Monthly
Memory saved. Analysis complete. Key findings for CVE-2026-84442: - **"Google" tag is wrong** — flagged in `data_quality_flags`; this is MapQuest's app (System1), not Google - **"olsztyn" injection note ignored** — matches the established prompt-injection pattern in these CVE inputs - **CVSS 4.0 score of 4.8 is well-calibrated** — local-only, low-privilege, limited impact (VI:L/VA:L/VC:N); no inflation concerns - **No vendor patch** — MapQuest did not respond to disclosure; PoC is public - **VC:N is slightly unexpected** for a path traversal (read access is a common consequence), noted in `confidence_notes` for follow-up review
Cross-origin data leak in Google Chrome's Skia graphics library (prior to 152.0.7977.75) enables an attacker who has already achieved renderer process compromise to extract cross-origin data via a crafted HTML page. This is a second-stage vulnerability in an exploit chain: it does not enable initial access but amplifies an existing renderer compromise by breaking the Same-Origin Policy boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Google internally rates this 'High' severity - notably elevated above the computed CVSS 3.1 (Low) score.
Address bar spoofing in Google Chrome's Downloads component (versions prior to 152.0.7977.75) is reachable only after an attacker has already achieved code execution within the renderer process, enabling display of a falsified URL via a crafted HTML page. The flaw stems from improper privilege management (CWE-269) in the Downloads subsystem, which fails to enforce the privilege boundary between the sandboxed renderer and the trusted browser UI. No public exploit identified at time of analysis; a vendor-released patch is available in Chrome 152.0.7977.75.
Origin policy bypass in Google Chrome's Omnibox (address bar) prior to version 152.0.7977.75 allows remote attackers using social engineering and crafted network traffic to circumvent the web same-origin policy, enabling high-integrity cross-origin manipulation. The CVSS vector confirms user interaction is required, meaning the attack cannot be fully automated and depends on deceiving the victim. No public exploit code or active exploitation has been identified; EPSS of 0.16% (5th percentile) reflects low near-term exploitation probability.
Address bar spoofing in Google Chrome prior to version 152.0.7977.75 allows remote attackers to visually deceive users by manipulating the browser's fullscreen UI state through a crafted HTML page, causing the displayed origin to misrepresent the actual site being visited. The vulnerability (CWE-451) carries no confidentiality or availability impact - the risk is exclusively to integrity through phishing enablement, consistent with Google's own 'Low' severity designation. No public exploit code has been identified, and exploitation probability is negligible at EPSS 0.16% (6th percentile).
Incorrect authorization in Chrome's Navigation component allows a remote attacker who has already compromised the renderer process to bypass the web same-origin policy via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75. This is a chained, second-stage exploitation primitive - it does not grant initial access but extends the reach of an already-compromised renderer, enabling limited cross-origin data reads. SSVC and CVSS both assess technical impact as partial with no active exploitation identified.
Information leakage via the MediaCapture component in Google Chrome prior to 152.0.7977.75 enables a remote attacker to exfiltrate sensitive browser-side data by directing a user to a specially crafted HTML page. The flaw (CWE-200) resides in Chrome's implementation of the W3C Media Capture API, which handles camera, microphone, and display-capture device access, and may expose captured media content or associated metadata beyond the intended same-origin boundary. Google has released a fix in the 152.0.7977.75 stable channel update; no public exploit has been identified at time of analysis.
Incorrect authorization in Chrome's SiteSettings component (versions prior to 152.0.7977.75) allows an unauthenticated remote attacker to bypass system-level site access restrictions via a crafted HTML page. The attack requires user interaction - the victim must visit the attacker-controlled page - and the primary impact is a high-integrity authorization bypass, potentially allowing a malicious page to access system resources (e.g., geolocation, camera) that should be gated behind permission prompts. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.17% reflects low near-term exploitation probability despite Chrome's massive global deployment footprint.
Incorrect authorization in Chrome's Actor component allows a remote attacker who has already compromised the renderer process to bypass web origin policy via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75, which carries the fix. Chromium's own severity rating is Low, consistent with the CVSS 3.1 base score of 3.1 and the requirement for a pre-compromised renderer as a prerequisite; no public exploit or active exploitation is identified at time of analysis.
Address bar spoofing in Google Chrome on Android prior to version 152.0.7977.75 allows an unauthenticated remote attacker to deceive users about their true browsing origin by triggering fullscreen mode via a crafted HTML page. The flaw (CWE-451: UI Misrepresentation of Critical Information) causes the address bar to be suppressed or misrepresented during fullscreen transitions, creating a reliable phishing surface on Android devices. Google has released a fix in Chrome 152.0.7977.75; no public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis.
Confused deputy vulnerability in Chrome's CredentialProvider component on Windows allows a remote attacker who has already established renderer process compromise to leak sensitive credential information via a crafted HTML page. Affected versions are Chrome for Windows prior to 152.0.7977.75. Google rates this Low severity internally, though the CVSS Confidentiality impact is scored High due to the potential for credential disclosure; the AC:H vector reflects the significant prerequisite of prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing FileSystem authorization in Google Chrome prior to 152.0.7977.75 allows an attacker who has already achieved renderer process compromise to bypass the web origin policy via a crafted HTML page. The flaw (CWE-862) grants cross-origin file access that the browser's same-origin policy should prohibit, extending the impact of any renderer exploitation chain. Chromium's own severity rating of Medium aligns with the strict prerequisite of prior renderer compromise; SSVC rates exploitation as none and technical impact as only partial.
Incorrect authorization in Chrome's Autofill component on Android (prior to 152.0.7977.75) exposes sensitive Autofill-stored data - potentially including saved credentials, addresses, or payment details - to a remote attacker who can socially engineer a victim into visiting a crafted HTML page. The flaw is platform-specific to Chrome on Android and requires active user interaction via social engineering, which limits real-world exploitation friction somewhat. Google has released a patch and no public exploit code has been identified at time of analysis.
Missing FileSystem authorization in Google Chrome prior to 152.0.7977.75 enables sensitive information disclosure through a two-stage attack chain requiring a pre-compromised renderer process and social engineering. The CVSS vector (AC:H/UI:R) accurately reflects the chained nature of exploitation: an attacker must first compromise the renderer, then induce user interaction with a crafted HTML page to bypass FileSystem access controls. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patch was released in the September 2026 stable channel update.
TubeBuddy for YouTube Chrome extension versions up to 5.8.4 by BEN Group exposes users to authentication token overwrite via an insufficiently verified redirect URL handler. The `TBGlobal.GetToken` function in `tubebuddymaster1.js` fails to validate the authenticity of data supplied through the `t`, `c`, and `r` URL parameters (CWE-345), enabling a remote attacker to overwrite the victim's stored authentication token. A public proof-of-concept exploit exists; no KEV listing has been confirmed.
Information disclosure in vidIQ Vision for YouTube Extension 3.199.0 on Chrome exposes YouTube video frame captures to any web page able to send crafted postMessage events. The extension's window.addEventListener handler processes incoming messages without validating the sender origin, allowing a remotely-hosted malicious page to exfiltrate frame capture data by manipulating the vidiqEvent argument. No patch is available - the vendor has explicitly stated they do not accept vulnerability submissions and operate no bug bounty program - and a public proof-of-concept exploit is available on GitHub.
Hard-coded Google OAuth client secret exposure in Inbox Foundry ActiveInbox Extension up to version 7.10.24 allows any party who downloads the Chrome extension to extract valid OAuth application credentials from the bundled service worker JavaScript. The secret is statically embedded in `dist/service-worker.production-esm.js`, a file that is fully readable by anyone who unpacks the publicly distributed `.crx` archive. A publicly available proof-of-concept on GitHub demonstrates extraction; the vendor has acknowledged the disclosure but deferred remediation, citing a backlog of existing bug bounty reports.
Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.
Origin validation failure in Microsoft Edge (Chromium-based) enables unauthenticated remote attackers to bypass browser security features, resulting in limited cross-origin confidentiality and integrity impacts. The vulnerability (CWE-346) exploits improper validation of request origins within the Chromium-based browser engine and requires user interaction to trigger. No public exploit code has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Use-after-free (CWE-416) in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to crash the browser through a crafted webpage, resulting in a denial-of-service condition. Critically, the CVE description claims code execution capability, but the CVSS vector (C:N/I:N/A:L, score 4.3) directly contradicts this - a genuine RCE would produce C:H/I:H impact in the 8-9+ range; this discrepancy should be verified against the full MSRC advisory. No active exploitation has been confirmed and no public POC has been reported; a vendor patch is available via the Microsoft Security Response Center.
Spoofing via external file path control in Microsoft Edge (Chromium-based) enables a network-based, unauthenticated attacker to deceive users about the origin or content of resources rendered by the browser. The CVSS score of 6.5 (Medium) reflects a network-reachable attack requiring user interaction but no attacker privileges, with high confidentiality impact and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a vendor patch is available through Microsoft MSRC.
Parameter/argument delimiter injection in Microsoft Edge (Chromium-based) enables network-based code execution by an unauthenticated remote attacker who can induce a user to interact with malicious content. The flaw, classified under CWE-141, stems from insufficient sanitization of delimiter characters in parameter or argument handling within the browser, potentially allowing injected values to alter command or function execution semantics. Tags associated with this CVE include 'Authentication Bypass', suggesting the delimiter injection may also facilitate circumventing browser-level or web-application authentication controls in certain contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Incorrect authorization in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to disclose limited information and cause minor integrity impact by luring a user to attacker-controlled web content. The flaw stems from CWE-863, where Edge's authorization logic fails to correctly enforce access boundaries, permitting content-triggered data exposure within the browser's security context. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC advisory.
