Monthly
Out-of-bounds read in Google Chrome's Media component prior to version 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to leak memory contents across the Chrome sandbox boundary via a crafted HTML page. The attack is a chained, second-stage capability - it requires prior renderer code execution and user interaction - not a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low observed exploitation likelihood.
Uninitialized GPU resource use in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read memory outside the Chrome sandbox boundary via a crafted HTML page. The vulnerability (CWE-908) is a second-stage primitive - it cannot be exploited in isolation and requires a pre-existing renderer process compromise as a hard prerequisite. No public exploit code has been identified and EPSS stands at 0.31%, consistent with its role as a chained exploitation component rather than a primary attack vector.
Cross-origin data exposure in Google Chrome's Extensions subsystem prior to version 152.0.7977.65 allows a remote attacker who successfully socially engineers a victim into installing a crafted malicious extension to read data from web origins the extension should not have access to. The high confidentiality impact (C:H) is real, but exploitation is gated on user interaction - the victim must install the malicious extension - which substantially limits opportunistic mass exploitation. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.27% (18th percentile) reflects low current exploitation probability consistent with no observed in-the-wild use.
Information disclosure in Google Chrome's Geolocation component prior to version 152.0.7977.65 allows a remote attacker to obtain the victim's sensitive geolocation data by tricking them into visiting a crafted HTML page. The attack relies on social engineering as the delivery mechanism and results in a high-confidentiality-impact leak of physical location information, which may expose home or workplace addresses. No public exploit code or active exploitation has been identified; EPSS at 0.21% (11th percentile) confirms low automated exploitation probability at time of analysis.
Cross-origin data exposure in Google Chrome before 152.0.7977.65 enables a chained information leak when a renderer process has already been compromised by a separate exploit. Chrome's CORS implementation incorrectly permits cross-origin data access from within a compromised renderer, allowing a remote attacker to exfiltrate data from origins the victim is authenticated to via a crafted HTML page. No public exploit code exists and no CISA KEV listing has been issued; the EPSS score of 0.17% (7th percentile) confirms this is a low-probability, low-severity secondary element of multi-stage browser attack chains rather than a standalone threat.
Memory disclosure in Google Chrome's Dawn WebGPU component exposes uninitialized memory contents to remote attackers who can lure a user to a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on desktop platforms, per the EUVD and Chrome release advisory. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Site isolation bypass in Google Chrome DevTools (versions prior to 152.0.7977.65) enables cross-origin data theft as a second-stage exploit following renderer process compromise. An attacker who has already gained control of a Chrome renderer - itself requiring exploitation of a separate vulnerability - can serve a crafted HTML page exploiting improper input validation in DevTools to breach the browser's inter-site boundary and read data from other open origins. No public exploit code exists and EPSS of 0.22% (12th percentile) confirms this is not currently seeing broad opportunistic exploitation, though the technique is highly attractive for targeted, multi-stage browser exploit chains.
Cross-origin data leakage via an uninitialized resource in the WebXR API affects Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker who can socially engineer a user into visiting a crafted HTML page may trigger a read of uninitialized memory, potentially exposing data from other browser origins. Google has rated this Medium severity; a patched release (152.0.7977.65) is available, and no public exploit or active exploitation has been identified at time of analysis.
Cross-origin data exposure via a ServiceWorker flaw in Google Chrome prior to 152.0.7977.65 permits remote attackers to read data from origins they do not control. An attacker can exploit this by delivering a crafted HTML page to a victim user, leveraging Chrome's ServiceWorker API to bypass same-origin isolation and exfiltrate cross-origin responses. No public exploit code is identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation activity; the mandatory user-interaction requirement further constrains automated abuse.
Incorrect USB authorization in Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass system USB access restrictions by socially engineering a user into visiting a crafted HTML page. The flaw (CWE-863) in Chrome's USB subsystem grants unauthorized access without proper permission verification, resulting in a limited integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS is very low at 0.21% (11th percentile), consistent with Chromium's own Medium severity rating; a vendor patch has been released.
Incorrect authorization in Google Chrome's WebXR implementation prior to version 152.0.7977.65 enables cross-origin data exfiltration via a crafted HTML page, requiring attacker-driven social engineering to direct a victim to the malicious page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5, reflecting high confidentiality impact but no integrity or availability loss, and user interaction is a necessary prerequisite. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog at time of analysis, with EPSS at 0.21% (11th percentile) confirming low observed exploitation activity.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.
Code injection in Google Chrome's Bisection component allows remote attackers to exfiltrate sensitive information by enticing a user to open a crafted file. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The vulnerability carries a CVSS 6.5 Medium rating with high confidentiality impact; no public exploit has been identified and EPSS sits at 0.19% (8th percentile), indicating minimal active exploitation pressure at time of analysis. Vendor patch is confirmed available.
Network-layer information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive data by directing a victim to a crafted HTML page. The attack is a multi-stage chain: the renderer compromise is a hard prerequisite not satisfied by this CVE alone, which materially constrains real-world exploitability. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) corroborates low observed exploitation probability; no CISA KEV listing exists.
Incorrect authorization in the Device component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions - specifically controls governing device-level API access - through a crafted HTML page delivered via social engineering. Exploitation requires user interaction, limiting opportunistic mass exploitation, and EPSS at 0.29% (21st percentile) reflects low real-world exploitation probability. No public exploit identified and no CISA KEV listing; a vendor patch is available.
