010.36 leaks sandbox-internal memory to a remote attacker via a crafted HTML page. The vulnerability stems from CWE-908 (use of uninitialized resource) where codec processing exposes arbitrary memory contents that happen to reside in uninitialized buffers - but exploitation is constrained entirely within the Chrome sandbox (S:U). No active exploitation is confirmed and no public exploit code exists; EPSS stands at 0.19% (9th percentile), consistent with a low-priority medium-severity disclosure issue.
Cleartext transmission of sensitive information via the HttpsUpgrades component in Google Chrome on iOS (versions prior to 153.0.8010.36) exposes user data to network-positioned attackers through crafted traffic. The HttpsUpgrades mechanism, which is responsible for automatically promoting HTTP requests to HTTPS, fails under certain conditions on iOS, leaving sensitive request content unencrypted in transit. With no public exploit identified and high attack complexity required (network positioning), the real-world risk is moderate despite the C:H confidentiality impact.
Incorrect authorization in the WebAppInstalls subsystem of Google Chrome before 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to bypass Chrome's site isolation via a crafted HTML page combined with social engineering. This is a chained, second-stage exploit - not a standalone vulnerability - requiring a prior renderer compromise before the WebAppInstalls flaw can be weaponized. Chromium rates it 'Medium' and EPSS sits at 0.19%, consistent with the high exploitation prerequisite; no public exploit code or CISA KEV listing exists.
Improper input validation in Chrome's built-in Passwords component (all versions prior to 153.0.8010.36) enables a remote, unauthenticated attacker to potentially leak sensitive stored credential data via crafted network traffic. The flaw is rated CVSS 5.9 (AC:H), with Chromium assigning a 'Medium' severity consistent with the meaningful exploitation complexity required. No public exploits or active exploitation have been identified at time of analysis.
Integer overflow in Chrome's WebRTC subsystem (prior to 153.0.8010.36) enables remote unauthenticated attackers to read memory within the browser's renderer sandbox by directing a victim to a crafted HTML page. The impact is confined to a partial confidentiality breach inside the sandbox - no integrity or availability compromise results. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.24% places this in the bottom quartile of near-term exploitation likelihood.
Missing authorization in the Actor component of Google Chrome before 153.0.8010.36 allows remote attackers to read sensitive browser information by inducing a victim to visit a crafted HTML page. The flaw (CWE-862) reflects a failure to enforce access control checks in an internal Chromium IPC/actor abstraction, exposing confidential data without requiring credentials. With CVSS 6.5 (Medium), EPSS at 0.28% (20th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a real but lower-priority information disclosure fixed in the September 2026 stable channel update.
Safebrowsing in Google Chrome prior to 153.0.8010.36 contains improper state validation (CWE-754) that allows a remote, unauthenticated attacker to bypass system access restrictions enforced by the Safe Browsing subsystem via a specially crafted HTML page. The bypass yields partial confidentiality and integrity impact (C:L/I:L) but no availability impact, consistent with circumventing protective filtering rather than achieving code execution. No active exploitation has been confirmed - EPSS is 0.24% (15th percentile) and the CVE is absent from CISA KEV - and Chromium's own severity assessment of 'Medium' aligns with the CVSS 5.4 score.
Cross-site request forgery in Chrome's DeviceBoundSessionCredentials (DBSC) subsystem allows a remote, unauthenticated attacker to bypass the web origin policy by luring a victim to a crafted HTML page. DeviceBoundSessionCredentials is Chrome's mechanism for cryptographically binding session tokens to a specific device, and the CSRF flaw undermines that origin-isolation guarantee, potentially allowing limited credential scope leakage (C:L). No public exploit code exists and no active exploitation has been confirmed; the EPSS score of 0.17% (7th percentile) and Chromium's own 'Medium' severity rating align with the modest real-world risk.
Origin-policy bypass in Google Chrome's Isolated component (prior to 153.0.8010.36) enables unauthenticated remote attackers to cross into privileged page contexts via a crafted HTML page requiring one click from the victim. Chromium rates this Medium severity, consistent with the CVSS 4.3 score and its limited confidentiality-only impact. No public exploit or active exploitation has been identified; EPSS at 0.19% (9th percentile) confirms very low near-term exploitation probability.
Cross-origin data disclosure in Google Chrome's WebGL subsystem (all versions prior to 153.0.8010.36) enables remote attackers to read residual GPU memory belonging to other origins by serving a crafted HTML page to an unpatched user. The root cause is CWE-908 (use of uninitialized resource): Chrome's WebGL implementation exposed GPU-side buffers to JavaScript before zeroing them, allowing fragments of prior rendering operations from cross-origin contexts to be read back. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.29%, consistent with the Medium Chromium severity rating and the limited, read-only impact.
Race condition in the Payments component of Google Chrome prior to 153.0.8010.36 enables remote attackers to spoof payment UI elements by delivering a crafted HTML page combined with social engineering, requiring user interaction to trigger the vulnerable timing window. The CWE-362 race condition in Chrome's Payment Request handling allows the attacker to substitute or overlay legitimate payment dialogs with fraudulent ones during the race window, potentially tricking victims into submitting payment credentials to attacker-controlled endpoints. No public exploit code exists and EPSS of 0.14% (4th percentile) reflects very low exploitation probability; Chromium rates this Medium severity.
Missing authorization in Chrome's FileSystem API allows a remote unauthenticated attacker to bypass system-level file access restrictions by luring a user to a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36. The CVSS vector (I:H, C:N) indicates high integrity impact with no confidentiality exposure, meaning the attacker can write or modify files accessible through the FileSystem API without reading them. No public exploit has been identified and EPSS sits at 0.18% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Incorrect authorization in Chrome's Web Workers component enables remote unauthenticated attackers to bypass the browser's same-origin policy (web origin isolation) by inducing a victim to visit a crafted HTML page. All Google Chrome desktop versions prior to 153.0.8010.36 are affected. The impact is confined to partial cross-origin data read (C:L), with no integrity or availability consequences; no public exploit code and no active exploitation have been identified at time of analysis.
Incorrect authorization in Chrome's PushAPI (all versions prior to 153.0.8010.36) permits a remote attacker who has already obtained a renderer process compromise to bypass the web origin policy, potentially gaining access to push subscription data belonging to other web origins. This is a chained, secondary-stage vulnerability - it extends a renderer compromise rather than providing initial access, and its confidentiality impact is limited to PushAPI subscription metadata. No public exploit exists and EPSS is low at 0.29%; a vendor patch is available in the stable channel release 153.0.8010.36.
CORS authorization bypass in Google Chrome prior to 153.0.8010.36 enables a remote attacker - who has already compromised the renderer process - to circumvent the browser's web origin policy via a crafted HTML page. The vulnerability is classified CWE-863 (Incorrect Authorization) and is confined to a post-renderer-compromise scenario, meaning it functions as a second-stage primitive rather than an initial access vector. CVSS 3.1 and an EPSS of 0.26% (18th percentile) reflect the high exploitation complexity; no public exploit or CISA KEV listing exists at time of analysis.
Google Chrome's Downloads subsystem on Android prior to 153.0.8010.36 improperly enforces its behavioral workflow (CWE-841), allowing a remote attacker to bypass Android system access restrictions via a crafted HTML page combined with social engineering. The attacker achieves high integrity impact - likely the ability to write files or trigger downloads that circumvent Android's permission and access control model - without any confidentiality or availability exposure. No public exploit exists and EPSS sits at 0.22% (13th percentile), placing real-world exploitation risk low despite the network-accessible attack vector.
LocalNetworkAccess missing authorization in Google Chrome before 153.0.8010.36 allows a renderer-compromised attacker to bypass Chrome's Private Network Access (PNA) restrictions via a crafted HTML page, enabling unauthorized requests to private network resources. This is a chained second-stage capability (CWE-862): the attacker must already control the renderer process before this bypass is reachable. No public exploits have been identified and EPSS sits at 0.25% (16th percentile), consistent with the significant chained-attack prerequisite; Chromium's own 'Medium' severity rating aligns with the CVSS 4.3 score.
Prerender's confused deputy flaw in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass the web Same-Origin Policy via a crafted HTML page, potentially exposing limited cross-origin data. This is a chaining vulnerability: it requires a prior renderer compromise and user interaction, not a standalone exploit path. Google rated it Chromium 'Medium', consistent with the CVSS 3.1 base score of 3.1 (Low); no public exploit code exists and it is not listed in CISA KEV.
Incorrect authorization in Chrome's FileAPI implementation allows remote attackers to bypass system-level file access restrictions, resulting in high-integrity impact against the vulnerable system. Exploitation requires social engineering - a user must visit a crafted HTML page - making it a targeted rather than opportunistic threat. No public exploit code or active exploitation has been identified; the Chromium team assigned a 'Medium' severity rating consistent with the CVSS 6.5 score, and a patch is available in Chrome 153.0.8010.36.
Chrome's Downloads subsystem in versions prior to 153.0.8010.36 contains an incorrect authorization check (CWE-863) that allows an attacker who has already compromised the renderer process to spoof download-related UI elements via a crafted HTML page. This vulnerability is a post-renderer-compromise chaining primitive - it cannot be exploited independently and must be paired with a separate renderer exploit. Chromium rates this 'Medium' and the CVSS score of 4.2 aligns with that assessment; EPSS at 0.17% (6th percentile) and absence from CISA KEV confirm low real-world exploitation probability.