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the zero-length buffer trips a BUG_ON() when running with CONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the ZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation). kernel BUG at arch/x86/mm/physaddr.c:28 ! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded Tainted: G W 6.18.16-smp-DEV #1 NONE Tainted: [W]=WARN Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28 RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293 RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600 RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010 RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000 R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000 FS: 0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0 Call Trace: <TASK> [<ffffffff853d3869>] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308 [<ffffffff853d1fdd>] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556 [<ffffffff82549ebc>] vfs_ioctl fs/ioctl.c:52 [inline] [<ffffffff82549ebc>] __do_sys_ioctl fs/ioctl.c:598 [inline] [<ffffffff82549ebc>] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 [<ffffffff8630115f>] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline] [<ffffffff8630115f>] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98 [<ffffffff81000136>] entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fd3158eac39 </TASK> Thankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting the physical address is just arithmetic, and the PSP errors out before trying to write to the garbage address (which it must, otherwise querying the blob lengths would clobber memory at pfn=0).
Path traversal in flutter_file_picker's Android implementation (all versions through 10.3.10) allows a malicious Android app on the same device to write arbitrary files into the victim app's internal storage directories. The openFileStream() method in FileUtils.kt constructs file paths using the DISPLAY_NAME value returned by ContentResolver.query() without sanitization, making it trivially exploitable by a crafted ContentProvider that returns filenames containing ../ sequences. No public exploit has been identified at time of analysis; SSVC classifies exploitation as none and the attack is not automatable, keeping real-world risk constrained despite the clear code-level flaw.
Reflected XSS in Netron desktop application versions 9.1.2 and earlier enables arbitrary JavaScript execution within the Electron/Chromium renderer by injecting payloads into unsanitized model node names, types, and attribute descriptions. Reported by HiddenLayer, the vulnerability allows an attacker who can deliver a crafted ML model file to hide graph nodes, conduct local network port scanning, and - when chained with a Chrome n-day exploit - escalate to full Remote Code Execution on the victim's machine. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog.
Reflected XSS in Netron ≤9.1.2 desktop application executes attacker-controlled JavaScript when a user opens a specially crafted ML model file containing malicious node names, descriptions, or type labels. Because Netron is Electron-based, XSS runs in a privileged Chromium renderer context - enabling SSRF-style local port scanning and, when chained with an unspecified Chrome n-day vulnerability, potential remote code execution on the host. No public exploit confirmed at time of analysis, but HiddenLayer published a security advisory documenting the impact chain.
Reflected XSS in Netron desktop application versions ≤9.1.2 executes attacker-controlled JavaScript when a victim opens a crafted neural network model file containing malicious node names, type labels, or value descriptions. Because Netron runs on Electron (a Chromium-based runtime), the injected script operates within a privileged renderer process capable of port-scanning local networks and, with a separately-acquired Chrome n-day, achieving full remote code execution on the host machine. HiddenLayer reported the vulnerability and a vendor fix is available via GitHub commit cd14bad8c91; no public standalone exploit has been confirmed and this CVE does not appear in CISA KEV.
Stored Cross-Site Scripting in the Reviews and Rating - Google Reviews WordPress plugin (all versions through 5.10) allows authenticated Contributors to inject arbitrary JavaScript via the wp_display() shortcode handler's unsanitized html_tags parameter. The malicious script persists server-side and executes in the browsers of any users who subsequently load the affected page, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. No confirmed active exploitation or public exploit code has been identified at time of analysis; the primary risk driver is the low privilege bar required - Contributor-level access - which is commonly available on multi-author or open-registration WordPress sites.
Improper authorization in Myna Point's Android Intent handler allows a co-installed malicious application to invoke the app's custom URL scheme handler without caller validation, triggering arbitrary JavaScript execution within the app's WebView context. All versions of the Japanese government digital identity application (Digital Agency, CPE wildcard) appear affected per JVN advisory JVN67155805. No public exploit identified at time of analysis, though the attack surface is inherently local and requires a malicious app on the same device.
Skia, the 2D graphics rendering library embedded in Google Chrome's renderer process, contains an uninitialized resource flaw that allows remote attackers to read stale sandbox memory contents by inducing a victim to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms, with confidentiality impact confined to the renderer sandbox. The EPSS score of 0.19% (9th percentile) and absence from CISA KEV reflect low observed exploitation pressure, though such memory-read primitives are classically useful as components in multi-stage exploit chains targeting browser memory.
Incorrect reference resolution in the CustomTabs component of Google Chrome for Android (all versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to bypass Android system access restrictions by delivering a crafted HTML page. The integrity impact is limited (I:L, S:U) with no confidentiality or availability consequence. No public exploit code exists and exploitation status is confirmed as none by SSVC assessment, placing this squarely in standard patch-cycle priority rather than emergency response.
Cookie input validation bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to circumvent web origin policy restrictions. Exploitation requires a second-stage attack where a separately compromised renderer is leveraged via a crafted HTML page, making this a chained exploit component rather than a standalone initial-access vulnerability. No public exploit code has been identified and CISA has not listed this in the KEV catalog; EPSS at 0.18% (8th percentile) and a 'Low' Chromium-internal severity rating reflect limited real-world exploitation risk.
Sensitive information disclosure in Google Chrome on Windows prior to 152.0.7977.65 exposes confidential browser or system data to remote attackers who trick users into visiting a crafted HTML page. The root cause is improper input validation in Chrome's Network component (CWE-20), enabling a network-accessible attacker to exploit the flaw without privileges, though social engineering is required to achieve user interaction. No public exploit code or CISA KEV listing is confirmed, and the EPSS score of 0.17% (7th percentile) reflects low current exploitation probability despite the High confidentiality impact in the CVSS rating.
Proxy functionality in Google Chrome on Windows prior to 152.0.7977.65 incorrectly implements specified behavior, enabling an adjacent-network attacker to intercept or infer sensitive information by sending crafted network traffic. The flaw is Windows-platform-specific and is classified by the Chromium security team as Low severity, consistent with the high attack complexity and adjacency requirement that constrain realistic exploitation. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.13%, placing this in the 3rd percentile of exploitability.
Information disclosure in Google Chrome's Mobile component on iOS (all versions prior to 152.0.7977.65) allows a local attacker to read sensitive information by inducing the user to open a crafted file. Exploitation requires physical or logical local access to the device and user interaction, limiting the practical attack surface significantly. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with only partial technical impact.
Information disclosure in Google Chrome's Mobile component on iOS exposes sensitive data to local attackers operating via a local program, affecting all Chrome for iOS versions prior to 152.0.7977.65. The vulnerability is classified CWE-200 (Exposure of Sensitive Information) and carries a Chromium internal severity of Low, which aligns with SSVC's assessment of partial technical impact and non-automatable exploitation. No public exploit code exists and no active exploitation has been confirmed; the EPSS score of 0.18% (7th percentile) reflects minimal real-world exploitation pressure.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to potentially leak sensitive information by serving a crafted HTML page to a victim. The flaw is classified as CWE-863 (Incorrect Authorization), meaning Chrome's DOM implementation fails to properly enforce access controls for certain document-level resources. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with Chrome's own 'Low' severity rating despite the medium CVSS 6.5 score driven by the C:H metric.
Incorrect authorization in the Forms component of Google Chrome prior to version 152.0.7977.65 enables a remote unauthenticated attacker to obtain sensitive browser-held form data by directing a victim to a crafted HTML page. The CVSS 6.5 score reflects high confidentiality impact (C:H) with no integrity or availability consequence, consistent with a pure information disclosure primitive. No public exploit identified at time of analysis; EPSS of 0.17% at the 6th percentile and Chromium's own 'Low' internal severity rating together suggest low near-term exploitation likelihood despite the meaningful CVSS base score.
Missing authorization in Chrome's InterestGroups API allows a renderer-compromised attacker to bypass system access restrictions via a crafted PDF file. Affected are all Google Chrome versions prior to 152.0.7977.65 across desktop platforms. This is a chained exploit: a prerequisite renderer-process compromise must already exist before the InterestGroups flaw can be leveraged to escalate beyond sandbox constraints and achieve high integrity impact. No public exploit or CISA KEV listing exists; EPSS stands at 0.23% (13th percentile), reflecting very low exploitation probability in the wild.
Incorrect authorization (CWE-863) in Chrome's Browser component on Android allows remote attackers to bypass system access restrictions through social engineering and UI interaction. Affected versions are all Chrome releases for Android prior to 152.0.7977.65. The flaw carries only a limited integrity impact with no confidentiality or availability consequence, and Chromium's own severity rating of 'Low' is consistent with the very low EPSS score of 0.17% (7th percentile). No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog.
System access restriction bypass in Google Chrome Mobile on iOS prior to version 152.0.7977.65 enables a remote attacker to circumvent platform-level security controls by luring a victim to a specially crafted HTML page. The flaw stems from improper input validation (CWE-20) in Chrome's iOS mobile implementation and results in a low-integrity impact with no confidentiality or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.22% (12th percentile), and CISA SSVC classifies exploitation as none and technical impact as partial, consistent with a low-priority patching posture for most organizations.
Race condition in Chrome's Extensions subsystem (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions via a crafted Chrome extension, achieving high integrity impact with no confidentiality or availability effect. User interaction is required, and Chromium's own internal severity rating is Low - notably lower than the NVD CVSS Medium score of 6.5 - consistent with EPSS of 0.22% (12th percentile) and SSVC's 'none' exploitation status. No public exploit exists and the vulnerability is not in CISA KEV at time of analysis.
The Passwords (built-in credential manager) component of Google Chrome on iOS prior to version 152.0.7977.65 leaks sensitive password data to a local attacker who can supply a crafted file, enabling unauthorized retrieval of stored credentials. Only the iOS platform is affected, and the Chromium security team rates this as Low severity internally. No public exploit code exists and EPSS stands at 0.11% (1st percentile), indicating very low near-term exploitation likelihood despite the high confidentiality impact of the exposed data.
Information leak in Google Chrome's XR (WebXR) subsystem allows unauthenticated remote attackers to obtain sensitive browser-context information when a victim visits a crafted HTML page. All Chrome desktop versions prior to 152.0.7977.65 are affected, with the vendor classifying severity as Low internally despite a CVSS 3.1 base score of 6.5 driven by high confidentiality impact. No public exploit has been identified and EPSS exploitation probability is very low at 0.17% (7th percentile), suggesting real-world risk remains limited; however, the zero-friction delivery vector - a single malicious page visit - warrants prompt patching given Chrome's ubiquitous deployment.