Incorrect authorization in Chrome's GetUserMedia API allows remote attackers to obtain sensitive information - specifically unauthorized access to a user's camera or microphone feed - by luring the victim to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the High confidentiality impact warrants timely patching given Chrome's ubiquitous deployment.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) grants a remote attacker who has already compromised the renderer process the ability to circumvent Same-Origin Policy restrictions via a crafted HTML page, leaking limited confidential data from cross-origin contexts. This is a second-stage exploitation primitive - it is only dangerous when chained with a separate renderer compromise vulnerability. No public exploit identified at time of analysis, and the low EPSS score of 0.26% (18th percentile) reflects minimal current exploitation interest.
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. No public exploit code and no CISA KEV listing are present; EPSS places exploitation probability at 0.24% (15th percentile), consistent with a low-priority but broadly applicable patch.
Improper resource exposure in Google Chrome's StreamsAPI (versions prior to 152.0.7977.65) enables remote attackers to partially bypass the web origin policy and read limited data from privileged browser pages via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - consistent with CVSS UI:R and S:U, confining impact to the victim's own browser context. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.18% (8th percentile) indicates very low real-world exploitation probability at time of analysis.
DevTools Missing Authorization in Google Chrome prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers who socially engineer victims into performing specific UI interactions. The CWE-862 root cause indicates the DevTools component lacks proper authorization checks on certain UI-driven data access paths, allowing an attacker-controlled page to extract information the browser context holds. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.15% at the 5th percentile confirms minimal near-term exploitation probability despite the C:H CVSS impact rating.
Site isolation bypass in Google Chrome's Speech component allows an attacker who has already established a foothold in the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65 across all platforms covered by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis, EPSS probability is very low at 0.20% (10th percentile), and the vulnerability is not listed in CISA KEV - however its value as a second-stage exploit in a browser attack chain elevates practical concern above the low CVSS score alone.
Cross-origin data exfiltration via the BFCache mechanism in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read data across origin boundaries using a crafted HTML page. This information disclosure (CWE-200) is a second-stage capability, not a standalone attack - it requires chaining with a separate renderer RCE vulnerability, constraining real-world risk significantly. No public exploit code or active exploitation has been confirmed; EPSS is 0.17% and the vulnerability is absent from CISA KEV. Vendor patch is available in Chrome 152.0.7977.65.
Incorrect authorization in Google Chrome's Web Authentication subsystem (Passkeys and Security Keys) allows a remote attacker to bypass the web origin policy by inducing a user to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop platforms are affected. The impact is limited to partial confidentiality - origin policy bypass could expose authentication context or credential associations across origins - with no integrity or availability impact confirmed.
CSS injection in Google Chrome prior to version 152.0.7977.65 enables a remote attacker to extract sensitive information from a victim's browser session by delivering a crafted HTML page. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N vector confirms unauthenticated network delivery requiring only that the victim navigate to attacker-controlled content, with high confidentiality impact and no integrity or availability consequences. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% at the 10th percentile indicates very low observed exploitation probability; this is not listed in the CISA KEV catalog.
Chrome's FileSystem API prior to version 152.0.7977.65 improperly handles case sensitivity when enforcing access restrictions, enabling a remote attacker to bypass system-level file access controls via a crafted HTML page delivered through social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms a network-reachable, unauthenticated path with high integrity impact, though the mandatory user interaction requirement limits mass exploitation. No public exploit has been identified at time of analysis, and an EPSS of 0.33% at the 26th percentile reflects limited observed exploitation activity.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits incomplete cleanup (CWE-459) in the SiteIsolation component, enabling a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin process separation via a crafted HTML page. This is a chained, second-stage attack - the CVSS score of 3.1 (Low) and EPSS of 0.28% (20th percentile) reflect the high prerequisite bar of a prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in Google Chrome's Network component prior to version 152.0.7977.65 allows a remote, unauthenticated attacker to bypass the browser's web origin policy by delivering a crafted HTML page to a victim. The bypass yields limited confidentiality exposure, consistent with the CVSS C:L rating, and requires the target user to interact with attacker-controlled content. No public exploit code has been identified and EPSS stands at 0.19% (8th percentile), indicating low current exploitation probability despite the broad deployment footprint of Chrome.
Web origin policy bypass in Google Chrome's cache component affects all versions prior to 152.0.7977.65, exploitable by a remote unauthenticated attacker who tricks a user into visiting a crafted HTML page. The incorrect reference resolution (CWE-706) in the cache layer allows cross-origin data to be read, constituting a Same-Origin Policy bypass with limited confidentiality impact. No active exploitation is confirmed and EPSS sits at 0.20% (10th percentile), indicating low real-world exploitation pressure at this time.
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
CSS information leak in Google Chrome before 152.0.7977.65 enables remote attackers to exfiltrate sensitive browser data by luring victims to a crafted HTML page. The flaw resides in Chrome's CSS rendering subsystem (CWE-200: Information Exposure) and carries a CVSS C:H rating, meaning confidentiality impact is assessed as high despite the medium-severity label. No public exploit code has been identified and EPSS probability sits at 0.17% (7th percentile), indicating very low observed exploitation activity; the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's CustomTabs feature on Android (versions prior to 152.0.7977.65) enables a local attacker to infer cross-origin information via a co-installed malicious application. The vulnerability stems from an observable discrepancy (CWE-203) - a measurable side-channel difference in Chrome's behavior that a co-resident app can detect and use to reconstruct protected web content. Impact is confined to limited confidentiality loss; no public exploit has been identified at time of analysis, and EPSS at 0.15% (4th percentile) signals very low real-world exploitation probability.
Incorrect authorization in Chrome's ServiceWorker component (CWE-863) allows remote unauthenticated attackers who can socially engineer a user into installing a crafted Chrome extension to bypass the web origin policy, resulting in limited cross-origin data exposure. All Chrome releases prior to 152.0.7977.65 are affected across platforms; a vendor patch is available. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) indicates very low current exploitation probability, consistent with the absence of a CISA KEV listing.