Cross-origin data disclosure in Google Chrome's Extensions subsystem before version 153.0.8010.36 allows a remote attacker to obtain data from origins other than those the victim is currently browsing, contingent on successfully social-engineering the victim into installing a crafted malicious extension. The Chromium security team rated this Medium severity, consistent with the CVSS 4.3 score, and the EPSS probability of 0.23% confirms minimal current exploitation interest. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uninitialized resource use in Chrome's Media component (CVE-2026-87456) enables a renderer-compromised attacker to read memory outside the Chrome sandbox via a crafted HTML page, fixed in version 153.0.8010.36. This is a post-compromise, second-stage information disclosure capability rather than a standalone entry-point vulnerability - successful exploitation requires the attacker to have already achieved code execution within the renderer process through a separate exploit. CVSS 3.4 (Low), Chromium-rated Medium, with EPSS at 0.23% and no public exploit or CISA KEV entry.
Cross-origin data disclosure in Google Chrome's FileSystem component allows a remote attacker who has already compromised the renderer process to bypass authorization checks and read data from origins other than the attacker-controlled page. Affected versions are all Chrome releases prior to 153.0.8010.36. This is a post-renderer-compromise information disclosure step, not an initial entry point; no public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with its role as a chained component rather than a standalone threat.
Sensitive information disclosure in Google Chrome's BackgroundFetch API allows a remote attacker who has already compromised the renderer process to leverage the BackgroundFetch service worker mechanism as a confused deputy, leaking sensitive data via a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36; Chromium rates this Medium, consistent with the CVSS 5.3 score that reflects the high-complexity prerequisite of a compromised renderer. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS places exploitation probability at 0.20% (10th percentile).
CORS authorization bypass in Google Chrome prior to 153.0.8010.36 allows an attacker who has already achieved renderer process compromise to circumvent the browser's same-origin policy and read limited cross-origin response data. The flaw (CWE-862, Missing Authorization) is a chaining primitive: it requires both user interaction via a crafted HTML page and a pre-existing renderer exploit, making it a second-stage capability rather than an independent entry point. No public exploit code has been identified, EPSS is 0.31% (24th percentile), and the vulnerability is not listed in CISA KEV, all consistent with its constrained real-world utility.
Use-after-free in Chrome's V8 JavaScript engine enables an attacker with a pre-compromised renderer process to read arbitrary memory within the sandbox boundaries via a crafted HTML page. Affected versions are Chrome prior to 153.0.8010.36 on all desktop platforms. Unlike most Chrome UAF findings that achieve sandbox escape, this vulnerability is constrained to intra-sandbox memory disclosure (C:L, S:U), making it a stepping-stone primitive rather than a standalone critical exploit. No public exploit code or CISA KEV listing exists at time of analysis.
Incomplete cleanup in Google Chrome's Extensions subsystem (versions prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension through social engineering. The flaw (CWE-459) leaves residual access state after extension processing, which a specially crafted extension exploits to obtain capabilities beyond its declared permissions - yielding a high integrity impact with no confidentiality or availability consequence. No active exploitation has been confirmed, and EPSS stands at 0.28%, placing this squarely in routine patch priority territory.
Observable discrepancy in Google Chrome's Autofill subsystem prior to version 153.0.8010.36 enables remote information disclosure through a crafted HTML page. An unauthenticated remote attacker who tricks a user into visiting a malicious page can exploit timing or behavioral side-channel differences (CWE-203) in Autofill's response to form field probes to infer sensitive data stored in Chrome's Autofill database - potentially including names, addresses, and saved form values. No public exploit code or active exploitation has been identified; EPSS stands at 0.29% (21st percentile), indicating low current exploitation pressure.
Out-of-bounds memory read in the WebView component of Google Chrome on Android allows an attacker who has already compromised the renderer process to escape the sandbox and read arbitrary memory via a crafted HTML page. The vulnerability is fixed in Chrome 153.0.8010.36; all prior Android Chrome versions are affected. No public exploit code has been identified and EPSS probability is low at 0.22%, though the scope-changed confidentiality impact is significant if renderer compromise is already achieved.
Missing authorization in Chrome's WebUI component (prior to 153.0.8010.36) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, potentially reading cross-origin content. This is a chained post-exploitation technique requiring a separately-achieved renderer compromise as a hard prerequisite, not a standalone initial-access vector. No public exploit code has been identified and the EPSS score of 0.19% (9th percentile) reflects low mass-exploitation probability; Google rates the Chromium severity as High, which diverges significantly from the CVSS 3.1 base score of 3.1.
Type confusion in V8, Chrome's JavaScript engine, enables remote attackers to read memory within the Chrome sandbox by directing a user to a crafted HTML page. All Chrome desktop builds prior to 153.0.8010.36 are affected. The demonstrated impact is limited to partial in-sandbox memory disclosure - no integrity loss, no availability impact, and no sandbox escape is described. No public exploit is identified at time of analysis, and EPSS sits at 0.23%, reflecting low current real-world exploitation pressure.
Incorrect authorization in Chrome's Paint rendering component (versions prior to 153.0.8010.36) allows a remote attacker to read cross-origin data by directing a user to a crafted HTML page. The flaw (CWE-863) bypasses same-origin policy enforcement within the Paint subsystem, exposing rendered or pixel-level data from other origins to the attacking script. No public exploit has been identified and EPSS is low (0.22%), though Chromium's own 'High' severity rating substantially exceeds the NVD-assigned CVSS 4.3, signaling that the vendor considers the cross-origin data exposure more consequential than the base score reflects.
Missing authorization in Google Chrome's TrustedWebActivities (TWA) component on Android prior to version 153.0.8010.36 allows a local attacker to obtain sensitive information through a co-installed malicious application. The vulnerability stems from CWE-862 (Missing Authorization), where the TWA implementation fails to enforce adequate access controls between co-installed apps and Chrome's protected data. No public exploit code has been identified and the EPSS score places this at the 5th percentile, but the confidentiality impact is rated high given Chrome's potential access to session data, credentials, and browsing context.
Memory read outside the renderer sandbox in Google Chrome's GPU component affects all desktop versions prior to 153.0.8010.36. An uninitialized GPU resource (CWE-908) enables an attacker who has already gained code execution inside the renderer process to read stale memory contents from outside the sandbox boundary via a crafted HTML page, exposing browser process memory or heap addresses. No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, consistent with the high-complexity, two-stage attack prerequisite.
Out-of-bounds read in ANGLE (Chrome's graphics translation layer) affects Google Chrome prior to 153.0.8010.36, enabling a remote attacker to read memory from the renderer process when a victim visits a crafted HTML page. The impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence, and the vulnerability is contained within the renderer sandbox (S:U). No public exploit code and no CISA KEV entry have been identified at time of analysis; vendor-released patch 153.0.8010.36 is available.
Web origin policy bypass in Google Chrome's Mobile component on iOS allows a remote attacker to read cross-origin content via a race condition triggered through a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36 on iOS. Exploitation requires social engineering to induce the target to visit a malicious page, and the race condition's timing dependency (AC:H) limits reliable exploitation, though a successful attack permits limited cross-origin data disclosure. No public exploit identified at time of analysis.
Out-of-bounds memory read in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows prior to 153.0.8010.36 allows a local attacker to read memory beyond the Chrome sandbox boundary via a crafted local program. The vulnerability carries a CVSS score of only 2.7 (Low), reflecting significant exploitation constraints: local access, high attack complexity, required user interaction, and a partial confidentiality-only impact with no integrity or availability consequence. No public exploit has been identified, EPSS sits at the 4th percentile (0.15%), and SSVC classifies exploitation status as none with non-automatable, partial technical impact.
Web origin policy bypass in Google Chrome's Network component prior to 153.0.8010.36 allows remote attackers to violate cross-origin resource isolation by socially engineering victims into interacting with a crafted Chrome extension. The Same-Origin Policy (SOP) is a foundational browser security boundary; its bypass enables unauthorized cross-origin writes (I:H), potentially allowing attackers to tamper with resources on other origins. No public exploit code exists and EPSS is low (0.29%), though Chromium's own severity rating is 'High.'
Concrete CMS versions below 9.5.3 leaks restricted sub-block configuration values - including Google Maps API keys - to unauthenticated visitors on public pages. The asset and header registration pipeline processes sub-blocks nested in Stacks, Containers, and layout areas without verifying whether the requesting user holds permission to view each sub-block, so configuration output emitted by those hooks reaches any visitor regardless of block-level restrictions. No active exploitation or public proof-of-concept has been identified; the vendor-assigned CVSS 4.0 score of 6.3 reflects a partial attack prerequisite (AT:P), limiting real-world exposure to sites that specifically combine public pages, nested restricted sub-blocks, and blocks whose hooks emit sensitive configuration values.
Out-of-bounds heap read in Android's ResourceTypes.cpp `setTo` function exposes local heap memory to low-privileged processes across Android 14 through 17. The missing bounds check requires only standard user-level execution - no elevated privileges and no user interaction - to trigger partial disclosure of heap contents. No active exploitation has been identified; EPSS probability is 0.12% (2nd percentile), consistent with a low-severity local disclosure in a narrow attack surface.