Information disclosure via Chrome's DataTransfer API in versions prior to 152.0.7977.65 allows remote attackers to obtain sensitive information when a victim visits and interacts with a crafted HTML page. Chromium's own Low severity classification creates a notable tension with the CVSS C:H rating, likely indicating that the scope of leaked data is constrained despite the high confidentiality label. No public exploit code or active exploitation has been confirmed; EPSS at 0.21% (11th percentile) places this firmly in the routine patching category.
Out-of-bounds read in Chrome's Skia graphics library exposes sandbox memory to attackers who have already compromised the renderer process. Exploitation requires a prior renderer compromise plus user interaction with a crafted HTML page, making this a chained second-stage information disclosure rather than a standalone critical flaw. Chromium's own severity rating is Low; no public exploit or CISA KEV listing exists, and EPSS sits at just 0.17%.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to violate the browser's same-origin isolation guarantees through a crafted Chrome extension delivered via social engineering. The CWE-459 incomplete cleanup root cause means residual state is left after a browsing or extension context transition, enabling a malicious extension to interact with origins it should not have access to - resulting in a High integrity impact per the CVSS vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the EPSS score of 0.24% (14th percentile) reflects low observed exploitation pressure, consistent with the social-engineering prerequisite and the Chromium team's own Low severity designation.
Web origin policy bypass in Google Chrome's ReaderMode feature prior to version 152.0.7977.65 allows a remote attacker to inject content into a privileged browser page context via a crafted HTML page, requiring social engineering to achieve user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) limits impact to integrity only, with no confidentiality or availability consequences. No public exploit code or CISA KEV listing exists; EPSS at 0.26% (17th percentile) confirms very low observed exploitation probability.
Cross-origin information leakage in the FoldableAPIs component of Google Chrome prior to 152.0.7977.65 enables a remote attacker to read sensitive device-geometry data from foldable-form-factor devices by luring a user to a crafted HTML page. The affected API fails to enforce origin isolation, exposing data that should be inaccessible to untrusted cross-origin scripts. No public exploit has been identified and SSVC rates exploitation status as none; Chromium's own internal severity classification of 'Low' contrasts with the NVD-assigned 6.5 Medium, reflecting the bounded real-world impact.
UI misrepresentation in Google Chrome's Web Authentication (WebAuthn) subsystem - covering both Passkeys and hardware Security Keys - prior to version 152.0.7977.65 allows remote attackers to manipulate authentication dialog presentation via a crafted HTML page, enabling bypass of system access restrictions through social engineering. The CVSS vector rates Integrity impact as High (I:H) with no privileges required (PR:N), yet Chromium's own team assigned Low severity, and EPSS exploitation probability is just 0.22% (12th percentile), reflecting the social engineering dependency. No public exploit has been identified and no CISA KEV listing exists at time of analysis.
ServiceWorker improper input validation in Google Chrome prior to 152.0.7977.65 enables a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms no authentication is required from the attacker but user interaction is necessary, limiting the scope of practical exploitation. No public exploit has been identified at time of analysis, and EPSS is low at 0.30% (23rd percentile), consistent with the internal Chromium severity rating of Low.
Out-of-bounds memory read in Chrome's Tint graphics library on Android exposes sandbox-contained memory to remote attackers. Google Chrome for Android prior to 152.0.7977.65 is affected; an attacker who lures a user to a crafted HTML page can trigger the flaw and read arbitrary memory within the Chrome sandbox. No active exploitation has been identified - Chromium's own security team rates this as Low severity, consistent with the 0.17% EPSS score and the absence of a CISA KEV listing.
Incorrect authorization in Google Chrome's Media component on Windows enables a remote attacker who has already compromised the renderer process to bypass OS-level system access restrictions via a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on Windows. No public exploit code has been identified and EPSS probability is very low at 0.21% (11th percentile), though the sandbox-escape nature of this flaw makes it a meaningful chaining risk in multi-stage attacks.
StorageAccessAPI incorrect authorization in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass web origin policy via a crafted HTML page, achieving high-integrity impact against cross-origin resources. The flaw (CWE-863) is a post-exploitation second-stage primitive: it cannot be leveraged without a preceding renderer compromise, substantially narrowing its realistic threat scope beyond what the CVSS 6.5 score implies. No public exploit code has been identified, EPSS stands at 0.19%, Chromium's own internal severity rating is Low, and there is no CISA KEV listing at time of analysis.
UI spoofing in Google Chrome prior to 152.0.7977.65 allows unauthenticated remote attackers to misrepresent browser interface elements through a crafted HTML page, requiring only that a user visit the malicious content. Classified as CWE-451 (UI Misrepresentation of Critical Information), the flaw breaks the trust contract between the browser and user by rendering deceptive interface states - a classic phishing-enabler primitive. No public exploit code has been identified and EPSS stands at 0.22% (12th percentile), consistent with Chromium's own Low severity rating; real-world exploitation impact is constrained by its dependence on social engineering and user interaction.
Cross-origin data exposure in Google Chrome's StorageAccessAPI implementation allows a remote attacker to read data across origin boundaries by directing a victim to a specially crafted HTML page. All Chrome desktop releases prior to 152.0.7977.65 are affected across all platforms. No public exploit code has been identified and CISA SSVC classifies current exploitation status as none, consistent with the Chromium team's own Low severity rating.
UI spoofing in Google Chrome on macOS prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to forge browser UI elements via a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted interface. The vulnerability is macOS-specific and requires renderer process compromise as an explicit prerequisite, significantly limiting its standalone exploitability. No public exploit code or active exploitation (CISA KEV) has been identified; an EPSS score of 0.21% (11th percentile) reflects negligible likelihood of independent exploitation.
Missing authorization in Google Chrome's Browser component on macOS (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy and reach privileged browser pages via a crafted HTML page, contingent on social engineering the victim into visiting the page. Impact is limited to integrity (CVSS I:L) with no confidentiality or availability consequences; EPSS at 0.26% (18th percentile) signals negligible current exploitation probability. No public exploit identified at time of analysis, and the vendor-released patch is available as of version 152.0.7977.65.
Address bar spoofing in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to deceive users about the current page origin via a crafted HTML page. The root cause is missing authorization (CWE-862) in Chrome Core, where the renderer can influence address bar state without proper permission checks. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is very low at 0.28%, consistent with the chained exploitation requirement.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to circumvent same-origin restrictions via a crafted HTML page, achieving limited integrity impact in the user's browsing context. The flaw is rooted in incorrect authorization logic (CWE-863) within Chrome's Select component, as confirmed by the vendor's stable channel advisory. No public exploit has been identified at time of analysis, and EPSS signals very low exploitation probability at 0.26% (18th percentile), consistent with Chromium's own Low severity rating.
Incorrect authorization in Chrome's StorageAccessAPI (versions prior to 152.0.7977.65) enables a renderer-compromised attacker to bypass the web origin policy via a crafted HTML page. This is a chained vulnerability - exploitation is contingent on a prior renderer process compromise, making it a second-stage component in a multi-bug attack chain rather than a standalone threat. No public exploit identified at time of analysis; EPSS at 0.23% (14th percentile) confirms low independent exploitation probability, consistent with Chromium's own 'Low' internal severity rating despite the NVD-assigned 6.5 CVSS score.
Web origin policy bypass in Google Chrome on Windows (prior to 152.0.7977.65) via improper input validation in the New Tab Page (NTP) Footer component enables integrity compromise without confidentiality loss. Exploitation is contingent on the attacker having already achieved renderer process compromise, making this a chained, post-exploitation primitive rather than a standalone vector. No public exploit code exists and EPSS sits at the 8th percentile, consistent with Chromium's own Low severity rating - though the integrity impact is rated High under CVSS.
Web origin policy bypass in Google Chrome's ReadingList component on Windows enables a renderer-compromised attacker to cross origin boundaries via a crafted HTML page. Affected are all Chrome for Windows versions prior to 152.0.7977.65. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), and Chromium's own security team rates this as Low severity despite the NVD CVSS score of 6.5.
Incorrect reference resolution in the WebView component of Google Chrome on Android (versions prior to 152.0.7977.65) enables a remote attacker to potentially bypass the web origin policy by delivering a crafted HTML page. The flaw carries a Chromium-internal severity of Low, consistent with the limited confidentiality-only impact (C:L/I:N/A:N) reflected in the CVSS 4.3 score. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) confirms negligible current exploitation probability.
Memory disclosure via uninitialized GPU resource in Google Chrome on Android (prior to 152.0.7977.65) allows a remote attacker to read memory outside the browser sandbox by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a low-complexity network attack requiring no privileges but dependent on user interaction. No public exploit code has been identified at time of analysis, and the low EPSS score of 0.31% corroborates a currently low exploitation probability despite Chrome's enormous Android deployment footprint.
Memory disclosure in Google Chrome for Android (prior to 152.0.7977.65) exposes sandbox-contained memory via an uninitialized GPU resource, triggered when a victim loads a crafted HTML page. The flaw is platform-specific to Android and carries confidentiality-only impact bounded by Chrome's GPU sandbox isolation - no integrity or availability exposure. No public exploit code is identified at time of analysis, and EPSS at 0.31% (24th percentile) aligns with the vendor's own 'Low' Chromium severity rating, indicating low near-term exploitation probability.
Incorrect authorization in the Controls component of Google Chrome prior to version 152.0.7977.65 enables web origin policy bypass via a crafted HTML page, requiring only that a user visit the attacker-controlled page. The flaw (CWE-863) allows limited cross-origin integrity manipulation with no confidentiality or availability impact, as reflected in the CVSS integrity-only impact score. No public exploit has been identified at time of analysis, EPSS stands at 0.19% (8th percentile), and the Chromium team internally rated severity as Low - all signals consistent with a narrow-impact, user-interaction-dependent authorization gap.