Cross-origin data leakage through the CustomTabs component in Google Chrome for Android (versions prior to 152.0.7977.65) enables a local attacker to extract sensitive browsing data belonging to other origins via a co-installed application. The flaw is classified CWE-200 and carries a CVSS Medium score of 5.5, reflecting meaningful confidentiality impact constrained by a local-only attack vector and required user interaction. No public exploit code or active exploitation via CISA KEV has been identified; the vendor-released patch is available in Chrome 152.0.7977.65.
Incorrect authorization in Chrome's Editing component (prior to 152.0.7977.65) permits remote attackers to read sensitive information by enticing a user to visit a specially crafted HTML page. The flaw (CWE-863) affects all Chrome versions across all platforms below the fixed release, with a high confidentiality impact but no integrity or availability consequence. No public exploit code or active exploitation is confirmed; EPSS stands at 0.36% (28th percentile), indicating low real-world exploitation probability at time of analysis.
Information leak in the Animation component of Google Chrome prior to 152.0.7977.65 allows remote unauthenticated attackers to obtain sensitive browser data by inducing a user to visit a crafted HTML page. The flaw is classified CWE-200 (Exposure of Sensitive Information) and carries a CVSS confidentiality impact of High, though Chromium's internal team rated it Medium severity. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.22% (13th percentile) confirms very low observed exploitation probability, making this a normal patch-cycle priority rather than an emergency.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
Observable discrepancy in HTML rendering in Google Chrome prior to 152.0.7977.65 enables a remote attacker to extract sensitive information when a victim visits a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), where Chrome's handling of specific HTML constructs produces measurable behavioral differences - such as timing variations or rendering side-channels - that leak protected state. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating low opportunistic risk despite the High confidentiality impact rating in the CVSS vector.
Cross-origin data leakage in Google Chrome's Canvas API (versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to read pixel-level data from cross-origin resources rendered in a canvas element via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - and impact is limited to partial confidentiality loss (C:L), with no integrity or availability consequences. No public exploit code has been identified and EPSS sits at 0.27% (18th percentile), indicating low real-world exploitation probability; vendor-released patch is available.
ServiceWorker in Google Chrome versions prior to 152.0.7977.65 leaks sensitive information to remote attackers via a crafted HTML page, exploiting CWE-200 (Exposure of Sensitive Information to Unauthorized Actor). The vulnerability requires no attacker-side authentication (PR:N per CVSS) but does require user interaction - a victim must visit the malicious page. With CVSS C:H and no integrity or availability impact, the primary threat is data exfiltration; no public exploit has been identified at time of analysis and EPSS sits at a low 0.27%.
Missing authorization in Google Chrome's Network component prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions with high integrity impact by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-reachable exploitation requiring no attacker-side privileges, though a single user interaction gates the attack. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.23% (13th percentile) reflects low observed exploitation probability despite broad product exposure.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process - and further leverages social engineering - to circumvent Chrome's cross-origin security boundary via a crafted HTML page, resulting in limited confidentiality exposure. The flaw resides in the SiteIsolation authorization logic (CWE-863), meaning Chrome fails to correctly validate whether a renderer process is permitted to access data belonging to a different origin. With an EPSS of 0.23% (13th percentile) and no CISA KEV listing, real-world exploitation probability is low; the dual prerequisite of a pre-existing renderer compromise plus social engineering substantially raises the attack bar beyond what the low CVSS score alone conveys.
Improper privilege management in Google Chrome's FileSystem subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by tricking a user into loading a specially crafted HTML page. The flaw is rated CVSS 4.3 (Medium) with impact limited to low integrity bypass - no confidentiality or availability impact - and carries an EPSS of 0.23% (13th percentile), indicating minimal observed exploitation interest. Vendor patch is available in stable channel 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis.
Web origin policy bypass in Google Chrome's StorageAccessAPI enables an attacker who has already compromised the renderer process to exfiltrate cross-origin storage data via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The vulnerability is rated medium severity (CVSS 4.3) and requires both user interaction and a pre-existing renderer compromise, making it a second-stage chained exploit component rather than a standalone initial access vector. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.
Race condition in Google Chrome's Workers implementation before version 152.0.7977.65 allows a remote attacker to bypass system access restrictions, resulting in high integrity impact. Exploitation requires a victim to visit a crafted HTML page, placing this in the social-engineering-dependent threat category. No public exploit has been identified, and the EPSS score of 0.19% (9th percentile) indicates negligible observed exploitation in the wild at time of analysis.
Observable discrepancy in the Forms component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by serving a crafted HTML page that induces measurable behavioral side-channel differences. The CVSS vector (AC:H/UI:R) confirms exploitation requires both high attack complexity - precise timing or environmental control to reliably observe the discrepancy - and active user interaction to visit the malicious page. No public exploit has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) signals limited automated exploitation interest despite the high confidentiality impact designation.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to exfiltrate sensitive information by luring a user to a crafted HTML page. The flaw (CWE-863) bypasses DOM-level permission checks, resulting in High confidentiality impact with no integrity or availability consequences. No public exploit has been identified at time of analysis, and EPSS at 0.36% (28th percentile) indicates minimal observed exploitation pressure despite the patch now being available from Google.
Incorrect authorization in Google Chrome's Network subsystem (all versions before 152.0.7977.65) permits remote unauthenticated attackers to bypass system access restrictions by inducing a user to visit a crafted HTML page. Classified as CWE-863, the flaw allows a limited integrity violation against the affected system without confidentiality or availability impact. No public exploit has been identified at time of analysis, and the low EPSS score (0.38%, 31st percentile) indicates minimal current exploitation pressure.