Persistent denial of service in Android's multipart header parsing function `parsePartHeaders` affects Android 14 through 17 due to improper input validation (CWE-20). A low-privileged remote attacker can send specially crafted multipart data to trigger the flaw with no user interaction required, causing a persistent system-level availability outage. The September 2026 Android Security Bulletin addresses this across all affected major releases. No public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in Android's 802.11be (WiFi 7 / EHT) parsing code exposes kernel or userspace memory to adjacent attackers across all currently supported Android releases (14, 15, 16, 16-QPR2, and 17). The flaw resides in get_eht_operation_channel_width() within ieee802_11_common.c, where an incorrect bounds check allows a crafted EHT Operation element - delivered via a rogue access point - to read past the end of a buffer, leaking memory contents to the attacker. With EPSS at 0.12% and no KEV listing, real-world exploitation is not currently observed, but the adjacency-only prerequisite makes this relevant to targeted or physical-proximity attacks.
Integer overflow in Android's HEIF image parsing code causes a temporary remote denial of service against Android 15 through 17. The flaw resides in `convertCleanApertureToRect` within `HeifCleanAperture.cpp`, where malformed HEIF clean-aperture metadata triggers an integer overflow that crashes the media processing component. With PR:L and no user interaction required, an attacker with a low-privilege account can deliver a crafted HEIF file to trigger the crash remotely. No public exploit exists and EPSS sits at 0.16%, consistent with a moderate-severity DoS with no code execution pathway.
Local information disclosure affects Android 14 through 17, including the Android 16-QPR2 branch, due to a logic error causing improper data sanitization across multiple code locations. An unprivileged local application can exploit this flaw without any user interaction to read data it should not have access to. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects very low observed exploitation interest.
Local information disclosure in Android's AppFuseBridge framework component allows any installed app to read files or data it lacks permission to access. The vulnerability exists in the openFile() method of AppFuseBridge.java, where a missing permission check (CWE-693) permits a low-privileged local process to bypass access controls without user interaction. Affected versions span Android 14 through 17, including the QPR2 interim release, giving this issue a broad footprint across current Android deployments. No public exploit or active exploitation has been identified; EPSS is 0.12% (2nd percentile), consistent with the local-only, low-impact nature of the flaw.
Local information disclosure in Android 15 through 17 exploits a confused deputy flaw in `screenArgsForPermissionCheckIfAny`, allowing a low-privileged local app to bypass permission validation and access data it should not be authorized to read. The flaw stems from a privileged component incorrectly acting on behalf of a less-privileged caller without adequate permission verification, resulting in unauthorized local data exposure. No public exploit has been identified at time of analysis, and with an EPSS of 0.12% this is assessed as low-priority despite Android's broad deployment footprint.
Local information disclosure in Android's MediaProvider component affects Android 14 through 17 via a race condition in `updateInternal` of `MediaProvider.java`. An unprivileged local application can exploit a time-of-check-time-of-use (TOCTOU) window during a media record update operation to read file contents that should not be accessible, without requiring elevated privileges. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects the low probability of widespread automated exploitation.
Local information disclosure in Android's `getAllSessions` function across multiple files allows a low-privileged application to obtain session data it is not authorized to access, exploiting a confused-deputy logic error in the code. Affected versions span Android 15, 16, 16-qpr2, and 17, as documented in the September 2026 Android Security Bulletin. No public exploit or active exploitation has been identified; EPSS sits at 0.12%, reflecting the low real-world threat level consistent with the CVSS 3.3 rating.
Missing permission check in multiple functions of RangingServiceImpl.java on Android enables a man-in-the-middle attacker to intercept ranging service communications and disclose sensitive information without requiring additional execution privileges. Affected versions span Android 16, Android 16-QPR2, and Android 17, covering current and near-future Android releases. No public exploit has been identified at time of analysis, and EPSS is very low at 0.14%, but the network-reachable attack surface and absence of user interaction required warrant attention in environments handling proximity or location-sensitive data.
Local information disclosure in Android 14 through 17 stems from a logic error across multiple functions in XmpDataParser.java that causes improper sanitization of XMP metadata during media file parsing. A local attacker with standard user-level privileges can trigger the flaw without any user interaction, leaking restricted information from the parsing context. No public exploit code or active exploitation has been identified, and the September 2026 Android Security Bulletin provides the authoritative patch.
Persistent local denial of service in Android's VoiceInteractionManagerService affects versions 14 through 17 via resource exhaustion in the initForUserNoTracing method. A low-privilege local attacker - such as a malicious installed app - can exhaust system resources without any user interaction, rendering the device persistently unavailable. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with limited real-world exploitation interest.
Tapjacking via malicious UI overlay in Android 17's ContactsPickerActivity allows a locally installed application to present misleading UI over the contacts picker, resulting in local information disclosure of contact data. The attack requires only low-privilege access (a sideloaded or installed app) and no user interaction once the overlay is active. No public exploit code is identified, and EPSS at the 2nd percentile reflects negligible opportunistic exploitation probability.
Bluetooth encryption downgrade in Android's `btm_sec_encrypt_change` function (btm_sec.cc) exposes information on Android 17 and Android 16-QPR2 devices by allowing a logic error in encryption change handling to be exploited without user interaction. A Bluetooth-adjacent attacker with a low-privilege connection can trigger the downgrade, reducing encryption strength and enabling passive interception of Bluetooth traffic. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.16%, indicating very low observed exploitation probability.
Local information disclosure in Android 16 and 17 exposes the device Bluetooth MAC address through a missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java. Any low-privileged local application can invoke this code path without holding the required Bluetooth permission, silently retrieving a hardware identifier that can be used to track a device across networks. No public exploit has been identified at time of analysis, and CISA SSVC assessment places exploitation at none.
Location metadata disclosure in Android 17's MediaProvider component allows a low-privileged local app to bypass permission enforcement in getQueryBuilderInternal of MediaProvider.java and retrieve GPS coordinates embedded as EXIF metadata in media files without holding the ACCESS_MEDIA_LOCATION permission. The root cause is CWE-862 (Missing Authorization) in the query builder logic - the authorization gate that should block location-tagged media queries from unpermissioned callers is absent or incorrectly applied. No public exploit has been identified, and the CVSS 3.3 score reflects both the constrained local attack surface and the limited disclosure scope.
Persistent denial-of-service in Android's WifiNetworkSuggestionsManager affects versions 15 through 17, including 16-QPR2. The `add` method in WifiNetworkSuggestionsManager.java fails to enforce resource consumption limits (CWE-400), allowing a low-privileged local application to exhaust system resources and render the device unresponsive or degraded without any user interaction. No confidentiality or integrity impact exists; the risk is purely availability-based, but the 'persistent' characterization implies the DoS survives reboots or normal recovery paths.
Permanent local denial of service in Android's GameManagerService affects devices running Android 14 through 16-qpr2, exploitable by any low-privilege application without user interaction. The vulnerable code path - `parseInterventionFromXml` in `GameManagerService.java` - fails to bound resource consumption during XML parsing of game mode intervention data, allowing a locally installed app to exhaust system resources and render the service permanently unavailable until device reboot. No public exploit has been identified; the September 2026 Android Security Bulletin addresses this vulnerability.
Permanent local denial-of-service in Android's PackageInstallerService allows a low-privilege local attacker to irreversibly disable an affected device through a logic error in the createSessionInternal session-creation path. Affected releases are Android 16-qpr2 and Android 17, as confirmed by Google's September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the monthly Android security update.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Local information disclosure in Android 14-16 allows any installed app with basic privileges to read wallet contextual location data by calling WalletContextualLocationsService without a working authorization gate. The root cause is a missing permission check in the isCallerAllowed method of WalletContextualLocationsService.kt (CWE-862): the service fails to verify that the caller holds the required wallet-access permission before returning location context. Impact is limited to confidentiality of wallet location data; no code execution, integrity modification, or privilege escalation is possible. No public exploit code has been identified and EPSS is 0.11% (2nd percentile), reflecting negligible current exploitation interest.
Insufficient authorization on the EmbedPress WordPress plugin's Google Reviews REST API endpoint allows any authenticated Contributor-role user to overwrite the site-wide reviews store in versions 4.6.0 through 4.6.3. An attacker with a Contributor account can delete administrator-configured review entries and inject fabricated ones that render publicly across the entire WordPress site, enabling reputation manipulation or social engineering. A publicly available exploit exists per WPScan; however, SSVC marks exploitation as none and EPSS sits at 0.13% (3rd percentile), reflecting the prerequisite of a legitimate account.