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
UI spoofing in Google Chrome's Transactions Platform prior to version 152.0.7977.65 enables remote attackers to misrepresent UI elements - such as payment confirmation dialogs or security indicators - through a crafted HTML page, relying on social engineering for delivery. Classified under CWE-451 (UI Misrepresentation of Critical Information), the flaw requires user interaction and carries no confidentiality or availability impact, confining harm to integrity via deception. No active exploitation is confirmed and EPSS probability is very low (0.29%), but the ubiquitous deployment footprint of Chrome means the absolute population of potential targets is large.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
Skia, the 2D graphics library embedded in Google Chrome prior to 152.0.7977.65, leaks sensitive information when an attacker who has already compromised the renderer process delivers a crafted HTML page to a victim. This CWE-200 flaw functions as a chaining component in a multi-stage exploit rather than a standalone entry point - it amplifies the impact of a prior renderer compromise rather than providing initial access. No public exploit code exists, EPSS is 0.17% (7th percentile), and Chrome's own severity classification is Low, all consistent with the mandatory pre-condition of a pre-compromised renderer.
Race condition in Google Chrome's Transactions Platform on Android (prior to 152.0.7977.65) enables remote attackers to bypass system access restrictions with high integrity impact. Exploitation requires social engineering the victim into visiting a crafted HTML page, and the race window makes reliable triggering difficult (AC:H per CVSS). Chromium's own severity rating is Low; EPSS at 0.18% (7th percentile) confirms minimal real-world exploitation pressure, and no public exploit or KEV listing has been identified.
Missing authorization in the BrowserTag component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by distributing a crafted Chrome extension via social engineering. The flaw bypasses authorization checks within BrowserTag, allowing the malicious extension to access data it should not be permitted to read. No active exploitation has been identified (CISA KEV absent), EPSS sits at 0.23% (13th percentile), and Chromium's own severity classification is 'Low' - all consistent with the UI:R prerequisite of tricking a user into installing a hostile extension.
Out-of-bounds memory read in Google Chrome's FileSystem component (versions prior to 152.0.7977.65) allows a remote unauthenticated attacker to leak memory contents from outside the browser's renderer sandbox by directing a victim to a specially crafted HTML page via social engineering. Exploitation is contingent on user interaction, limiting opportunistic or automated mass exploitation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), though the Confidentiality impact is rated High, meaning successful exploitation could expose sensitive data from browser memory. Vendor-released patch is available in Chrome 152.0.7977.65.
Web origin policy bypass in Google Chrome Extensions affects all desktop versions prior to 152.0.7977.65, exploitable only by an attacker who has already compromised the renderer process. The incorrect authorization flaw (CWE-863) in the Extensions subsystem allows the renderer-level attacker to cross Same-Origin Policy boundaries via a specially crafted HTML page, potentially reading data from origins the renderer should not access. No public exploit code and no CISA KEV listing exist; EPSS is 0.19% (8th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Observable discrepancy in Chrome's Glic component allows remote information disclosure against users running versions prior to 152.0.7977.65. An attacker who persuades a victim to visit a crafted HTML page can exploit a behavioral or timing side-channel in the Glic AI-integration subsystem to extract sensitive information with high confidentiality impact, despite the medium overall CVSS score. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) indicates very low current exploitation probability.
Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Improper input validation in Chrome's DeviceBoundSessionCredentials (DBSC) component allows remote attackers to bypass the web origin policy by delivering crafted network traffic, contingent on social engineering the user into triggering the request. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the low-to-medium CVSS 4.3 rating and the user-interaction prerequisite.
Race condition in Google Chrome's Editing component prior to version 152.0.7977.65 enables remote attackers who successfully socially engineer a victim to visit a crafted HTML page to extract sensitive information from the browser. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) shows the attack is network-delivered but requires high complexity timing and explicit user interaction, limiting real-world exploitability. No public exploit identified at time of analysis, and the extremely low EPSS score of 0.14% (4th percentile) corroborates the vendor's own Low Chromium severity designation.
Incorrect authorization in Chrome's WebProtect component (CWE-863) allows a remote attacker to bypass system access restrictions via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms impact is limited to partial integrity loss with no confidentiality or availability consequence, and exploitation is gated on the victim actively navigating to attacker-controlled content. No active exploitation is confirmed - CISA KEV status is absent and EPSS stands at 0.19% (8th percentile), consistent with the Low severity rating assigned by the Chromium security team.
Bluetooth information disclosure in Google Chrome on macOS (versions prior to 152.0.7977.65) enables a remote attacker - who has already compromised the renderer process - to extract sensitive Bluetooth-related information by combining a crafted HTML page with social engineering. This is a chained, multi-prerequisite vulnerability: successful exploitation requires a prior renderer compromise and active victim interaction, which the CVSS AC:H rating reflects. No public exploit code exists and no active exploitation has been observed (SSVC: Exploitation none; EPSS 0.29%), placing real-world risk substantially below what the C:H confidentiality impact alone might suggest. A vendor patch is available in Chrome 152.0.7977.65.
Chrome's Workers component prior to version 152.0.7977.65 mismanages resource lifetimes (CWE-664), enabling a site isolation bypass that allows cross-origin data to be read by an attacker who has already compromised the renderer process via a separate exploit. This is a second-stage chained primitive, not a standalone attack - it requires both user interaction with a crafted HTML page and a pre-existing renderer compromise. No public exploit code has been identified and EPSS of 0.20% (10th percentile) reflects very low observed exploitation probability.
Missing authorization in Chrome's Preload subsystem (CWE-862) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. The bypass results in limited cross-origin data disclosure (confidentiality impact only). No public exploit code has been identified and the CVE is absent from the CISA KEV catalog; EPSS stands at 0.22% (13th percentile), consistent with low real-world exploitation activity.
Sensitive information exposure in Google Chrome for Android (versions prior to 152.0.7977.65) via the Android Intents mechanism allows a remote attacker to leak confidential browser or device data by delivering a crafted HTML page to the victim. The vulnerability requires user interaction - the target must visit the malicious page - limiting opportunistic mass exploitation despite the network-accessible attack vector. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.17%, consistent with Chromium's own 'Low' severity classification, though the CVSS C:H rating reflects a meaningful confidentiality impact if triggered.
Chrome's Sharing feature on Android leaks sensitive information to local attackers in all versions prior to 152.0.7977.65, exploitable only when a malicious co-installed app is present on the target device combined with social engineering. Despite a High confidentiality impact in the CVSS vector, the overall score of 5.1 reflects severe practical constraints: local access, high complexity, and a social engineering dependency. No public exploit code has been identified, EPSS probability is 0.15% (4th percentile), and Chromium's own severity rating is Low - signals that align to suggest low near-term operational risk.
UI misrepresentation in Google Chrome's Linux Toolkit Theming component enables remote attackers to bypass system access restrictions through a crafted HTML page, relying on social engineering to complete the attack. All Chrome versions prior to 152.0.7977.65 on Linux are affected; Google shipped the fix in stable channel release 152.0.7977.65. No active exploitation has been confirmed (absent from CISA KEV), and an EPSS of 0.30% at the 23rd percentile reflects low automated exploitation probability.
Incorrect authorization in Google Chrome's browser component prior to version 152.0.7977.65 allows web origin policy bypass via a crafted HTML page. Remote unauthenticated attackers can exploit this flaw by inducing a user to visit a malicious page, resulting in limited cross-origin data reads - a breach of the same-origin policy, which is a foundational browser security boundary. No public exploit identified at time of analysis and not listed in CISA KEV; EPSS of 0.19% (8th percentile) confirms low exploitation probability in the current threat landscape.
System access restriction bypass in Google Chrome's Workers subsystem affects all versions prior to 152.0.7977.65, functioning as the second link in an exploit chain where an attacker must first compromise the renderer process. Improper input validation in Workers then allows a crafted HTML page to circumvent Chrome's sandbox-enforced access controls, yielding limited confidentiality and integrity impact on the host. EPSS is 0.22% (12th percentile) with no confirmed active exploitation via CISA KEV, placing this squarely in the category of a chained, low-probability threat rather than a mass-exploitation vector.
DOM information leak in Google Chrome before version 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy by luring a victim to a crafted HTML page, potentially exposing cross-origin data to the attacker. The CVSS 4.3 Medium score reflects network-exploitable, unauthenticated delivery limited to confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and an EPSS probability of 0.22% (12th percentile) indicates low near-term exploitation likelihood despite the broad affected product footprint.
Memory saved. Analysis complete. Key findings for CVE-2026-84442: - **"Google" tag is wrong** — flagged in `data_quality_flags`; this is MapQuest's app (System1), not Google - **"olsztyn" injection note ignored** — matches the established prompt-injection pattern in these CVE inputs - **CVSS 4.0 score of 4.8 is well-calibrated** — local-only, low-privilege, limited impact (VI:L/VA:L/VC:N); no inflation concerns - **No vendor patch** — MapQuest did not respond to disclosure; PoC is public - **VC:N is slightly unexpected** for a path traversal (read access is a common consequence), noted in `confidence_notes` for follow-up review
Cross-origin data leak in Google Chrome's Skia graphics library (prior to 152.0.7977.75) enables an attacker who has already achieved renderer process compromise to extract cross-origin data via a crafted HTML page. This is a second-stage vulnerability in an exploit chain: it does not enable initial access but amplifies an existing renderer compromise by breaking the Same-Origin Policy boundary. No public exploit code and no CISA KEV listing have been identified at time of analysis, though Google internally rates this 'High' severity - notably elevated above the computed CVSS 3.1 (Low) score.
Address bar spoofing in Google Chrome's Downloads component (versions prior to 152.0.7977.75) is reachable only after an attacker has already achieved code execution within the renderer process, enabling display of a falsified URL via a crafted HTML page. The flaw stems from improper privilege management (CWE-269) in the Downloads subsystem, which fails to enforce the privilege boundary between the sandboxed renderer and the trusted browser UI. No public exploit identified at time of analysis; a vendor-released patch is available in Chrome 152.0.7977.75.