CustomTabs in Google Chrome on Android before version 152.0.7977.65 leaks cross-origin data through an observable discrepancy (CWE-203) exploitable by a co-installed malicious application. The information disclosure is constrained to local attack scenarios where an adversary controls a second app on the same Android device, limiting real-world exposure significantly. EPSS stands at 0.18% (7th percentile), no public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog.
Improper input validation in Google Chrome's Safebrowsing component prior to version 152.0.7977.65 allows remote attackers to bypass system access restrictions via a crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is network-reachable without authentication but requires user interaction, constraining opportunistic or automated exploitation at scale. EPSS at 0.22% (12th percentile) and absence from CISA KEV indicate low real-world exploitation probability at time of analysis; no public exploit code has been identified.
Cross-origin data leakage in Google Chrome's FindInPage component affects all versions prior to 152.0.7977.65. Exploitation requires a remote attacker to have already compromised the renderer process and then deliver a crafted HTML page that triggers improper input validation, exposing data from a different origin accessible in the browser session. No public exploit code has been identified; EPSS scores this at 0.22% (13th percentile), consistent with the compound, chained nature of exploitation required.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to cross origin security boundaries via a crafted HTML page, resulting in limited cross-site data disclosure. The flaw is an incorrect authorization check (CWE-863) in Chrome's SiteIsolation subsystem - a defense-in-depth mechanism that keeps different origins in separate OS processes. No public exploit has been identified and EPSS stands at 0.38%, consistent with the high prerequisite of prior renderer compromise; this vulnerability is not listed in CISA KEV.
Memory read outside Chrome's sandbox via an uninitialized resource in ANGLE affects Google Chrome prior to 152.0.7977.65, enabling an attacker who has already compromised the renderer process to exfiltrate memory beyond sandbox boundaries using a crafted HTML page. This is a chained exploit component - it does not enable initial access but extends an attacker's reach post-renderer-compromise, making it a meaningful escalation primitive in a multi-stage browser exploit chain. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.29% (21st percentile), consistent with its role as a secondary exploit stage.
Site isolation boundary bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read cross-origin data via a crafted PDF file. This is a chained, second-stage attack technique - not a standalone exploit - requiring renderer process compromise as a hard prerequisite before the missing authorization check (CWE-862) in SiteIsolation becomes actionable. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.35% (27th percentile) aligns with the complex prerequisites that suppress widespread exploitation.
Site Isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin boundary enforcement and access a privileged page via a crafted HTML page. This is a chaining vulnerability rather than a standalone exploit - it requires a pre-existing renderer compromise (typically from a separate, higher-severity CVE) before the SiteIsolation authorization flaw can be leveraged. No public exploit code has been identified and EPSS at 0.27% (19th percentile) reflects low standalone exploitation probability, though this class of flaw is historically weaponized as a second stage in full browser sandbox escape chains.
Web origin policy bypass in Google Chrome's Preload component (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a specially crafted HTML page. Classified as CWE-20 (Improper Input Validation) with a vendor-assigned CVSS score of 4.3 (Medium), the vulnerability is a second-stage attack primitive rather than a standalone exploit - requiring prior renderer compromise as a hard prerequisite. No public exploit code or active exploitation has been confirmed at time of analysis; Google has released a fix in Chrome 152.0.7977.65.
Missing authorization in Google Chrome's BFCache (Back/Forward Cache) component allows a remote attacker who has already compromised the renderer process to bypass system access restrictions via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. The integrity impact is rated High, enabling unauthorized writes or modifications to protected resources beyond the renderer sandbox. EPSS is low at 0.38% (31st percentile), and no active exploitation or public POC has been identified, but the vulnerability is noteworthy as a sandbox-escape primitive in a chained attack.
Out-of-bounds memory read in the GPU component of Google Chrome on Android (prior to 152.0.7977.65) exposes process memory outside the renderer sandbox when a victim visits a crafted HTML page. The flaw targets Android-specific GPU code paths in Chrome's rendering pipeline, producing a high confidentiality impact limited to the GPU process memory space, with no integrity or availability consequence. No public exploit has been identified at time of analysis, and an EPSS probability of 0.24% at the 15th percentile indicates low near-term opportunistic exploitation likelihood.
Chrome's FileSystem API implementation prior to version 152.0.7977.65 contains incorrect authorization logic (CWE-863) that permits a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page via social engineering. The bypass produces a limited integrity impact - unauthorized write or access to filesystem-restricted resources - with no confidentiality or availability consequence per the CVSS vector (I:L, C:N, A:N). No public exploit code exists and the vulnerability is absent from CISA KEV; EPSS of 0.27% (19th percentile) reflects low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Performance API implementation prior to version 152.0.7977.65 enables remote information disclosure via observable timing discrepancies. By serving a crafted HTML page, a remote unauthenticated attacker can exploit CWE-203 side-channel behavior to infer or extract data belonging to other web origins, violating the browser Same-Origin Policy. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.37% (30th percentile), indicating low near-term exploitation probability despite the high confidentiality impact rating in CVSS.
UI misrepresentation in Google Chrome prior to 152.0.7977.65 enables remote attackers to spoof browser interface elements via a crafted HTML page, potentially deceiving users about the identity or security state of a site they are visiting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) confirms network delivery with no attacker authentication required, though user interaction is a hard prerequisite. No public exploit code and no active exploitation have been identified; the EPSS score of 0.22% at the 13th percentile reflects very low near-term exploitation probability.
UI spoofing in Google Chrome on macOS prior to version 152.0.7977.65 enables a remote attacker to misrepresent input UI elements by serving a crafted HTML page, classified under CWE-451 (UI Misrepresentation of Critical Information). Victims who visit the malicious page may be deceived by falsified browser UI elements - such as address bar content, form fields, or security indicators - potentially leading to credential theft or other social engineering outcomes. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.22%; a vendor patch is available at 152.0.7977.65.