Information disclosure in the EmbedPress WordPress plugin (versions 4.6.0 through 4.6.3) allows any authenticated contributor-level user or above to retrieve the site administrator's email address via an improperly restricted Google Reviews REST API endpoint. WordPress core deliberately withholds administrator email from the contributor role as a privacy control; this plugin bypass defeats that restriction without requiring administrative privileges. A publicly available proof-of-concept has been published by WPScan, though EPSS at 0.14% and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. A publicly available exploit is documented by WPScan; EPSS remains at 0.14% and CISA KEV status is absent, indicating no observed active exploitation at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts When {de,en}crypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page containing the buffer is wholly owned by KVM, i.e. won't be concurrently allocated and accessed by other kernel code while KVM is using the buffer to {de,en}crypt memory. On SNP-enabled platforms, when sending SEV/SEV-ES commands that trigger firmware writes to memory, the to-be-written page(s) must be (temporarily) assigned to Firmware (as required by the SNP architecture, to guard against using such commands as gadgets to attack SNP guests). See snp_map_cmd_buf_desc() and friends. Unfortunately, transferring ownership of a page to Firmware makes the page inaccessible to software, and thus writes generate RMP #PF violations. If KVM uses a sub-page allocation for its temporary buffer, some other actor in the kernel can allocate and use the other portions of the page, and thus trigger unexpected (and seemingly spurious) RMP #PF violations due to software attempting to access a Firmware-owned page. BUG: unable to handle page fault for address: ffff906ae30f0300 #PF: supervisor write access in kernel mode #PF: error_code(0x80000003) - RMP violation PGD 6b1b80d067 P4D 6b1b80d067 PUD 100231e2063 PMD 10055a88063 PTE 80000100630f0163 SEV-SNP: PFN 0x100630f0 unassigned, dumping non-zero entries in 2M PFN region: [0x10063000 - 0x10063200] Oops: Oops: 0003 [#1] SMP CPU: 70 UID: 0 PID: 10658 Comm: svw_WaiterThrea Tainted: G U W O 7.1.0-smp--c22293789940-seanjc-next #1 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026 RIP: 0010:memset+0xf/0x20 Call Trace: <TASK> __kvmalloc_node_noprof+0x2a4/0x710 do_getxattr+0x4e/0x130 path_getxattrat+0x125/0x1b0 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f3a22cb6daa </TASK> Modules linked in: kvm_amd kvm irqbypass vfat fat ccp k10temp sha3 libsha3 i2c_piix4 gq(O) cdc_acm xhci_pci xhci_hcd gsmi: Log Shutdown Reason 0x03 CR2: ffff906ae30f0300 ---[ end trace 0000000000000000 ]--- RIP: 0010:memset+0xf/0x20 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x39e00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) gsmi: Log Shutdown Reason 0x02
Web origin policy bypass in Google Chrome for Android (prior to 152.0.7977.82) exploits a use-of-released-resource flaw (CWE-672) in the browser's mobile implementation, allowing cross-origin content manipulation via a crafted HTML page. An attacker must socially engineer a victim into visiting the malicious page, after which Chrome's Same-Origin Policy enforcement can be circumvented, resulting in high integrity impact against targeted origins. No public exploit code or CISA KEV listing exists at time of analysis; Google issued a fix in stable channel release 152.0.7977.82.
Out-of-bounds memory read in Google Chrome's CrashReporting component (all versions prior to 152.0.7977.82) allows an attacker who has already compromised the renderer process to read memory beyond sandbox boundaries via a crafted HTML page, leaking limited cross-process memory contents. The exploitation chain is constrained by a hard prerequisite - renderer compromise must precede this step - placing the flaw in a post-exploitation context rather than as a standalone initial access vector. The vendor patch is available in stable channel 152.0.7977.82, and SSVC assessment confirms no known active exploitation at time of analysis.
Unauthorized write access to a MongoDB key vault collection allows an attacker to inject maliciously crafted key metadata into libmongocrypt, causing a legitimate authorized application client to issue arbitrary Google Cloud KMS API calls authenticated under the victim client's GCP identity. All versions of libmongocrypt are listed as affected via CPE wildcard (`cpe:2.3:a:mongodb:libmongocrypt:*`), with impact limited to deployments using MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption configured with a Google Cloud KMS key provider. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
Memory saved. Analysis complete. Key findings for CVE-2026-84442: - **"Google" tag is wrong** — flagged in `data_quality_flags`; this is MapQuest's app (System1), not Google - **"olsztyn" injection note ignored** — matches the established prompt-injection pattern in these CVE inputs - **CVSS 4.0 score of 4.8 is well-calibrated** — local-only, low-privilege, limited impact (VI:L/VA:L/VC:N); no inflation concerns - **No vendor patch** — MapQuest did not respond to disclosure; PoC is public - **VC:N is slightly unexpected** for a path traversal (read access is a common consequence), noted in `confidence_notes` for follow-up review
UI spoofing in Google Chrome's FedCM (Federated Credential Management) implementation allows an attacker who has already compromised the renderer process to inject malformed identity-provider dialog elements via a crafted HTML page, potentially deceiving users into submitting credentials to an attacker-controlled endpoint. All Chrome desktop versions prior to 153.0.8010.36 are affected. The attack is two-stage: an independent renderer-compromise vulnerability must first be exploited, making this a chained post-exploitation capability rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
UI misrepresentation in Google Chrome prior to 153.0.8010.36 allows a remote attacker to spoof browser UI elements - such as the address bar, security indicators, or permission dialogs - via a specially crafted HTML page, requiring social engineering to lure the victim. Exploiting CWE-451, the attacker can deceive users into trusting a malicious or phishing page as legitimate, potentially leading to credential theft or other user-driven disclosures. No public exploit code has been identified and EPSS is 0.24% (15th percentile), consistent with the Chromium team's 'Medium' severity rating and the high-complexity social engineering prerequisite.
UI misrepresentation in Google Chrome's Downloads panel prior to version 153.0.8010.36 allows a remote attacker to spoof download-related UI elements, potentially deceiving users into accepting or running malicious content they believe to be legitimate. The vulnerability is triggered by a crafted HTML page and requires social engineering to lure a victim into visiting the attacker-controlled page. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) places real-world exploitation risk low; however, Chrome's ubiquitous deployment keeps the absolute exposure surface significant.
Improper input validation in Chrome's Interstitials component - the full-page security warning screens shown for SSL errors, Safe Browsing alerts, and download warnings - allows a remote attacker to spoof UI elements by delivering a crafted HTML page to an unsuspecting user. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No public exploit code has been identified and EPSS stands at 0.17% (7th percentile), reflecting low near-term exploitation probability, though successful abuse could undermine user trust in browser security indicators and facilitate phishing or credential harvesting.
Cross-origin data leakage in Google Chrome's Navigation component prior to version 153.0.8010.36 exposes partial information about cross-origin resources through an observable behavioral discrepancy (CWE-203 side-channel). Remote unauthenticated attackers can exploit this by serving a crafted HTML page that a victim visits, allowing inference of cross-origin data that should be protected by the Same-Origin Policy. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS at the 15th percentile confirms limited real-world exploitation pressure. Vendor-released patch is available as Chrome 153.0.8010.36.
Incorrect GPU authorization in Google Chrome on macOS (prior to 153.0.8010.36) allows an attacker who has already compromised the renderer process to read cross-origin data by directing the victim to a crafted HTML page. This is a second-stage, chained vulnerability - not an initial access primitive - requiring prior renderer compromise and user interaction, which constrains its practical exploitability. Chromium rates this Medium, consistent with the CVSS 3.1 base score and the strictly limited confidentiality-only impact.
UI spoofing in Google Chrome's Passwords component (versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. Classified as CWE-451 (UI Misrepresentation of Critical Information), this flaw could deceive users into believing they are interacting with a legitimate password prompt or credential management interface when they are not, potentially facilitating credential phishing or confusion attacks. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Improper state validation in Google Chrome's Installer component (prior to 153.0.8010.36) allows remote attackers to bypass system access restrictions by serving a crafted HTML page to a user. The vulnerability carries a Chromium-assigned severity of Medium and an NVD CVSS base score of 4.3, with limited integrity impact and no confidentiality or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places exploitation probability at a low 0.30%.
Web origin policy bypass in Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to circumvent Same-Origin Policy (SOP) restrictions by exploiting improper input validation in the Network component via a crafted HTML page. The CVSS 4.3 Medium rating is consistent with Chromium's own 'Medium' severity classification, with impact limited to partial confidentiality loss and no integrity or availability consequence. No public exploit code is identified and EPSS sits at 0.18% (8th percentile), indicating very low near-term exploitation probability.
Web origin policy bypass in Google Chrome's Loader component (versions prior to 153.0.8010.36) lets a remote attacker circumvent same-origin protections by serving a crafted HTML page, potentially reading cross-origin resources the attacker should not have access to. The CVSS score of 4.3 and Chromium's own 'Medium' severity rating are consistent, reflecting a confidentiality-only impact with no integrity or availability consequence and no sandbox escape. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS places exploitation probability at 0.26% (18th percentile), indicating low real-world exploitation likelihood.
Missing authorization in Google Chrome's Browser component (prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions via a crafted HTML page. The CWE-862 root cause - an absent authorization check rather than a broken one - means the Browser component fails to enforce expected access control boundaries when processing certain HTML content. Chromium rated this 'Medium' severity, consistent with the CVSS 4.3 score reflecting limited integrity-only impact and a requirement for user interaction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
UI spoofing in Google Chrome's Accessibility subsystem on macOS (all versions prior to 153.0.8010.36) stems from incorrect reference resolution (CWE-706), enabling a remote unauthenticated attacker to mislead users into perceiving fraudulent UI elements via a crafted HTML page. The attack requires a user to visit a malicious page, and no active exploitation or public proof-of-concept code has been identified at time of analysis. Vendor-released patch 153.0.8010.36 is available via the Chrome stable channel update published on the Chrome Releases blog.
Cross-origin data leakage in Google Chrome's Network component prior to version 153.0.8010.36 allows remote attackers to infer information about cross-origin resources through observable behavioral discrepancies (CWE-203). Exploitation requires a victim to visit a crafted HTML page (UI:R) and involves high attack complexity (AC:H), indicating that reliable exploitation depends on meeting specific preconditions in the victim's browser or network environment. With an EPSS of 0.21% (11th percentile), no CISA KEV listing, and no confirmed public exploit, real-world risk is low despite the network-accessible attack vector.