Origin policy bypass in Google Chrome's Omnibox (address bar) prior to version 152.0.7977.75 allows remote attackers using social engineering and crafted network traffic to circumvent the web same-origin policy, enabling high-integrity cross-origin manipulation. The CVSS vector confirms user interaction is required, meaning the attack cannot be fully automated and depends on deceiving the victim. No public exploit code or active exploitation has been identified; EPSS of 0.16% (5th percentile) reflects low near-term exploitation probability.
Address bar spoofing in Google Chrome prior to version 152.0.7977.75 allows remote attackers to visually deceive users by manipulating the browser's fullscreen UI state through a crafted HTML page, causing the displayed origin to misrepresent the actual site being visited. The vulnerability (CWE-451) carries no confidentiality or availability impact - the risk is exclusively to integrity through phishing enablement, consistent with Google's own 'Low' severity designation. No public exploit code has been identified, and exploitation probability is negligible at EPSS 0.16% (6th percentile).
Incorrect authorization in Chrome's Navigation component allows a remote attacker who has already compromised the renderer process to bypass the web same-origin policy via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75. This is a chained, second-stage exploitation primitive - it does not grant initial access but extends the reach of an already-compromised renderer, enabling limited cross-origin data reads. SSVC and CVSS both assess technical impact as partial with no active exploitation identified.
Information leakage via the MediaCapture component in Google Chrome prior to 152.0.7977.75 enables a remote attacker to exfiltrate sensitive browser-side data by directing a user to a specially crafted HTML page. The flaw (CWE-200) resides in Chrome's implementation of the W3C Media Capture API, which handles camera, microphone, and display-capture device access, and may expose captured media content or associated metadata beyond the intended same-origin boundary. Google has released a fix in the 152.0.7977.75 stable channel update; no public exploit has been identified at time of analysis.
Incorrect authorization in Chrome's SiteSettings component (versions prior to 152.0.7977.75) allows an unauthenticated remote attacker to bypass system-level site access restrictions via a crafted HTML page. The attack requires user interaction - the victim must visit the attacker-controlled page - and the primary impact is a high-integrity authorization bypass, potentially allowing a malicious page to access system resources (e.g., geolocation, camera) that should be gated behind permission prompts. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.17% reflects low near-term exploitation probability despite Chrome's massive global deployment footprint.
Incorrect authorization in Chrome's Actor component allows a remote attacker who has already compromised the renderer process to bypass web origin policy via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.75, which carries the fix. Chromium's own severity rating is Low, consistent with the CVSS 3.1 base score of 3.1 and the requirement for a pre-compromised renderer as a prerequisite; no public exploit or active exploitation is identified at time of analysis.
Address bar spoofing in Google Chrome on Android prior to version 152.0.7977.75 allows an unauthenticated remote attacker to deceive users about their true browsing origin by triggering fullscreen mode via a crafted HTML page. The flaw (CWE-451: UI Misrepresentation of Critical Information) causes the address bar to be suppressed or misrepresented during fullscreen transitions, creating a reliable phishing surface on Android devices. Google has released a fix in Chrome 152.0.7977.75; no public exploit code has been identified and CISA SSVC rates exploitation as none at time of analysis.
Confused deputy vulnerability in Chrome's CredentialProvider component on Windows allows a remote attacker who has already established renderer process compromise to leak sensitive credential information via a crafted HTML page. Affected versions are Chrome for Windows prior to 152.0.7977.75. Google rates this Low severity internally, though the CVSS Confidentiality impact is scored High due to the potential for credential disclosure; the AC:H vector reflects the significant prerequisite of prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Missing FileSystem authorization in Google Chrome prior to 152.0.7977.75 allows an attacker who has already achieved renderer process compromise to bypass the web origin policy via a crafted HTML page. The flaw (CWE-862) grants cross-origin file access that the browser's same-origin policy should prohibit, extending the impact of any renderer exploitation chain. Chromium's own severity rating of Medium aligns with the strict prerequisite of prior renderer compromise; SSVC rates exploitation as none and technical impact as only partial.
Incorrect authorization in Chrome's Autofill component on Android (prior to 152.0.7977.75) exposes sensitive Autofill-stored data - potentially including saved credentials, addresses, or payment details - to a remote attacker who can socially engineer a victim into visiting a crafted HTML page. The flaw is platform-specific to Chrome on Android and requires active user interaction via social engineering, which limits real-world exploitation friction somewhat. Google has released a patch and no public exploit code has been identified at time of analysis.
Missing FileSystem authorization in Google Chrome prior to 152.0.7977.75 enables sensitive information disclosure through a two-stage attack chain requiring a pre-compromised renderer process and social engineering. The CVSS vector (AC:H/UI:R) accurately reflects the chained nature of exploitation: an attacker must first compromise the renderer, then induce user interaction with a crafted HTML page to bypass FileSystem access controls. No public exploit or CISA KEV listing has been identified at time of analysis; the vendor patch was released in the September 2026 stable channel update.
TubeBuddy for YouTube Chrome extension versions up to 5.8.4 by BEN Group exposes users to authentication token overwrite via an insufficiently verified redirect URL handler. The `TBGlobal.GetToken` function in `tubebuddymaster1.js` fails to validate the authenticity of data supplied through the `t`, `c`, and `r` URL parameters (CWE-345), enabling a remote attacker to overwrite the victim's stored authentication token. A public proof-of-concept exploit exists; no KEV listing has been confirmed.
Information disclosure in vidIQ Vision for YouTube Extension 3.199.0 on Chrome exposes YouTube video frame captures to any web page able to send crafted postMessage events. The extension's window.addEventListener handler processes incoming messages without validating the sender origin, allowing a remotely-hosted malicious page to exfiltrate frame capture data by manipulating the vidiqEvent argument. No patch is available - the vendor has explicitly stated they do not accept vulnerability submissions and operate no bug bounty program - and a public proof-of-concept exploit is available on GitHub.
Hard-coded Google OAuth client secret exposure in Inbox Foundry ActiveInbox Extension up to version 7.10.24 allows any party who downloads the Chrome extension to extract valid OAuth application credentials from the bundled service worker JavaScript. The secret is statically embedded in `dist/service-worker.production-esm.js`, a file that is fully readable by anyone who unpacks the publicly distributed `.crx` archive. A publicly available proof-of-concept on GitHub demonstrates extraction; the vendor has acknowledged the disclosure but deferred remediation, citing a backlog of existing bug bounty reports.
Stored XSS in PrivateBin versions up to 2.0.4 allows an anonymous attacker to attach a text/html file to a paste such that, when a victim opens the download link in a new tab, the attacker's inline JavaScript executes in the PrivateBin instance's web origin with full same-origin capability including localStorage access and same-origin fetch. This is an incomplete fix for CVE-2022-24833: the 2022 patch only sanitized the preview blob for SVG files but never updated the download link's blob, leaving all non-SVG active content types-including text/html-completely bypassing DOMPurify. A detailed proof-of-concept demonstrating exploitation with Playwright/Chromium automation is publicly available in GitHub Security Advisory GHSA-f2xf-7x3g-4272; no public exploit identified as confirmed actively exploited per CISA KEV.
Origin validation failure in Microsoft Edge (Chromium-based) enables unauthenticated remote attackers to bypass browser security features, resulting in limited cross-origin confidentiality and integrity impacts. The vulnerability (CWE-346) exploits improper validation of request origins within the Chromium-based browser engine and requires user interaction to trigger. No public exploit code has been identified at time of analysis, and Microsoft has released a patch via the MSRC update guide.
Use-after-free (CWE-416) in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to crash the browser through a crafted webpage, resulting in a denial-of-service condition. Critically, the CVE description claims code execution capability, but the CVSS vector (C:N/I:N/A:L, score 4.3) directly contradicts this - a genuine RCE would produce C:H/I:H impact in the 8-9+ range; this discrepancy should be verified against the full MSRC advisory. No active exploitation has been confirmed and no public POC has been reported; a vendor patch is available via the Microsoft Security Response Center.
Spoofing via external file path control in Microsoft Edge (Chromium-based) enables a network-based, unauthenticated attacker to deceive users about the origin or content of resources rendered by the browser. The CVSS score of 6.5 (Medium) reflects a network-reachable attack requiring user interaction but no attacker privileges, with high confidentiality impact and no integrity or availability impact. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog; a vendor patch is available through Microsoft MSRC.
Parameter/argument delimiter injection in Microsoft Edge (Chromium-based) enables network-based code execution by an unauthenticated remote attacker who can induce a user to interact with malicious content. The flaw, classified under CWE-141, stems from insufficient sanitization of delimiter characters in parameter or argument handling within the browser, potentially allowing injected values to alter command or function execution semantics. Tags associated with this CVE include 'Authentication Bypass', suggesting the delimiter injection may also facilitate circumventing browser-level or web-application authentication controls in certain contexts. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor patch is available.
Incorrect authorization in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to disclose limited information and cause minor integrity impact by luring a user to attacker-controlled web content. The flaw stems from CWE-863, where Edge's authorization logic fails to correctly enforce access boundaries, permitting content-triggered data exposure within the browser's security context. No public exploit has been identified at time of analysis, and Microsoft has released a patch via the MSRC advisory.