Incorrect authorization in Google Chrome Mobile on iOS (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw stems from improper authorization enforcement (CWE-863) within the iOS-specific mobile browser code path, permitting limited integrity violations without confidentiality or availability impact. No public exploit has been identified and EPSS sits at a low 0.23% (13th percentile), consistent with a medium-severity, user-interaction-dependent issue not yet seeing active targeting.
Address bar spoofing in Google Chrome prior to version 152.0.7977.65 enables remote attackers to deceive users about the true origin of a page they are visiting via a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information) in the browser's navigation subsystem. The practical impact is phishing amplification: a victim visiting the attacker's page may see a trusted domain displayed in the address bar and submit credentials or sensitive information to an attacker-controlled site. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS at 0.22% (13th percentile) confirms low automated exploitation probability, though the social-engineering utility of address bar spoofing makes targeted abuse plausible.
Cross-origin data disclosure in Google Chrome's ANGLE graphics layer on Windows allows a remote unauthenticated attacker to read data from other origins by serving a crafted HTML page to a victim user. The flaw is rooted in an uninitialized resource (CWE-908) within ANGLE, Chrome's graphics abstraction layer, affecting all Chrome versions on Windows prior to 152.0.7977.65. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS of 0.29% (21st percentile) corroborates low observed exploitation activity, though the C:H confidentiality rating reflects the severity of cross-origin data leakage if exploited.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits a missing authorization flaw (CWE-862) in the Lighthouse auditing component, allowing an attacker who has already achieved renderer process compromise to cross site isolation boundaries and access limited cross-origin data. The attack chain requires high complexity - a pre-compromised renderer plus active social engineering - making this a second-stage vulnerability in a chained exploit rather than an independently weaponizable flaw. No public exploit code exists and no CISA KEV listing has been identified; EPSS at 0.32% (24th percentile) corroborates the low priority for standalone exploitation.
Web origin policy bypass in Google Chrome's Loader component (all versions prior to 152.0.7977.65) enables remote unauthenticated attackers to read limited cross-origin data by luring a user to a crafted HTML page. The flaw stems from incorrect authorization (CWE-863) in how the Loader enforces origin boundaries, allowing an attacker-controlled page to extract content from another origin the victim is browsing. EPSS is 0.34% (26th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, placing this in the lower tier of active exploitation risk despite broad product prevalence.
Improper access control in Chrome's Workers subsystem allows a remote unauthenticated attacker to bypass the web origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin data leakage. Affected versions span all Chrome releases prior to 152.0.7977.65 across desktop platforms. No public exploit identified at time of analysis and EPSS probability stands at 0.24% (15th percentile), indicating this is a low-urgency but real boundary-enforcement gap in the browser's sandboxing model.
Incorrect reference resolution in Google Chrome's Passwords feature (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by delivering a crafted file that a user must open. The integrity impact is limited (CVSS I:L), and no confidentiality or availability loss is indicated. With EPSS at 0.36% (29th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low despite the network-accessible attack vector.
Network-layer information disclosure in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive network-layer data by delivering a crafted HTML page to a victim. The CVSS score of 5.3 reflects constrained real-world risk: high confidentiality impact is offset by the requirement for a prior renderer compromise and active user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low anticipated exploitation activity.
Sensitive information disclosure in Google Chrome's Sync component (versions prior to 152.0.7977.65) allows remote unauthenticated attackers to extract synchronized user data via crafted network traffic. The flaw stems from improper input validation (CWE-20) in the Sync subsystem, which handles cross-device synchronization of browser data including passwords, history, and tokens. No public exploit code or CISA KEV listing exists; EPSS of 0.34% (27th percentile) reflects low real-world exploitation probability, though CVSS C:H signals potentially severe data exposure if exploited.
Incorrect authorization in Chrome's Network component allows remote unauthenticated attackers to bypass system access restrictions via a crafted HTML page, resulting in low-integrity impact. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS at 0.23% (13th percentile) reflects low real-world exploitation probability; a vendor patch has been issued in the stable channel.
Information disclosure in Google Chrome's SignIn component (versions prior to 152.0.7977.65) allows remote, unauthenticated attackers to obtain sensitive user information by sending crafted network traffic during the sign-in flow. The CVSS vector assigns High complexity (AC:H), indicating exploitation is not straightforward and requires specific network conditions to be met. No public exploit code has been identified, and EPSS places exploitation probability at just 0.21%, reinforcing that real-world opportunistic exploitation is unlikely at this time.
Missing authorization in the Payments component of Google Chrome on Android (prior to 152.0.7977.65) allows remote attackers to potentially bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw is classified as CWE-862 and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to integrity. No public exploit code has been identified at time of analysis, and EPSS scoring of 0.32% (24th percentile) indicates statistically low exploitation probability at scale.
Origin policy bypass in Google Chrome prior to 152.0.7977.65 exposes users to potential cross-site data leakage when a victim visits an attacker-controlled page. The Network component fails to properly validate input (CWE-20), enabling circumvention of the browser's web origin policy - a fundamental Same-Origin Policy enforcement mechanism - allowing a remote attacker to read data from origins other than the page's own. No public exploit has been identified and EPSS stands at 0.24% (15th percentile), indicating low current exploitation probability, though Chrome's ubiquitous global deployment amplifies the aggregate exposure.
Missing authorization in Google Chrome's HTTP/2 implementation prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers via crafted network traffic. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication is required but high attack complexity, consistent with a need for specific network positioning or traffic crafting. No public exploit code or active exploitation has been identified; EPSS at 0.20% (10th percentile) confirms low current exploitation probability.