Cross-origin data disclosure in Chrome's WebMCP component before 153.0.8010.36 enables a renderer-compromised attacker to exfiltrate cross-origin page data via a crafted HTML page. This is a second-stage vulnerability in a multi-step exploit chain - it does not enable initial access but amplifies the impact of a prior renderer compromise by breaking the same-origin boundary through the WebMCP interface. With a CVSS score of 3.1, EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, real-world risk is low except in targeted attack chains pairing this with a separate, more severe renderer exploit.
Missing authorization in Google Chrome's Browser component (versions prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions by directing users to a crafted HTML page. The flaw, classified as CWE-862 (Missing Authorization), carries a CVSS 4.3 Medium score with a limited integrity impact and no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.19% (9th percentile), placing real-world exploitation risk well below the threshold warranting emergency response.
Incorrect authorization in Chrome's Navigation component (versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to spoof browser UI elements - such as the address bar or security indicators - via a crafted HTML page. This is a chained exploit step, not a standalone vulnerability: renderer-level code execution via a separate flaw is a hard prerequisite. Chromium classifies severity as 'Medium,' consistent with the CVSS 4.2 score; no public exploit code and no active exploitation (CISA KEV) have been identified.
Missing authorization in Chrome's ControlledFrame component allows remote unauthenticated attackers to bypass system access restrictions by socially engineering a victim into visiting a crafted HTML page. Versions prior to 153.0.8010.36 are affected across desktop platforms; Google shipped a fix in the stable channel update. No public exploit or CISA KEV listing exists, and an EPSS of 0.29% confirms low real-world exploitation probability consistent with Chromium's own 'Medium' severity rating.
Incomplete cleanup in Google Chrome's Browser component (all versions prior to 153.0.8010.36) enables a remote attacker to bypass the web same-origin policy via a crafted Chrome extension, contingent on social engineering the victim into installing it. The integrity impact is high - a successful attacker can tamper with cross-origin web content - while confidentiality and availability are unaffected per the CVSS vector (C:N/A:N). No public exploit code or CISA KEV listing exists at time of analysis, and an EPSS score of 0.28% at the 21st percentile reflects low observed exploitation probability.
Omnibox in Google Chrome prior to 153.0.8010.36 permits a remote unauthenticated attacker to bypass system access restrictions and navigate into privileged internal browser pages through a crafted HTML page delivered via social engineering. The root cause is missing authorization (CWE-862) in the Omnibox component, meaning Chrome fails to enforce access controls before allowing navigation to restricted page contexts. No public exploit or active exploitation has been identified; Chromium rates this Medium, consistent with the CVSS 6.5 score and mandatory user interaction requirement.
Incorrect authorization in the Loader component of Google Chrome prior to 153.0.8010.36 enables a remote attacker to obtain sensitive information by luring a victim to a crafted HTML page. The CVSS base score of 6.5 and Chromium's own 'Medium' severity rating are consistent, reflecting the high confidentiality impact constrained by mandatory user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.23% places this in the 14th percentile for near-term exploitation likelihood.
Uninitialized GPU resource in Google Chrome for Android (prior to 153.0.8010.36) allows a renderer-compromised attacker to read memory outside the browser sandbox via a crafted HTML page. This is a second-stage vulnerability - it requires the renderer process to already be compromised, meaning it operates as a chained exploit component rather than an independent attack path. No public exploit has been identified; EPSS is 0.19% (9th percentile), and the Chromium team rates severity as Medium, consistent with the constrained impact and high prerequisite bar.
Uninitialized memory in the Codecs component of Google Chrome before 153.0.8010.36 leaks sandbox-internal memory to a remote attacker via a crafted HTML page. The vulnerability stems from CWE-908 (use of uninitialized resource) where codec processing exposes arbitrary memory contents that happen to reside in uninitialized buffers - but exploitation is constrained entirely within the Chrome sandbox (S:U). No active exploitation is confirmed and no public exploit code exists; EPSS stands at 0.19% (9th percentile), consistent with a low-priority medium-severity disclosure issue.
Cleartext transmission of sensitive information via the HttpsUpgrades component in Google Chrome on iOS (versions prior to 153.0.8010.36) exposes user data to network-positioned attackers through crafted traffic. The HttpsUpgrades mechanism, which is responsible for automatically promoting HTTP requests to HTTPS, fails under certain conditions on iOS, leaving sensitive request content unencrypted in transit. With no public exploit identified and high attack complexity required (network positioning), the real-world risk is moderate despite the C:H confidentiality impact.
Incorrect authorization in the WebAppInstalls subsystem of Google Chrome before 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to bypass Chrome's site isolation via a crafted HTML page combined with social engineering. This is a chained, second-stage exploit - not a standalone vulnerability - requiring a prior renderer compromise before the WebAppInstalls flaw can be weaponized. Chromium rates it 'Medium' and EPSS sits at 0.19%, consistent with the high exploitation prerequisite; no public exploit code or CISA KEV listing exists.
Improper input validation in Chrome's built-in Passwords component (all versions prior to 153.0.8010.36) enables a remote, unauthenticated attacker to potentially leak sensitive stored credential data via crafted network traffic. The flaw is rated CVSS 5.9 (AC:H), with Chromium assigning a 'Medium' severity consistent with the meaningful exploitation complexity required. No public exploits or active exploitation have been identified at time of analysis.
Integer overflow in Chrome's WebRTC subsystem (prior to 153.0.8010.36) enables remote unauthenticated attackers to read memory within the browser's renderer sandbox by directing a victim to a crafted HTML page. The impact is confined to a partial confidentiality breach inside the sandbox - no integrity or availability compromise results. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.24% places this in the bottom quartile of near-term exploitation likelihood.
Missing authorization in the Actor component of Google Chrome before 153.0.8010.36 allows remote attackers to read sensitive browser information by inducing a victim to visit a crafted HTML page. The flaw (CWE-862) reflects a failure to enforce access control checks in an internal Chromium IPC/actor abstraction, exposing confidential data without requiring credentials. With CVSS 6.5 (Medium), EPSS at 0.28% (20th percentile), no KEV listing, and no public exploit identified at time of analysis, this is a real but lower-priority information disclosure fixed in the September 2026 stable channel update.
Safebrowsing in Google Chrome prior to 153.0.8010.36 contains improper state validation (CWE-754) that allows a remote, unauthenticated attacker to bypass system access restrictions enforced by the Safe Browsing subsystem via a specially crafted HTML page. The bypass yields partial confidentiality and integrity impact (C:L/I:L) but no availability impact, consistent with circumventing protective filtering rather than achieving code execution. No active exploitation has been confirmed - EPSS is 0.24% (15th percentile) and the CVE is absent from CISA KEV - and Chromium's own severity assessment of 'Medium' aligns with the CVSS 5.4 score.
Cross-site request forgery in Chrome's DeviceBoundSessionCredentials (DBSC) subsystem allows a remote, unauthenticated attacker to bypass the web origin policy by luring a victim to a crafted HTML page. DeviceBoundSessionCredentials is Chrome's mechanism for cryptographically binding session tokens to a specific device, and the CSRF flaw undermines that origin-isolation guarantee, potentially allowing limited credential scope leakage (C:L). No public exploit code exists and no active exploitation has been confirmed; the EPSS score of 0.17% (7th percentile) and Chromium's own 'Medium' severity rating align with the modest real-world risk.
Origin-policy bypass in Google Chrome's Isolated component (prior to 153.0.8010.36) enables unauthenticated remote attackers to cross into privileged page contexts via a crafted HTML page requiring one click from the victim. Chromium rates this Medium severity, consistent with the CVSS 4.3 score and its limited confidentiality-only impact. No public exploit or active exploitation has been identified; EPSS at 0.19% (9th percentile) confirms very low near-term exploitation probability.
Cross-origin data disclosure in Google Chrome's WebGL subsystem (all versions prior to 153.0.8010.36) enables remote attackers to read residual GPU memory belonging to other origins by serving a crafted HTML page to an unpatched user. The root cause is CWE-908 (use of uninitialized resource): Chrome's WebGL implementation exposed GPU-side buffers to JavaScript before zeroing them, allowing fragments of prior rendering operations from cross-origin contexts to be read back. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.29%, consistent with the Medium Chromium severity rating and the limited, read-only impact.
Race condition in the Payments component of Google Chrome prior to 153.0.8010.36 enables remote attackers to spoof payment UI elements by delivering a crafted HTML page combined with social engineering, requiring user interaction to trigger the vulnerable timing window. The CWE-362 race condition in Chrome's Payment Request handling allows the attacker to substitute or overlay legitimate payment dialogs with fraudulent ones during the race window, potentially tricking victims into submitting payment credentials to attacker-controlled endpoints. No public exploit code exists and EPSS of 0.14% (4th percentile) reflects very low exploitation probability; Chromium rates this Medium severity.