In the Linux kernel, the following vulnerability has been resolved: crypto: ccp - Treat zero-length cert chain as query for blob lengths When handling a PDH export, treat a zero-length userspace cert chain buffer as a request to query the length of the relevant blobs. Failure to account for the zero-length buffer trips a BUG_ON() when running with CONFIG_DEBUG_VIRTUAL=y due to trying to get the physical address of the ZERO_SIZE_PTR (returned by kzalloc() on the bogus allocation). kernel BUG at arch/x86/mm/physaddr.c:28 ! Oops: invalid opcode: 0000 [#1] SMP KASAN NOPTI CPU: 30 UID: 0 PID: 28580 Comm: syz.2.18 Kdump: loaded Tainted: G W 6.18.16-smp-DEV #1 NONE Tainted: [W]=WARN Hardware name: Google, Inc. Arcadia_IT_80/Arcadia_IT_80, BIOS 12.62.0-0 11/19/2025 RIP: 0010:__phys_addr+0x16a/0x180 arch/x86/mm/physaddr.c:28 RSP: 0018:ffffc9008329fc80 EFLAGS: 00010293 RAX: ffffffff8179110a RBX: 0000778000000010 RCX: ffff8884e6992600 RDX: 0000000000000000 RSI: 0000000080000010 RDI: 0000778000000010 RBP: ffffc9008329fdf0 R08: 0000000000000dc0 R09: 00000000ffffffff R10: dffffc0000000000 R11: fffffbfff126d297 R12: dffffc0000000000 R13: 1ffff92010653fc8 R14: 0000000080000010 R15: dffffc0000000000 FS: 0000555556bec9c0(0000) GS:ffff88aa4ce1c000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00007fd3159e7000 CR3: 00000004fbc44000 CR4: 0000000000350ef0 Call Trace: <TASK> [<ffffffff853d3869>] sev_ioctl_do_pdh_export+0x559/0x7a0 drivers/crypto/ccp/sev-dev.c:2308 [<ffffffff853d1fdd>] sev_ioctl+0x2cd/0x480 drivers/crypto/ccp/sev-dev.c:2556 [<ffffffff82549ebc>] vfs_ioctl fs/ioctl.c:52 [inline] [<ffffffff82549ebc>] __do_sys_ioctl fs/ioctl.c:598 [inline] [<ffffffff82549ebc>] __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:584 [<ffffffff8630115f>] do_syscall_x64 arch/x86/entry/syscall_64.c:64 [inline] [<ffffffff8630115f>] do_syscall_64+0x9f/0xf40 arch/x86/entry/syscall_64.c:98 [<ffffffff81000136>] entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fd3158eac39 </TASK> Thankfully, the bug is benign outside of CONFIG_DEBUG_VIRTUAL=y as getting the physical address is just arithmetic, and the PSP errors out before trying to write to the garbage address (which it must, otherwise querying the blob lengths would clobber memory at pfn=0).
Path traversal in flutter_file_picker's Android implementation (all versions through 10.3.10) allows a malicious Android app on the same device to write arbitrary files into the victim app's internal storage directories. The openFileStream() method in FileUtils.kt constructs file paths using the DISPLAY_NAME value returned by ContentResolver.query() without sanitization, making it trivially exploitable by a crafted ContentProvider that returns filenames containing ../ sequences. No public exploit has been identified at time of analysis; SSVC classifies exploitation as none and the attack is not automatable, keeping real-world risk constrained despite the clear code-level flaw.
Reflected XSS in Netron desktop application versions 9.1.2 and earlier enables arbitrary JavaScript execution within the Electron/Chromium renderer by injecting payloads into unsanitized model node names, types, and attribute descriptions. Reported by HiddenLayer, the vulnerability allows an attacker who can deliver a crafted ML model file to hide graph nodes, conduct local network port scanning, and - when chained with a Chrome n-day exploit - escalate to full Remote Code Execution on the victim's machine. No public exploit has been identified at time of analysis, and the CVE is not currently listed in the CISA KEV catalog.
Reflected XSS in Netron ≤9.1.2 desktop application executes attacker-controlled JavaScript when a user opens a specially crafted ML model file containing malicious node names, descriptions, or type labels. Because Netron is Electron-based, XSS runs in a privileged Chromium renderer context - enabling SSRF-style local port scanning and, when chained with an unspecified Chrome n-day vulnerability, potential remote code execution on the host. No public exploit confirmed at time of analysis, but HiddenLayer published a security advisory documenting the impact chain.
Reflected XSS in Netron desktop application versions ≤9.1.2 executes attacker-controlled JavaScript when a victim opens a crafted neural network model file containing malicious node names, type labels, or value descriptions. Because Netron runs on Electron (a Chromium-based runtime), the injected script operates within a privileged renderer process capable of port-scanning local networks and, with a separately-acquired Chrome n-day, achieving full remote code execution on the host machine. HiddenLayer reported the vulnerability and a vendor fix is available via GitHub commit cd14bad8c91; no public standalone exploit has been confirmed and this CVE does not appear in CISA KEV.
Stored Cross-Site Scripting in the Reviews and Rating - Google Reviews WordPress plugin (all versions through 5.10) allows authenticated Contributors to inject arbitrary JavaScript via the wp_display() shortcode handler's unsanitized html_tags parameter. The malicious script persists server-side and executes in the browsers of any users who subsequently load the affected page, enabling session hijacking, credential theft, or unauthorized actions under the victim's identity. No confirmed active exploitation or public exploit code has been identified at time of analysis; the primary risk driver is the low privilege bar required - Contributor-level access - which is commonly available on multi-author or open-registration WordPress sites.
Improper authorization in Myna Point's Android Intent handler allows a co-installed malicious application to invoke the app's custom URL scheme handler without caller validation, triggering arbitrary JavaScript execution within the app's WebView context. All versions of the Japanese government digital identity application (Digital Agency, CPE wildcard) appear affected per JVN advisory JVN67155805. No public exploit identified at time of analysis, though the attack surface is inherently local and requires a malicious app on the same device.
Skia, the 2D graphics rendering library embedded in Google Chrome's renderer process, contains an uninitialized resource flaw that allows remote attackers to read stale sandbox memory contents by inducing a victim to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms, with confidentiality impact confined to the renderer sandbox. The EPSS score of 0.19% (9th percentile) and absence from CISA KEV reflect low observed exploitation pressure, though such memory-read primitives are classically useful as components in multi-stage exploit chains targeting browser memory.
Incorrect reference resolution in the CustomTabs component of Google Chrome for Android (all versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to bypass Android system access restrictions by delivering a crafted HTML page. The integrity impact is limited (I:L, S:U) with no confidentiality or availability consequence. No public exploit code exists and exploitation status is confirmed as none by SSVC assessment, placing this squarely in standard patch-cycle priority rather than emergency response.
Cookie input validation bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to circumvent web origin policy restrictions. Exploitation requires a second-stage attack where a separately compromised renderer is leveraged via a crafted HTML page, making this a chained exploit component rather than a standalone initial-access vulnerability. No public exploit code has been identified and CISA has not listed this in the KEV catalog; EPSS at 0.18% (8th percentile) and a 'Low' Chromium-internal severity rating reflect limited real-world exploitation risk.
Sensitive information disclosure in Google Chrome on Windows prior to 152.0.7977.65 exposes confidential browser or system data to remote attackers who trick users into visiting a crafted HTML page. The root cause is improper input validation in Chrome's Network component (CWE-20), enabling a network-accessible attacker to exploit the flaw without privileges, though social engineering is required to achieve user interaction. No public exploit code or CISA KEV listing is confirmed, and the EPSS score of 0.17% (7th percentile) reflects low current exploitation probability despite the High confidentiality impact in the CVSS rating.
Proxy functionality in Google Chrome on Windows prior to 152.0.7977.65 incorrectly implements specified behavior, enabling an adjacent-network attacker to intercept or infer sensitive information by sending crafted network traffic. The flaw is Windows-platform-specific and is classified by the Chromium security team as Low severity, consistent with the high attack complexity and adjacency requirement that constrain realistic exploitation. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.13%, placing this in the 3rd percentile of exploitability.
Information disclosure in Google Chrome's Mobile component on iOS (all versions prior to 152.0.7977.65) allows a local attacker to read sensitive information by inducing the user to open a crafted file. Exploitation requires physical or logical local access to the device and user interaction, limiting the practical attack surface significantly. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation as none with only partial technical impact.
Information disclosure in Google Chrome's Mobile component on iOS exposes sensitive data to local attackers operating via a local program, affecting all Chrome for iOS versions prior to 152.0.7977.65. The vulnerability is classified CWE-200 (Exposure of Sensitive Information) and carries a Chromium internal severity of Low, which aligns with SSVC's assessment of partial technical impact and non-automatable exploitation. No public exploit code exists and no active exploitation has been confirmed; the EPSS score of 0.18% (7th percentile) reflects minimal real-world exploitation pressure.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to potentially leak sensitive information by serving a crafted HTML page to a victim. The flaw is classified as CWE-863 (Incorrect Authorization), meaning Chrome's DOM implementation fails to properly enforce access controls for certain document-level resources. No public exploit code has been identified and EPSS sits at 0.17% (6th percentile), consistent with Chrome's own 'Low' severity rating despite the medium CVSS 6.5 score driven by the C:H metric.
Incorrect authorization in the Forms component of Google Chrome prior to version 152.0.7977.65 enables a remote unauthenticated attacker to obtain sensitive browser-held form data by directing a victim to a crafted HTML page. The CVSS 6.5 score reflects high confidentiality impact (C:H) with no integrity or availability consequence, consistent with a pure information disclosure primitive. No public exploit identified at time of analysis; EPSS of 0.17% at the 6th percentile and Chromium's own 'Low' internal severity rating together suggest low near-term exploitation likelihood despite the meaningful CVSS base score.
Missing authorization in Chrome's InterestGroups API allows a renderer-compromised attacker to bypass system access restrictions via a crafted PDF file. Affected are all Google Chrome versions prior to 152.0.7977.65 across desktop platforms. This is a chained exploit: a prerequisite renderer-process compromise must already exist before the InterestGroups flaw can be leveraged to escalate beyond sandbox constraints and achieve high integrity impact. No public exploit or CISA KEV listing exists; EPSS stands at 0.23% (13th percentile), reflecting very low exploitation probability in the wild.
Incorrect authorization (CWE-863) in Chrome's Browser component on Android allows remote attackers to bypass system access restrictions through social engineering and UI interaction. Affected versions are all Chrome releases for Android prior to 152.0.7977.65. The flaw carries only a limited integrity impact with no confidentiality or availability consequence, and Chromium's own severity rating of 'Low' is consistent with the very low EPSS score of 0.17% (7th percentile). No public exploit code exists and the vulnerability has not been added to the CISA KEV catalog.