Safebrowsing in Google Chrome prior to 152.0.7977.65 fails to properly validate input from crafted files, permitting remote attackers to bypass system access restrictions that the component is designed to enforce. The attack requires user interaction - specifically opening a crafted file - and results in limited integrity impact with no confidentiality or availability compromise. No public exploit code or CISA KEV listing has been identified; EPSS exploitation probability is very low at 0.22% (12th percentile), consistent with the Chromium team's Medium severity classification.
Origin policy bypass in Google Chrome's Editing component (prior to 152.0.7977.65) requires an attacker who has already compromised the renderer process to additionally leverage social engineering against the user via a crafted HTML page. Successful exploitation leaks limited cross-origin data by circumventing the same-origin policy through improper input validation in the editing subsystem. No public exploit code exists and EPSS sits at the 15th percentile, indicating low near-term exploitation probability; no active exploitation confirmed by CISA KEV.
Incorrect authorization in Chrome's WebAppInstalls component on Android (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. The flaw (CWE-863) results in a low-integrity impact with no confidentiality or availability consequence, consistent with CVSS 4.3 Medium. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS of 0.24% (15th percentile) signals low current exploitation interest.
Missing authorization in Google Chrome's Network component, prior to version 152.0.7977.65, allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by serving a crafted HTML page to a user. This is effectively a second-stage sandbox-bypass vulnerability requiring a pre-compromised renderer as a prerequisite, making it a chained exploit component rather than a standalone critical flaw. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.23% (13th percentile), consistent with low near-term exploitation probability. A vendor patch is available in stable channel release 152.0.7977.65.
Memory disclosure in Google Chrome's ANGLE graphics subsystem (prior to 152.0.7977.65) exposes out-of-sandbox memory contents when a user visits a crafted HTML page. The uninitialized resource flaw (CWE-908) in ANGLE - Chrome's cross-platform graphics abstraction layer - allows a remote attacker to read memory that should be isolated within the renderer sandbox, leading to high-confidence confidentiality impact. No public exploit has been identified at time of analysis, and EPSS at 0.29% reflects currently low exploitation probability despite the high CVSS confidentiality rating.
Cross-origin data disclosure in Google Chrome's ANGLE graphics translation layer affects all desktop versions prior to 152.0.7977.65. The uninitialized GPU resource (CWE-908) can be triggered by a crafted HTML page, allowing a remote attacker to read residual data across origin boundaries - a direct violation of browser isolation guarantees. No public exploit code or active exploitation is identified at the time of analysis; the 0.24% EPSS score (15th percentile) places real-world exploitation probability in low-priority territory despite the High confidentiality sub-score in the CVSS rating.
Incorrect authorization in the TabGroups feature of Google Chrome prior to 152.0.7977.65 allows a remote attacker to leak sensitive browser information by serving crafted network traffic to a victim user. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser fails to properly enforce access control within tab group contexts, and was rated Medium severity by the Chromium security team. No public exploit identified at time of analysis, and an EPSS of 0.20% at the 10th percentile confirms very low observed exploitation activity.
Chrome's Network subsystem before version 152.0.7977.65 allows remote attackers to bypass the browser's web origin policy due to improper initialization (CWE-665), exploitable via a crafted HTML page that requires user interaction. The impact is limited to partial confidentiality disclosure (C:L), with no integrity or availability consequences, and the CVSS score of 4.3 (Medium) aligns with EPSS exploitation probability of 0.36% (29th percentile). No public exploit code or CISA KEV listing exists at the time of analysis; a vendor patch is available in the stable channel.
Incorrect authorization in Google Chrome's WebProtect component before version 152.0.7977.65 allows a remote, unauthenticated attacker to exfiltrate sensitive information by directing a user to a specially crafted HTML page. The flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H) and no integrity or availability impact, scoped entirely within the browser process. No public exploit is identified at time of analysis, and the EPSS score of 0.27% (19th percentile) indicates low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Missing authorization in Chrome's CustomTabs feature on Android exposes sensitive browser information to co-installed malicious applications on versions prior to 152.0.7977.65. The vulnerability stems from CWE-862 (Missing Authorization), meaning Chrome does not properly verify whether a companion app is permitted to access data surfaced through the CustomTabs interface. No public exploit code or active exploitation has been identified; EPSS sits at the 6th percentile, confirming low real-world exploitation probability despite the High confidentiality impact in the CVSS vector.
Web origin policy bypass in Google Chrome's WebRTC component (prior to 152.0.7977.65) enables a network-positioned attacker who has already compromised the renderer process to cross same-origin boundaries via a crafted HTML page requiring user interaction. This is a chained exploitation step - not a standalone critical flaw - making it most relevant as a second-stage component in a targeted multi-stage browser exploit. No public exploit code exists and EPSS of 0.28% at the 20th percentile is consistent with no observed opportunistic exploitation; the vulnerability is not listed in CISA KEV.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape process-level sandboxing constraints via a crafted HTML page. The vulnerability stems from improper input validation in Chrome's Navigation subsystem (CWE-20), and exploitation requires both a prior renderer compromise and user interaction. With a CVSS score of 3.1 (Low), EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, this is a low-urgency chained escalation risk rather than a primary attack vector - but it is meaningful in advanced threat scenarios where a renderer exploit already exists.
Incorrect reference resolution in Chrome's Preload subsystem (versions prior to 152.0.7977.65) allows remote attackers to bypass the Same-Origin Policy by serving a crafted HTML page to a victim. The vulnerability is limited to confidentiality impact at the low tier - an attacker can read a constrained subset of cross-origin data but cannot modify content or cause a denial of service. No public exploit code has been identified and the EPSS score of 0.31% (23rd percentile) reflects low real-world exploitation probability at time of analysis.