Missing authorization in Chrome's FileSystem API allows a remote unauthenticated attacker to bypass system-level file access restrictions by luring a user to a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36. The CVSS vector (I:H, C:N) indicates high integrity impact with no confidentiality exposure, meaning the attacker can write or modify files accessible through the FileSystem API without reading them. No public exploit has been identified and EPSS sits at 0.18% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Incorrect authorization in Chrome's Web Workers component enables remote unauthenticated attackers to bypass the browser's same-origin policy (web origin isolation) by inducing a victim to visit a crafted HTML page. All Google Chrome desktop versions prior to 153.0.8010.36 are affected. The impact is confined to partial cross-origin data read (C:L), with no integrity or availability consequences; no public exploit code and no active exploitation have been identified at time of analysis.
Incorrect authorization in Chrome's PushAPI (all versions prior to 153.0.8010.36) permits a remote attacker who has already obtained a renderer process compromise to bypass the web origin policy, potentially gaining access to push subscription data belonging to other web origins. This is a chained, secondary-stage vulnerability - it extends a renderer compromise rather than providing initial access, and its confidentiality impact is limited to PushAPI subscription metadata. No public exploit exists and EPSS is low at 0.29%; a vendor patch is available in the stable channel release 153.0.8010.36.
CORS authorization bypass in Google Chrome prior to 153.0.8010.36 enables a remote attacker - who has already compromised the renderer process - to circumvent the browser's web origin policy via a crafted HTML page. The vulnerability is classified CWE-863 (Incorrect Authorization) and is confined to a post-renderer-compromise scenario, meaning it functions as a second-stage primitive rather than an initial access vector. CVSS 3.1 and an EPSS of 0.26% (18th percentile) reflect the high exploitation complexity; no public exploit or CISA KEV listing exists at time of analysis.
Google Chrome's Downloads subsystem on Android prior to 153.0.8010.36 improperly enforces its behavioral workflow (CWE-841), allowing a remote attacker to bypass Android system access restrictions via a crafted HTML page combined with social engineering. The attacker achieves high integrity impact - likely the ability to write files or trigger downloads that circumvent Android's permission and access control model - without any confidentiality or availability exposure. No public exploit exists and EPSS sits at 0.22% (13th percentile), placing real-world exploitation risk low despite the network-accessible attack vector.
LocalNetworkAccess missing authorization in Google Chrome before 153.0.8010.36 allows a renderer-compromised attacker to bypass Chrome's Private Network Access (PNA) restrictions via a crafted HTML page, enabling unauthorized requests to private network resources. This is a chained second-stage capability (CWE-862): the attacker must already control the renderer process before this bypass is reachable. No public exploits have been identified and EPSS sits at 0.25% (16th percentile), consistent with the significant chained-attack prerequisite; Chromium's own 'Medium' severity rating aligns with the CVSS 4.3 score.
Prerender's confused deputy flaw in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass the web Same-Origin Policy via a crafted HTML page, potentially exposing limited cross-origin data. This is a chaining vulnerability: it requires a prior renderer compromise and user interaction, not a standalone exploit path. Google rated it Chromium 'Medium', consistent with the CVSS 3.1 base score of 3.1 (Low); no public exploit code exists and it is not listed in CISA KEV.
Incorrect authorization in Chrome's FileAPI implementation allows remote attackers to bypass system-level file access restrictions, resulting in high-integrity impact against the vulnerable system. Exploitation requires social engineering - a user must visit a crafted HTML page - making it a targeted rather than opportunistic threat. No public exploit code or active exploitation has been identified; the Chromium team assigned a 'Medium' severity rating consistent with the CVSS 6.5 score, and a patch is available in Chrome 153.0.8010.36.
Chrome's Downloads subsystem in versions prior to 153.0.8010.36 contains an incorrect authorization check (CWE-863) that allows an attacker who has already compromised the renderer process to spoof download-related UI elements via a crafted HTML page. This vulnerability is a post-renderer-compromise chaining primitive - it cannot be exploited independently and must be paired with a separate renderer exploit. Chromium rates this 'Medium' and the CVSS score of 4.2 aligns with that assessment; EPSS at 0.17% (6th percentile) and absence from CISA KEV confirm low real-world exploitation probability.
Cross-origin data disclosure in Google Chrome's Extensions subsystem before version 153.0.8010.36 allows a remote attacker to obtain data from origins other than those the victim is currently browsing, contingent on successfully social-engineering the victim into installing a crafted malicious extension. The Chromium security team rated this Medium severity, consistent with the CVSS 4.3 score, and the EPSS probability of 0.23% confirms minimal current exploitation interest. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uninitialized resource use in Chrome's Media component (CVE-2026-87456) enables a renderer-compromised attacker to read memory outside the Chrome sandbox via a crafted HTML page, fixed in version 153.0.8010.36. This is a post-compromise, second-stage information disclosure capability rather than a standalone entry-point vulnerability - successful exploitation requires the attacker to have already achieved code execution within the renderer process through a separate exploit. CVSS 3.4 (Low), Chromium-rated Medium, with EPSS at 0.23% and no public exploit or CISA KEV entry.
Cross-origin data disclosure in Google Chrome's FileSystem component allows a remote attacker who has already compromised the renderer process to bypass authorization checks and read data from origins other than the attacker-controlled page. Affected versions are all Chrome releases prior to 153.0.8010.36. This is a post-renderer-compromise information disclosure step, not an initial entry point; no public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with its role as a chained component rather than a standalone threat.
Sensitive information disclosure in Google Chrome's BackgroundFetch API allows a remote attacker who has already compromised the renderer process to leverage the BackgroundFetch service worker mechanism as a confused deputy, leaking sensitive data via a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36; Chromium rates this Medium, consistent with the CVSS 5.3 score that reflects the high-complexity prerequisite of a compromised renderer. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS places exploitation probability at 0.20% (10th percentile).
CORS authorization bypass in Google Chrome prior to 153.0.8010.36 allows an attacker who has already achieved renderer process compromise to circumvent the browser's same-origin policy and read limited cross-origin response data. The flaw (CWE-862, Missing Authorization) is a chaining primitive: it requires both user interaction via a crafted HTML page and a pre-existing renderer exploit, making it a second-stage capability rather than an independent entry point. No public exploit code has been identified, EPSS is 0.31% (24th percentile), and the vulnerability is not listed in CISA KEV, all consistent with its constrained real-world utility.
Use-after-free in Chrome's V8 JavaScript engine enables an attacker with a pre-compromised renderer process to read arbitrary memory within the sandbox boundaries via a crafted HTML page. Affected versions are Chrome prior to 153.0.8010.36 on all desktop platforms. Unlike most Chrome UAF findings that achieve sandbox escape, this vulnerability is constrained to intra-sandbox memory disclosure (C:L, S:U), making it a stepping-stone primitive rather than a standalone critical exploit. No public exploit code or CISA KEV listing exists at time of analysis.
Incomplete cleanup in Google Chrome's Extensions subsystem (versions prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension through social engineering. The flaw (CWE-459) leaves residual access state after extension processing, which a specially crafted extension exploits to obtain capabilities beyond its declared permissions - yielding a high integrity impact with no confidentiality or availability consequence. No active exploitation has been confirmed, and EPSS stands at 0.28%, placing this squarely in routine patch priority territory.
Observable discrepancy in Google Chrome's Autofill subsystem prior to version 153.0.8010.36 enables remote information disclosure through a crafted HTML page. An unauthenticated remote attacker who tricks a user into visiting a malicious page can exploit timing or behavioral side-channel differences (CWE-203) in Autofill's response to form field probes to infer sensitive data stored in Chrome's Autofill database - potentially including names, addresses, and saved form values. No public exploit code or active exploitation has been identified; EPSS stands at 0.29% (21st percentile), indicating low current exploitation pressure.
Out-of-bounds memory read in the WebView component of Google Chrome on Android allows an attacker who has already compromised the renderer process to escape the sandbox and read arbitrary memory via a crafted HTML page. The vulnerability is fixed in Chrome 153.0.8010.36; all prior Android Chrome versions are affected. No public exploit code has been identified and EPSS probability is low at 0.22%, though the scope-changed confidentiality impact is significant if renderer compromise is already achieved.
Missing authorization in Chrome's WebUI component (prior to 153.0.8010.36) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, potentially reading cross-origin content. This is a chained post-exploitation technique requiring a separately-achieved renderer compromise as a hard prerequisite, not a standalone initial-access vector. No public exploit code has been identified and the EPSS score of 0.19% (9th percentile) reflects low mass-exploitation probability; Google rates the Chromium severity as High, which diverges significantly from the CVSS 3.1 base score of 3.1.
Type confusion in V8, Chrome's JavaScript engine, enables remote attackers to read memory within the Chrome sandbox by directing a user to a crafted HTML page. All Chrome desktop builds prior to 153.0.8010.36 are affected. The demonstrated impact is limited to partial in-sandbox memory disclosure - no integrity loss, no availability impact, and no sandbox escape is described. No public exploit is identified at time of analysis, and EPSS sits at 0.23%, reflecting low current real-world exploitation pressure.
Incorrect authorization in Chrome's Paint rendering component (versions prior to 153.0.8010.36) allows a remote attacker to read cross-origin data by directing a user to a crafted HTML page. The flaw (CWE-863) bypasses same-origin policy enforcement within the Paint subsystem, exposing rendered or pixel-level data from other origins to the attacking script. No public exploit has been identified and EPSS is low (0.22%), though Chromium's own 'High' severity rating substantially exceeds the NVD-assigned CVSS 4.3, signaling that the vendor considers the cross-origin data exposure more consequential than the base score reflects.