System access restriction bypass in Google Chrome Mobile on iOS prior to version 152.0.7977.65 enables a remote attacker to circumvent platform-level security controls by luring a victim to a specially crafted HTML page. The flaw stems from improper input validation (CWE-20) in Chrome's iOS mobile implementation and results in a low-integrity impact with no confidentiality or availability consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability is 0.22% (12th percentile), and CISA SSVC classifies exploitation as none and technical impact as partial, consistent with a low-priority patching posture for most organizations.
Race condition in Chrome's Extensions subsystem (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions via a crafted Chrome extension, achieving high integrity impact with no confidentiality or availability effect. User interaction is required, and Chromium's own internal severity rating is Low - notably lower than the NVD CVSS Medium score of 6.5 - consistent with EPSS of 0.22% (12th percentile) and SSVC's 'none' exploitation status. No public exploit exists and the vulnerability is not in CISA KEV at time of analysis.
The Passwords (built-in credential manager) component of Google Chrome on iOS prior to version 152.0.7977.65 leaks sensitive password data to a local attacker who can supply a crafted file, enabling unauthorized retrieval of stored credentials. Only the iOS platform is affected, and the Chromium security team rates this as Low severity internally. No public exploit code exists and EPSS stands at 0.11% (1st percentile), indicating very low near-term exploitation likelihood despite the high confidentiality impact of the exposed data.
Information leak in Google Chrome's XR (WebXR) subsystem allows unauthenticated remote attackers to obtain sensitive browser-context information when a victim visits a crafted HTML page. All Chrome desktop versions prior to 152.0.7977.65 are affected, with the vendor classifying severity as Low internally despite a CVSS 3.1 base score of 6.5 driven by high confidentiality impact. No public exploit has been identified and EPSS exploitation probability is very low at 0.17% (7th percentile), suggesting real-world risk remains limited; however, the zero-friction delivery vector - a single malicious page visit - warrants prompt patching given Chrome's ubiquitous deployment.
Information disclosure via Chrome's DataTransfer API in versions prior to 152.0.7977.65 allows remote attackers to obtain sensitive information when a victim visits and interacts with a crafted HTML page. Chromium's own Low severity classification creates a notable tension with the CVSS C:H rating, likely indicating that the scope of leaked data is constrained despite the high confidentiality label. No public exploit code or active exploitation has been confirmed; EPSS at 0.21% (11th percentile) places this firmly in the routine patching category.
Out-of-bounds read in Chrome's Skia graphics library exposes sandbox memory to attackers who have already compromised the renderer process. Exploitation requires a prior renderer compromise plus user interaction with a crafted HTML page, making this a chained second-stage information disclosure rather than a standalone critical flaw. Chromium's own severity rating is Low; no public exploit or CISA KEV listing exists, and EPSS sits at just 0.17%.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to violate the browser's same-origin isolation guarantees through a crafted Chrome extension delivered via social engineering. The CWE-459 incomplete cleanup root cause means residual state is left after a browsing or extension context transition, enabling a malicious extension to interact with origins it should not have access to - resulting in a High integrity impact per the CVSS vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis; the EPSS score of 0.24% (14th percentile) reflects low observed exploitation pressure, consistent with the social-engineering prerequisite and the Chromium team's own Low severity designation.
Web origin policy bypass in Google Chrome's ReaderMode feature prior to version 152.0.7977.65 allows a remote attacker to inject content into a privileged browser page context via a crafted HTML page, requiring social engineering to achieve user interaction. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) limits impact to integrity only, with no confidentiality or availability consequences. No public exploit code or CISA KEV listing exists; EPSS at 0.26% (17th percentile) confirms very low observed exploitation probability.
Cross-origin information leakage in the FoldableAPIs component of Google Chrome prior to 152.0.7977.65 enables a remote attacker to read sensitive device-geometry data from foldable-form-factor devices by luring a user to a crafted HTML page. The affected API fails to enforce origin isolation, exposing data that should be inaccessible to untrusted cross-origin scripts. No public exploit has been identified and SSVC rates exploitation status as none; Chromium's own internal severity classification of 'Low' contrasts with the NVD-assigned 6.5 Medium, reflecting the bounded real-world impact.
UI misrepresentation in Google Chrome's Web Authentication (WebAuthn) subsystem - covering both Passkeys and hardware Security Keys - prior to version 152.0.7977.65 allows remote attackers to manipulate authentication dialog presentation via a crafted HTML page, enabling bypass of system access restrictions through social engineering. The CVSS vector rates Integrity impact as High (I:H) with no privileges required (PR:N), yet Chromium's own team assigned Low severity, and EPSS exploitation probability is just 0.22% (12th percentile), reflecting the social engineering dependency. No public exploit has been identified and no CISA KEV listing exists at time of analysis.
ServiceWorker improper input validation in Google Chrome prior to 152.0.7977.65 enables a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms no authentication is required from the attacker but user interaction is necessary, limiting the scope of practical exploitation. No public exploit has been identified at time of analysis, and EPSS is low at 0.30% (23rd percentile), consistent with the internal Chromium severity rating of Low.
Out-of-bounds memory read in Chrome's Tint graphics library on Android exposes sandbox-contained memory to remote attackers. Google Chrome for Android prior to 152.0.7977.65 is affected; an attacker who lures a user to a crafted HTML page can trigger the flaw and read arbitrary memory within the Chrome sandbox. No active exploitation has been identified - Chromium's own security team rates this as Low severity, consistent with the 0.17% EPSS score and the absence of a CISA KEV listing.
Incorrect authorization in Google Chrome's Media component on Windows enables a remote attacker who has already compromised the renderer process to bypass OS-level system access restrictions via a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on Windows. No public exploit code has been identified and EPSS probability is very low at 0.21% (11th percentile), though the sandbox-escape nature of this flaw makes it a meaningful chaining risk in multi-stage attacks.
StorageAccessAPI incorrect authorization in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass web origin policy via a crafted HTML page, achieving high-integrity impact against cross-origin resources. The flaw (CWE-863) is a post-exploitation second-stage primitive: it cannot be leveraged without a preceding renderer compromise, substantially narrowing its realistic threat scope beyond what the CVSS 6.5 score implies. No public exploit code has been identified, EPSS stands at 0.19%, Chromium's own internal severity rating is Low, and there is no CISA KEV listing at time of analysis.
UI spoofing in Google Chrome prior to 152.0.7977.65 allows unauthenticated remote attackers to misrepresent browser interface elements through a crafted HTML page, requiring only that a user visit the malicious content. Classified as CWE-451 (UI Misrepresentation of Critical Information), the flaw breaks the trust contract between the browser and user by rendering deceptive interface states - a classic phishing-enabler primitive. No public exploit code has been identified and EPSS stands at 0.22% (12th percentile), consistent with Chromium's own Low severity rating; real-world exploitation impact is constrained by its dependence on social engineering and user interaction.
Cross-origin data exposure in Google Chrome's StorageAccessAPI implementation allows a remote attacker to read data across origin boundaries by directing a victim to a specially crafted HTML page. All Chrome desktop releases prior to 152.0.7977.65 are affected across all platforms. No public exploit code has been identified and CISA SSVC classifies current exploitation status as none, consistent with the Chromium team's own Low severity rating.
UI spoofing in Google Chrome on macOS prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to forge browser UI elements via a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted interface. The vulnerability is macOS-specific and requires renderer process compromise as an explicit prerequisite, significantly limiting its standalone exploitability. No public exploit code or active exploitation (CISA KEV) has been identified; an EPSS score of 0.21% (11th percentile) reflects negligible likelihood of independent exploitation.
Missing authorization in Google Chrome's Browser component on macOS (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy and reach privileged browser pages via a crafted HTML page, contingent on social engineering the victim into visiting the page. Impact is limited to integrity (CVSS I:L) with no confidentiality or availability consequences; EPSS at 0.26% (18th percentile) signals negligible current exploitation probability. No public exploit identified at time of analysis, and the vendor-released patch is available as of version 152.0.7977.65.
Address bar spoofing in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to deceive users about the current page origin via a crafted HTML page. The root cause is missing authorization (CWE-862) in Chrome Core, where the renderer can influence address bar state without proper permission checks. No public exploit code or CISA KEV listing exists at time of analysis; EPSS is very low at 0.28%, consistent with the chained exploitation requirement.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker to circumvent same-origin restrictions via a crafted HTML page, achieving limited integrity impact in the user's browsing context. The flaw is rooted in incorrect authorization logic (CWE-863) within Chrome's Select component, as confirmed by the vendor's stable channel advisory. No public exploit has been identified at time of analysis, and EPSS signals very low exploitation probability at 0.26% (18th percentile), consistent with Chromium's own Low severity rating.
Incorrect authorization in Chrome's StorageAccessAPI (versions prior to 152.0.7977.65) enables a renderer-compromised attacker to bypass the web origin policy via a crafted HTML page. This is a chained vulnerability - exploitation is contingent on a prior renderer process compromise, making it a second-stage component in a multi-bug attack chain rather than a standalone threat. No public exploit identified at time of analysis; EPSS at 0.23% (14th percentile) confirms low independent exploitation probability, consistent with Chromium's own 'Low' internal severity rating despite the NVD-assigned 6.5 CVSS score.
Web origin policy bypass in Google Chrome on Windows (prior to 152.0.7977.65) via improper input validation in the New Tab Page (NTP) Footer component enables integrity compromise without confidentiality loss. Exploitation is contingent on the attacker having already achieved renderer process compromise, making this a chained, post-exploitation primitive rather than a standalone vector. No public exploit code exists and EPSS sits at the 8th percentile, consistent with Chromium's own Low severity rating - though the integrity impact is rated High under CVSS.
Web origin policy bypass in Google Chrome's ReadingList component on Windows enables a renderer-compromised attacker to cross origin boundaries via a crafted HTML page. Affected are all Chrome for Windows versions prior to 152.0.7977.65. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), and Chromium's own security team rates this as Low severity despite the NVD CVSS score of 6.5.
Incorrect reference resolution in the WebView component of Google Chrome on Android (versions prior to 152.0.7977.65) enables a remote attacker to potentially bypass the web origin policy by delivering a crafted HTML page. The flaw carries a Chromium-internal severity of Low, consistent with the limited confidentiality-only impact (C:L/I:N/A:N) reflected in the CVSS 4.3 score. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) confirms negligible current exploitation probability.