Cross-origin data leakage in Google Chrome's Payments subsystem, affecting all versions prior to 152.0.7977.65, stems from a TOCTOU race condition exploitable by an attacker who has already compromised the renderer process. By delivering a crafted HTML page, the attacker can race the Payments component to read data across origin boundaries, violating the Same-Origin Policy. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.25% (16th percentile) reflects low real-world exploitation probability.
Out-of-bounds read in Google Chrome's Media component prior to version 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to leak memory contents across the Chrome sandbox boundary via a crafted HTML page. The attack is a chained, second-stage capability - it requires prior renderer code execution and user interaction - not a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low observed exploitation likelihood.
Uninitialized GPU resource use in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read memory outside the Chrome sandbox boundary via a crafted HTML page. The vulnerability (CWE-908) is a second-stage primitive - it cannot be exploited in isolation and requires a pre-existing renderer process compromise as a hard prerequisite. No public exploit code has been identified and EPSS stands at 0.31%, consistent with its role as a chained exploitation component rather than a primary attack vector.
Cross-origin data exposure in Google Chrome's Extensions subsystem prior to version 152.0.7977.65 allows a remote attacker who successfully socially engineers a victim into installing a crafted malicious extension to read data from web origins the extension should not have access to. The high confidentiality impact (C:H) is real, but exploitation is gated on user interaction - the victim must install the malicious extension - which substantially limits opportunistic mass exploitation. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.27% (18th percentile) reflects low current exploitation probability consistent with no observed in-the-wild use.
Information disclosure in Google Chrome's Geolocation component prior to version 152.0.7977.65 allows a remote attacker to obtain the victim's sensitive geolocation data by tricking them into visiting a crafted HTML page. The attack relies on social engineering as the delivery mechanism and results in a high-confidentiality-impact leak of physical location information, which may expose home or workplace addresses. No public exploit code or active exploitation has been identified; EPSS at 0.21% (11th percentile) confirms low automated exploitation probability at time of analysis.
Cross-origin data exposure in Google Chrome before 152.0.7977.65 enables a chained information leak when a renderer process has already been compromised by a separate exploit. Chrome's CORS implementation incorrectly permits cross-origin data access from within a compromised renderer, allowing a remote attacker to exfiltrate data from origins the victim is authenticated to via a crafted HTML page. No public exploit code exists and no CISA KEV listing has been issued; the EPSS score of 0.17% (7th percentile) confirms this is a low-probability, low-severity secondary element of multi-stage browser attack chains rather than a standalone threat.
Memory disclosure in Google Chrome's Dawn WebGPU component exposes uninitialized memory contents to remote attackers who can lure a user to a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on desktop platforms, per the EUVD and Chrome release advisory. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Site isolation bypass in Google Chrome DevTools (versions prior to 152.0.7977.65) enables cross-origin data theft as a second-stage exploit following renderer process compromise. An attacker who has already gained control of a Chrome renderer - itself requiring exploitation of a separate vulnerability - can serve a crafted HTML page exploiting improper input validation in DevTools to breach the browser's inter-site boundary and read data from other open origins. No public exploit code exists and EPSS of 0.22% (12th percentile) confirms this is not currently seeing broad opportunistic exploitation, though the technique is highly attractive for targeted, multi-stage browser exploit chains.
Cross-origin data leakage via an uninitialized resource in the WebXR API affects Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker who can socially engineer a user into visiting a crafted HTML page may trigger a read of uninitialized memory, potentially exposing data from other browser origins. Google has rated this Medium severity; a patched release (152.0.7977.65) is available, and no public exploit or active exploitation has been identified at time of analysis.
Cross-origin data exposure via a ServiceWorker flaw in Google Chrome prior to 152.0.7977.65 permits remote attackers to read data from origins they do not control. An attacker can exploit this by delivering a crafted HTML page to a victim user, leveraging Chrome's ServiceWorker API to bypass same-origin isolation and exfiltrate cross-origin responses. No public exploit code is identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation activity; the mandatory user-interaction requirement further constrains automated abuse.
Incorrect USB authorization in Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass system USB access restrictions by socially engineering a user into visiting a crafted HTML page. The flaw (CWE-863) in Chrome's USB subsystem grants unauthorized access without proper permission verification, resulting in a limited integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS is very low at 0.21% (11th percentile), consistent with Chromium's own Medium severity rating; a vendor patch has been released.
Incorrect authorization in Google Chrome's WebXR implementation prior to version 152.0.7977.65 enables cross-origin data exfiltration via a crafted HTML page, requiring attacker-driven social engineering to direct a victim to the malicious page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5, reflecting high confidentiality impact but no integrity or availability loss, and user interaction is a necessary prerequisite. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog at time of analysis, with EPSS at 0.21% (11th percentile) confirming low observed exploitation activity.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.
Code injection in Google Chrome's Bisection component allows remote attackers to exfiltrate sensitive information by enticing a user to open a crafted file. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The vulnerability carries a CVSS 6.5 Medium rating with high confidentiality impact; no public exploit has been identified and EPSS sits at 0.19% (8th percentile), indicating minimal active exploitation pressure at time of analysis. Vendor patch is confirmed available.
Network-layer information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive data by directing a victim to a crafted HTML page. The attack is a multi-stage chain: the renderer compromise is a hard prerequisite not satisfied by this CVE alone, which materially constrains real-world exploitability. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) corroborates low observed exploitation probability; no CISA KEV listing exists.
Incorrect authorization in the Device component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions - specifically controls governing device-level API access - through a crafted HTML page delivered via social engineering. Exploitation requires user interaction, limiting opportunistic mass exploitation, and EPSS at 0.29% (21st percentile) reflects low real-world exploitation probability. No public exploit identified and no CISA KEV listing; a vendor patch is available.