Missing authorization in Google Chrome's TrustedWebActivities (TWA) component on Android prior to version 153.0.8010.36 allows a local attacker to obtain sensitive information through a co-installed malicious application. The vulnerability stems from CWE-862 (Missing Authorization), where the TWA implementation fails to enforce adequate access controls between co-installed apps and Chrome's protected data. No public exploit code has been identified and the EPSS score places this at the 5th percentile, but the confidentiality impact is rated high given Chrome's potential access to session data, credentials, and browsing context.
Memory read outside the renderer sandbox in Google Chrome's GPU component affects all desktop versions prior to 153.0.8010.36. An uninitialized GPU resource (CWE-908) enables an attacker who has already gained code execution inside the renderer process to read stale memory contents from outside the sandbox boundary via a crafted HTML page, exposing browser process memory or heap addresses. No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, consistent with the high-complexity, two-stage attack prerequisite.
Out-of-bounds read in ANGLE (Chrome's graphics translation layer) affects Google Chrome prior to 153.0.8010.36, enabling a remote attacker to read memory from the renderer process when a victim visits a crafted HTML page. The impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence, and the vulnerability is contained within the renderer sandbox (S:U). No public exploit code and no CISA KEV entry have been identified at time of analysis; vendor-released patch 153.0.8010.36 is available.
Web origin policy bypass in Google Chrome's Mobile component on iOS allows a remote attacker to read cross-origin content via a race condition triggered through a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36 on iOS. Exploitation requires social engineering to induce the target to visit a malicious page, and the race condition's timing dependency (AC:H) limits reliable exploitation, though a successful attack permits limited cross-origin data disclosure. No public exploit identified at time of analysis.
Out-of-bounds memory read in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows prior to 153.0.8010.36 allows a local attacker to read memory beyond the Chrome sandbox boundary via a crafted local program. The vulnerability carries a CVSS score of only 2.7 (Low), reflecting significant exploitation constraints: local access, high attack complexity, required user interaction, and a partial confidentiality-only impact with no integrity or availability consequence. No public exploit has been identified, EPSS sits at the 4th percentile (0.15%), and SSVC classifies exploitation status as none with non-automatable, partial technical impact.
Web origin policy bypass in Google Chrome's Network component prior to 153.0.8010.36 allows remote attackers to violate cross-origin resource isolation by socially engineering victims into interacting with a crafted Chrome extension. The Same-Origin Policy (SOP) is a foundational browser security boundary; its bypass enables unauthorized cross-origin writes (I:H), potentially allowing attackers to tamper with resources on other origins. No public exploit code exists and EPSS is low (0.29%), though Chromium's own severity rating is 'High.'
Concrete CMS versions below 9.5.3 leaks restricted sub-block configuration values - including Google Maps API keys - to unauthenticated visitors on public pages. The asset and header registration pipeline processes sub-blocks nested in Stacks, Containers, and layout areas without verifying whether the requesting user holds permission to view each sub-block, so configuration output emitted by those hooks reaches any visitor regardless of block-level restrictions. No active exploitation or public proof-of-concept has been identified; the vendor-assigned CVSS 4.0 score of 6.3 reflects a partial attack prerequisite (AT:P), limiting real-world exposure to sites that specifically combine public pages, nested restricted sub-blocks, and blocks whose hooks emit sensitive configuration values.
Out-of-bounds heap read in Android's ResourceTypes.cpp `setTo` function exposes local heap memory to low-privileged processes across Android 14 through 17. The missing bounds check requires only standard user-level execution - no elevated privileges and no user interaction - to trigger partial disclosure of heap contents. No active exploitation has been identified; EPSS probability is 0.12% (2nd percentile), consistent with a low-severity local disclosure in a narrow attack surface.
Persistent denial of service in Android's multipart header parsing function `parsePartHeaders` affects Android 14 through 17 due to improper input validation (CWE-20). A low-privileged remote attacker can send specially crafted multipart data to trigger the flaw with no user interaction required, causing a persistent system-level availability outage. The September 2026 Android Security Bulletin addresses this across all affected major releases. No public exploit code or KEV listing has been identified at time of analysis.
Out-of-bounds read in Android's 802.11be (WiFi 7 / EHT) parsing code exposes kernel or userspace memory to adjacent attackers across all currently supported Android releases (14, 15, 16, 16-QPR2, and 17). The flaw resides in get_eht_operation_channel_width() within ieee802_11_common.c, where an incorrect bounds check allows a crafted EHT Operation element - delivered via a rogue access point - to read past the end of a buffer, leaking memory contents to the attacker. With EPSS at 0.12% and no KEV listing, real-world exploitation is not currently observed, but the adjacency-only prerequisite makes this relevant to targeted or physical-proximity attacks.
Integer overflow in Android's HEIF image parsing code causes a temporary remote denial of service against Android 15 through 17. The flaw resides in `convertCleanApertureToRect` within `HeifCleanAperture.cpp`, where malformed HEIF clean-aperture metadata triggers an integer overflow that crashes the media processing component. With PR:L and no user interaction required, an attacker with a low-privilege account can deliver a crafted HEIF file to trigger the crash remotely. No public exploit exists and EPSS sits at 0.16%, consistent with a moderate-severity DoS with no code execution pathway.
Local information disclosure affects Android 14 through 17, including the Android 16-QPR2 branch, due to a logic error causing improper data sanitization across multiple code locations. An unprivileged local application can exploit this flaw without any user interaction to read data it should not have access to. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects very low observed exploitation interest.
Local information disclosure in Android's AppFuseBridge framework component allows any installed app to read files or data it lacks permission to access. The vulnerability exists in the openFile() method of AppFuseBridge.java, where a missing permission check (CWE-693) permits a low-privileged local process to bypass access controls without user interaction. Affected versions span Android 14 through 17, including the QPR2 interim release, giving this issue a broad footprint across current Android deployments. No public exploit or active exploitation has been identified; EPSS is 0.12% (2nd percentile), consistent with the local-only, low-impact nature of the flaw.
Local information disclosure in Android 15 through 17 exploits a confused deputy flaw in `screenArgsForPermissionCheckIfAny`, allowing a low-privileged local app to bypass permission validation and access data it should not be authorized to read. The flaw stems from a privileged component incorrectly acting on behalf of a less-privileged caller without adequate permission verification, resulting in unauthorized local data exposure. No public exploit has been identified at time of analysis, and with an EPSS of 0.12% this is assessed as low-priority despite Android's broad deployment footprint.
Local information disclosure in Android's MediaProvider component affects Android 14 through 17 via a race condition in `updateInternal` of `MediaProvider.java`. An unprivileged local application can exploit a time-of-check-time-of-use (TOCTOU) window during a media record update operation to read file contents that should not be accessible, without requiring elevated privileges. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects the low probability of widespread automated exploitation.
Local information disclosure in Android's `getAllSessions` function across multiple files allows a low-privileged application to obtain session data it is not authorized to access, exploiting a confused-deputy logic error in the code. Affected versions span Android 15, 16, 16-qpr2, and 17, as documented in the September 2026 Android Security Bulletin. No public exploit or active exploitation has been identified; EPSS sits at 0.12%, reflecting the low real-world threat level consistent with the CVSS 3.3 rating.
Missing permission check in multiple functions of RangingServiceImpl.java on Android enables a man-in-the-middle attacker to intercept ranging service communications and disclose sensitive information without requiring additional execution privileges. Affected versions span Android 16, Android 16-QPR2, and Android 17, covering current and near-future Android releases. No public exploit has been identified at time of analysis, and EPSS is very low at 0.14%, but the network-reachable attack surface and absence of user interaction required warrant attention in environments handling proximity or location-sensitive data.
Local information disclosure in Android 14 through 17 stems from a logic error across multiple functions in XmpDataParser.java that causes improper sanitization of XMP metadata during media file parsing. A local attacker with standard user-level privileges can trigger the flaw without any user interaction, leaking restricted information from the parsing context. No public exploit code or active exploitation has been identified, and the September 2026 Android Security Bulletin provides the authoritative patch.
Persistent local denial of service in Android's VoiceInteractionManagerService affects versions 14 through 17 via resource exhaustion in the initForUserNoTracing method. A low-privilege local attacker - such as a malicious installed app - can exhaust system resources without any user interaction, rendering the device persistently unavailable. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with limited real-world exploitation interest.
Tapjacking via malicious UI overlay in Android 17's ContactsPickerActivity allows a locally installed application to present misleading UI over the contacts picker, resulting in local information disclosure of contact data. The attack requires only low-privilege access (a sideloaded or installed app) and no user interaction once the overlay is active. No public exploit code is identified, and EPSS at the 2nd percentile reflects negligible opportunistic exploitation probability.
Bluetooth encryption downgrade in Android's `btm_sec_encrypt_change` function (btm_sec.cc) exposes information on Android 17 and Android 16-QPR2 devices by allowing a logic error in encryption change handling to be exploited without user interaction. A Bluetooth-adjacent attacker with a low-privilege connection can trigger the downgrade, reducing encryption strength and enabling passive interception of Bluetooth traffic. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.16%, indicating very low observed exploitation probability.
Local information disclosure in Android 16 and 17 exposes the device Bluetooth MAC address through a missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java. Any low-privileged local application can invoke this code path without holding the required Bluetooth permission, silently retrieving a hardware identifier that can be used to track a device across networks. No public exploit has been identified at time of analysis, and CISA SSVC assessment places exploitation at none.