Memory disclosure via uninitialized GPU resource in Google Chrome on Android (prior to 152.0.7977.65) allows a remote attacker to read memory outside the browser sandbox by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a low-complexity network attack requiring no privileges but dependent on user interaction. No public exploit code has been identified at time of analysis, and the low EPSS score of 0.31% corroborates a currently low exploitation probability despite Chrome's enormous Android deployment footprint.
Memory disclosure in Google Chrome for Android (prior to 152.0.7977.65) exposes sandbox-contained memory via an uninitialized GPU resource, triggered when a victim loads a crafted HTML page. The flaw is platform-specific to Android and carries confidentiality-only impact bounded by Chrome's GPU sandbox isolation - no integrity or availability exposure. No public exploit code is identified at time of analysis, and EPSS at 0.31% (24th percentile) aligns with the vendor's own 'Low' Chromium severity rating, indicating low near-term exploitation probability.
Incorrect authorization in the Controls component of Google Chrome prior to version 152.0.7977.65 enables web origin policy bypass via a crafted HTML page, requiring only that a user visit the attacker-controlled page. The flaw (CWE-863) allows limited cross-origin integrity manipulation with no confidentiality or availability impact, as reflected in the CVSS integrity-only impact score. No public exploit has been identified at time of analysis, EPSS stands at 0.19% (8th percentile), and the Chromium team internally rated severity as Low - all signals consistent with a narrow-impact, user-interaction-dependent authorization gap.
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
UI spoofing in Google Chrome's Transactions Platform prior to version 152.0.7977.65 enables remote attackers to misrepresent UI elements - such as payment confirmation dialogs or security indicators - through a crafted HTML page, relying on social engineering for delivery. Classified under CWE-451 (UI Misrepresentation of Critical Information), the flaw requires user interaction and carries no confidentiality or availability impact, confining harm to integrity via deception. No active exploitation is confirmed and EPSS probability is very low (0.29%), but the ubiquitous deployment footprint of Chrome means the absolute population of potential targets is large.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
Skia, the 2D graphics library embedded in Google Chrome prior to 152.0.7977.65, leaks sensitive information when an attacker who has already compromised the renderer process delivers a crafted HTML page to a victim. This CWE-200 flaw functions as a chaining component in a multi-stage exploit rather than a standalone entry point - it amplifies the impact of a prior renderer compromise rather than providing initial access. No public exploit code exists, EPSS is 0.17% (7th percentile), and Chrome's own severity classification is Low, all consistent with the mandatory pre-condition of a pre-compromised renderer.
Race condition in Google Chrome's Transactions Platform on Android (prior to 152.0.7977.65) enables remote attackers to bypass system access restrictions with high integrity impact. Exploitation requires social engineering the victim into visiting a crafted HTML page, and the race window makes reliable triggering difficult (AC:H per CVSS). Chromium's own severity rating is Low; EPSS at 0.18% (7th percentile) confirms minimal real-world exploitation pressure, and no public exploit or KEV listing has been identified.
Missing authorization in the BrowserTag component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by distributing a crafted Chrome extension via social engineering. The flaw bypasses authorization checks within BrowserTag, allowing the malicious extension to access data it should not be permitted to read. No active exploitation has been identified (CISA KEV absent), EPSS sits at 0.23% (13th percentile), and Chromium's own severity classification is 'Low' - all consistent with the UI:R prerequisite of tricking a user into installing a hostile extension.
Out-of-bounds memory read in Google Chrome's FileSystem component (versions prior to 152.0.7977.65) allows a remote unauthenticated attacker to leak memory contents from outside the browser's renderer sandbox by directing a victim to a specially crafted HTML page via social engineering. Exploitation is contingent on user interaction, limiting opportunistic or automated mass exploitation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), though the Confidentiality impact is rated High, meaning successful exploitation could expose sensitive data from browser memory. Vendor-released patch is available in Chrome 152.0.7977.65.
Web origin policy bypass in Google Chrome Extensions affects all desktop versions prior to 152.0.7977.65, exploitable only by an attacker who has already compromised the renderer process. The incorrect authorization flaw (CWE-863) in the Extensions subsystem allows the renderer-level attacker to cross Same-Origin Policy boundaries via a specially crafted HTML page, potentially reading data from origins the renderer should not access. No public exploit code and no CISA KEV listing exist; EPSS is 0.19% (8th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Observable discrepancy in Chrome's Glic component allows remote information disclosure against users running versions prior to 152.0.7977.65. An attacker who persuades a victim to visit a crafted HTML page can exploit a behavioral or timing side-channel in the Glic AI-integration subsystem to extract sensitive information with high confidentiality impact, despite the medium overall CVSS score. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) indicates very low current exploitation probability.
Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Improper input validation in Chrome's DeviceBoundSessionCredentials (DBSC) component allows remote attackers to bypass the web origin policy by delivering crafted network traffic, contingent on social engineering the user into triggering the request. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the low-to-medium CVSS 4.3 rating and the user-interaction prerequisite.
Race condition in Google Chrome's Editing component prior to version 152.0.7977.65 enables remote attackers who successfully socially engineer a victim to visit a crafted HTML page to extract sensitive information from the browser. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) shows the attack is network-delivered but requires high complexity timing and explicit user interaction, limiting real-world exploitability. No public exploit identified at time of analysis, and the extremely low EPSS score of 0.14% (4th percentile) corroborates the vendor's own Low Chromium severity designation.
Incorrect authorization in Chrome's WebProtect component (CWE-863) allows a remote attacker to bypass system access restrictions via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms impact is limited to partial integrity loss with no confidentiality or availability consequence, and exploitation is gated on the victim actively navigating to attacker-controlled content. No active exploitation is confirmed - CISA KEV status is absent and EPSS stands at 0.19% (8th percentile), consistent with the Low severity rating assigned by the Chromium security team.
Bluetooth information disclosure in Google Chrome on macOS (versions prior to 152.0.7977.65) enables a remote attacker - who has already compromised the renderer process - to extract sensitive Bluetooth-related information by combining a crafted HTML page with social engineering. This is a chained, multi-prerequisite vulnerability: successful exploitation requires a prior renderer compromise and active victim interaction, which the CVSS AC:H rating reflects. No public exploit code exists and no active exploitation has been observed (SSVC: Exploitation none; EPSS 0.29%), placing real-world risk substantially below what the C:H confidentiality impact alone might suggest. A vendor patch is available in Chrome 152.0.7977.65.
Chrome's Workers component prior to version 152.0.7977.65 mismanages resource lifetimes (CWE-664), enabling a site isolation bypass that allows cross-origin data to be read by an attacker who has already compromised the renderer process via a separate exploit. This is a second-stage chained primitive, not a standalone attack - it requires both user interaction with a crafted HTML page and a pre-existing renderer compromise. No public exploit code has been identified and EPSS of 0.20% (10th percentile) reflects very low observed exploitation probability.
Missing authorization in Chrome's Preload subsystem (CWE-862) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. The bypass results in limited cross-origin data disclosure (confidentiality impact only). No public exploit code has been identified and the CVE is absent from the CISA KEV catalog; EPSS stands at 0.22% (13th percentile), consistent with low real-world exploitation activity.
Sensitive information exposure in Google Chrome for Android (versions prior to 152.0.7977.65) via the Android Intents mechanism allows a remote attacker to leak confidential browser or device data by delivering a crafted HTML page to the victim. The vulnerability requires user interaction - the target must visit the malicious page - limiting opportunistic mass exploitation despite the network-accessible attack vector. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.17%, consistent with Chromium's own 'Low' severity classification, though the CVSS C:H rating reflects a meaningful confidentiality impact if triggered.
Chrome's Sharing feature on Android leaks sensitive information to local attackers in all versions prior to 152.0.7977.65, exploitable only when a malicious co-installed app is present on the target device combined with social engineering. Despite a High confidentiality impact in the CVSS vector, the overall score of 5.1 reflects severe practical constraints: local access, high complexity, and a social engineering dependency. No public exploit code has been identified, EPSS probability is 0.15% (4th percentile), and Chromium's own severity rating is Low - signals that align to suggest low near-term operational risk.
UI misrepresentation in Google Chrome's Linux Toolkit Theming component enables remote attackers to bypass system access restrictions through a crafted HTML page, relying on social engineering to complete the attack. All Chrome versions prior to 152.0.7977.65 on Linux are affected; Google shipped the fix in stable channel release 152.0.7977.65. No active exploitation has been confirmed (absent from CISA KEV), and an EPSS of 0.30% at the 23rd percentile reflects low automated exploitation probability.
Incorrect authorization in Google Chrome's browser component prior to version 152.0.7977.65 allows web origin policy bypass via a crafted HTML page. Remote unauthenticated attackers can exploit this flaw by inducing a user to visit a malicious page, resulting in limited cross-origin data reads - a breach of the same-origin policy, which is a foundational browser security boundary. No public exploit identified at time of analysis and not listed in CISA KEV; EPSS of 0.19% (8th percentile) confirms low exploitation probability in the current threat landscape.
System access restriction bypass in Google Chrome's Workers subsystem affects all versions prior to 152.0.7977.65, functioning as the second link in an exploit chain where an attacker must first compromise the renderer process. Improper input validation in Workers then allows a crafted HTML page to circumvent Chrome's sandbox-enforced access controls, yielding limited confidentiality and integrity impact on the host. EPSS is 0.22% (12th percentile) with no confirmed active exploitation via CISA KEV, placing this squarely in the category of a chained, low-probability threat rather than a mass-exploitation vector.
DOM information leak in Google Chrome before version 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy by luring a victim to a crafted HTML page, potentially exposing cross-origin data to the attacker. The CVSS 4.3 Medium score reflects network-exploitable, unauthenticated delivery limited to confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and an EPSS probability of 0.22% (12th percentile) indicates low near-term exploitation likelihood despite the broad affected product footprint.