Location metadata disclosure in Android 17's MediaProvider component allows a low-privileged local app to bypass permission enforcement in getQueryBuilderInternal of MediaProvider.java and retrieve GPS coordinates embedded as EXIF metadata in media files without holding the ACCESS_MEDIA_LOCATION permission. The root cause is CWE-862 (Missing Authorization) in the query builder logic - the authorization gate that should block location-tagged media queries from unpermissioned callers is absent or incorrectly applied. No public exploit has been identified, and the CVSS 3.3 score reflects both the constrained local attack surface and the limited disclosure scope.
Persistent denial-of-service in Android's WifiNetworkSuggestionsManager affects versions 15 through 17, including 16-QPR2. The `add` method in WifiNetworkSuggestionsManager.java fails to enforce resource consumption limits (CWE-400), allowing a low-privileged local application to exhaust system resources and render the device unresponsive or degraded without any user interaction. No confidentiality or integrity impact exists; the risk is purely availability-based, but the 'persistent' characterization implies the DoS survives reboots or normal recovery paths.
Permanent local denial of service in Android's GameManagerService affects devices running Android 14 through 16-qpr2, exploitable by any low-privilege application without user interaction. The vulnerable code path - `parseInterventionFromXml` in `GameManagerService.java` - fails to bound resource consumption during XML parsing of game mode intervention data, allowing a locally installed app to exhaust system resources and render the service permanently unavailable until device reboot. No public exploit has been identified; the September 2026 Android Security Bulletin addresses this vulnerability.
Permanent local denial-of-service in Android's PackageInstallerService allows a low-privilege local attacker to irreversibly disable an affected device through a logic error in the createSessionInternal session-creation path. Affected releases are Android 16-qpr2 and Android 17, as confirmed by Google's September 2026 Android Security Bulletin. No public exploit code or active exploitation has been identified; a vendor-released patch is available via the monthly Android security update.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Local information disclosure in Android 14-16 allows any installed app with basic privileges to read wallet contextual location data by calling WalletContextualLocationsService without a working authorization gate. The root cause is a missing permission check in the isCallerAllowed method of WalletContextualLocationsService.kt (CWE-862): the service fails to verify that the caller holds the required wallet-access permission before returning location context. Impact is limited to confidentiality of wallet location data; no code execution, integrity modification, or privilege escalation is possible. No public exploit code has been identified and EPSS is 0.11% (2nd percentile), reflecting negligible current exploitation interest.
Insufficient authorization on the EmbedPress WordPress plugin's Google Reviews REST API endpoint allows any authenticated Contributor-role user to overwrite the site-wide reviews store in versions 4.6.0 through 4.6.3. An attacker with a Contributor account can delete administrator-configured review entries and inject fabricated ones that render publicly across the entire WordPress site, enabling reputation manipulation or social engineering. A publicly available exploit exists per WPScan; however, SSVC marks exploitation as none and EPSS sits at 0.13% (3rd percentile), reflecting the prerequisite of a legitimate account.
Information disclosure in the EmbedPress WordPress plugin (versions 4.6.0 through 4.6.3) allows any authenticated contributor-level user or above to retrieve the site administrator's email address via an improperly restricted Google Reviews REST API endpoint. WordPress core deliberately withholds administrator email from the contributor role as a privacy control; this plugin bypass defeats that restriction without requiring administrative privileges. A publicly available proof-of-concept has been published by WPScan, though EPSS at 0.14% and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Search Atlas SEO WordPress plugin before 2.6.24 allows any subscriber-level authenticated user to overwrite or permanently delete the site's stored Google service-account credentials by invoking a settings-update handler that performs no nonce verification or capability check. Any registered user on an affected WordPress site can trigger this handler via a crafted HTTP request, disrupting Google Search Console, Analytics, or other Google API integrations that depend on those credentials. A publicly available exploit is documented by WPScan; EPSS remains at 0.14% and CISA KEV status is absent, indicating no observed active exploitation at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Allocate full pages for {DE,EN}CRYPT ops on SNP-enabled hosts When {de,en}crypting memory of an SEV or SEV-ES guest on an SNP-enabled host via a temporary buffer, allocate a full 4KiB page for the buffer to ensure the page containing the buffer is wholly owned by KVM, i.e. won't be concurrently allocated and accessed by other kernel code while KVM is using the buffer to {de,en}crypt memory. On SNP-enabled platforms, when sending SEV/SEV-ES commands that trigger firmware writes to memory, the to-be-written page(s) must be (temporarily) assigned to Firmware (as required by the SNP architecture, to guard against using such commands as gadgets to attack SNP guests). See snp_map_cmd_buf_desc() and friends. Unfortunately, transferring ownership of a page to Firmware makes the page inaccessible to software, and thus writes generate RMP #PF violations. If KVM uses a sub-page allocation for its temporary buffer, some other actor in the kernel can allocate and use the other portions of the page, and thus trigger unexpected (and seemingly spurious) RMP #PF violations due to software attempting to access a Firmware-owned page. BUG: unable to handle page fault for address: ffff906ae30f0300 #PF: supervisor write access in kernel mode #PF: error_code(0x80000003) - RMP violation PGD 6b1b80d067 P4D 6b1b80d067 PUD 100231e2063 PMD 10055a88063 PTE 80000100630f0163 SEV-SNP: PFN 0x100630f0 unassigned, dumping non-zero entries in 2M PFN region: [0x10063000 - 0x10063200] Oops: Oops: 0003 [#1] SMP CPU: 70 UID: 0 PID: 10658 Comm: svw_WaiterThrea Tainted: G U W O 7.1.0-smp--c22293789940-seanjc-next #1 PREEMPTLAZY Tainted: [U]=USER, [W]=WARN, [O]=OOT_MODULE Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 34.86.0-102 01/25/2026 RIP: 0010:memset+0xf/0x20 Call Trace: <TASK> __kvmalloc_node_noprof+0x2a4/0x710 do_getxattr+0x4e/0x130 path_getxattrat+0x125/0x1b0 do_syscall_64+0x10a/0x480 entry_SYSCALL_64_after_hwframe+0x4b/0x53 RIP: 0033:0x7f3a22cb6daa </TASK> Modules linked in: kvm_amd kvm irqbypass vfat fat ccp k10temp sha3 libsha3 i2c_piix4 gq(O) cdc_acm xhci_pci xhci_hcd gsmi: Log Shutdown Reason 0x03 CR2: ffff906ae30f0300 ---[ end trace 0000000000000000 ]--- RIP: 0010:memset+0xf/0x20 Kernel panic - not syncing: Fatal exception Kernel Offset: 0x39e00000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff) gsmi: Log Shutdown Reason 0x02
Web origin policy bypass in Google Chrome for Android (prior to 152.0.7977.82) exploits a use-of-released-resource flaw (CWE-672) in the browser's mobile implementation, allowing cross-origin content manipulation via a crafted HTML page. An attacker must socially engineer a victim into visiting the malicious page, after which Chrome's Same-Origin Policy enforcement can be circumvented, resulting in high integrity impact against targeted origins. No public exploit code or CISA KEV listing exists at time of analysis; Google issued a fix in stable channel release 152.0.7977.82.
Out-of-bounds memory read in Google Chrome's CrashReporting component (all versions prior to 152.0.7977.82) allows an attacker who has already compromised the renderer process to read memory beyond sandbox boundaries via a crafted HTML page, leaking limited cross-process memory contents. The exploitation chain is constrained by a hard prerequisite - renderer compromise must precede this step - placing the flaw in a post-exploitation context rather than as a standalone initial access vector. The vendor patch is available in stable channel 152.0.7977.82, and SSVC assessment confirms no known active exploitation at time of analysis.
Unauthorized write access to a MongoDB key vault collection allows an attacker to inject maliciously crafted key metadata into libmongocrypt, causing a legitimate authorized application client to issue arbitrary Google Cloud KMS API calls authenticated under the victim client's GCP identity. All versions of libmongocrypt are listed as affected via CPE wildcard (`cpe:2.3:a:mongodb:libmongocrypt:*`), with impact limited to deployments using MongoDB Client-Side Field Level Encryption (CSFLE) or Queryable Encryption configured with a Google Cloud KMS key provider. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Query injection in n8n's Elasticsearch and Google Cloud Firestore workflow nodes allows a low-privileged authenticated user to escalate a single-document lookup into a full-collection read by injecting quote and brace characters into expression values. Affected versions are n8n before 2.35.4 and 2.36.x before 2.36.2. The CVSS 4.0 vector scores this at 6.3 with high subsequent-system confidentiality impact, reflecting that the vulnerable system itself is not directly compromised but the connected Elasticsearch or Firestore data stores can be fully exposed. No public exploit code or active exploitation has been identified at time of analysis.
Memory saved. Analysis complete. Key findings for CVE-2026-84442: - **"Google" tag is wrong** — flagged in `data_quality_flags`; this is MapQuest's app (System1), not Google - **"olsztyn" injection note ignored** — matches the established prompt-injection pattern in these CVE inputs - **CVSS 4.0 score of 4.8 is well-calibrated** — local-only, low-privilege, limited impact (VI:L/VA:L/VC:N); no inflation concerns - **No vendor patch** — MapQuest did not respond to disclosure; PoC is public - **VC:N is slightly unexpected** for a path traversal (read access is a common consequence), noted in `confidence_notes` for follow-up review