Incorrect authorization in Chrome's GetUserMedia API allows remote attackers to obtain sensitive information - specifically unauthorized access to a user's camera or microphone feed - by luring the victim to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the High confidentiality impact warrants timely patching given Chrome's ubiquitous deployment.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) grants a remote attacker who has already compromised the renderer process the ability to circumvent Same-Origin Policy restrictions via a crafted HTML page, leaking limited confidential data from cross-origin contexts. This is a second-stage exploitation primitive - it is only dangerous when chained with a separate renderer compromise vulnerability. No public exploit identified at time of analysis, and the low EPSS score of 0.26% (18th percentile) reflects minimal current exploitation interest.
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. No public exploit code and no CISA KEV listing are present; EPSS places exploitation probability at 0.24% (15th percentile), consistent with a low-priority but broadly applicable patch.
Improper resource exposure in Google Chrome's StreamsAPI (versions prior to 152.0.7977.65) enables remote attackers to partially bypass the web origin policy and read limited data from privileged browser pages via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - consistent with CVSS UI:R and S:U, confining impact to the victim's own browser context. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.18% (8th percentile) indicates very low real-world exploitation probability at time of analysis.
DevTools Missing Authorization in Google Chrome prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers who socially engineer victims into performing specific UI interactions. The CWE-862 root cause indicates the DevTools component lacks proper authorization checks on certain UI-driven data access paths, allowing an attacker-controlled page to extract information the browser context holds. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.15% at the 5th percentile confirms minimal near-term exploitation probability despite the C:H CVSS impact rating.
Site isolation bypass in Google Chrome's Speech component allows an attacker who has already established a foothold in the renderer process to cross origin boundaries via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65 across all platforms covered by the CPE cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis, EPSS probability is very low at 0.20% (10th percentile), and the vulnerability is not listed in CISA KEV - however its value as a second-stage exploit in a browser attack chain elevates practical concern above the low CVSS score alone.
Cross-origin data exfiltration via the BFCache mechanism in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read data across origin boundaries using a crafted HTML page. This information disclosure (CWE-200) is a second-stage capability, not a standalone attack - it requires chaining with a separate renderer RCE vulnerability, constraining real-world risk significantly. No public exploit code or active exploitation has been confirmed; EPSS is 0.17% and the vulnerability is absent from CISA KEV. Vendor patch is available in Chrome 152.0.7977.65.
Incorrect authorization in Google Chrome's Web Authentication subsystem (Passkeys and Security Keys) allows a remote attacker to bypass the web origin policy by inducing a user to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop platforms are affected. The impact is limited to partial confidentiality - origin policy bypass could expose authentication context or credential associations across origins - with no integrity or availability impact confirmed.
CSS injection in Google Chrome prior to version 152.0.7977.65 enables a remote attacker to extract sensitive information from a victim's browser session by delivering a crafted HTML page. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N vector confirms unauthenticated network delivery requiring only that the victim navigate to attacker-controlled content, with high confidentiality impact and no integrity or availability consequences. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% at the 10th percentile indicates very low observed exploitation probability; this is not listed in the CISA KEV catalog.
Chrome's FileSystem API prior to version 152.0.7977.65 improperly handles case sensitivity when enforcing access restrictions, enabling a remote attacker to bypass system-level file access controls via a crafted HTML page delivered through social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms a network-reachable, unauthenticated path with high integrity impact, though the mandatory user interaction requirement limits mass exploitation. No public exploit has been identified at time of analysis, and an EPSS of 0.33% at the 26th percentile reflects limited observed exploitation activity.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits incomplete cleanup (CWE-459) in the SiteIsolation component, enabling a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin process separation via a crafted HTML page. This is a chained, second-stage attack - the CVSS score of 3.1 (Low) and EPSS of 0.28% (20th percentile) reflect the high prerequisite bar of a prior renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis.
Incorrect authorization in Google Chrome's Network component prior to version 152.0.7977.65 allows a remote, unauthenticated attacker to bypass the browser's web origin policy by delivering a crafted HTML page to a victim. The bypass yields limited confidentiality exposure, consistent with the CVSS C:L rating, and requires the target user to interact with attacker-controlled content. No public exploit code has been identified and EPSS stands at 0.19% (8th percentile), indicating low current exploitation probability despite the broad deployment footprint of Chrome.
Web origin policy bypass in Google Chrome's cache component affects all versions prior to 152.0.7977.65, exploitable by a remote unauthenticated attacker who tricks a user into visiting a crafted HTML page. The incorrect reference resolution (CWE-706) in the cache layer allows cross-origin data to be read, constituting a Same-Origin Policy bypass with limited confidentiality impact. No active exploitation is confirmed and EPSS sits at 0.20% (10th percentile), indicating low real-world exploitation pressure at this time.
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
CSS information leak in Google Chrome before 152.0.7977.65 enables remote attackers to exfiltrate sensitive browser data by luring victims to a crafted HTML page. The flaw resides in Chrome's CSS rendering subsystem (CWE-200: Information Exposure) and carries a CVSS C:H rating, meaning confidentiality impact is assessed as high despite the medium-severity label. No public exploit code has been identified and EPSS probability sits at 0.17% (7th percentile), indicating very low observed exploitation activity; the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's CustomTabs feature on Android (versions prior to 152.0.7977.65) enables a local attacker to infer cross-origin information via a co-installed malicious application. The vulnerability stems from an observable discrepancy (CWE-203) - a measurable side-channel difference in Chrome's behavior that a co-resident app can detect and use to reconstruct protected web content. Impact is confined to limited confidentiality loss; no public exploit has been identified at time of analysis, and EPSS at 0.15% (4th percentile) signals very low real-world exploitation probability.
Incorrect authorization in Chrome's ServiceWorker component (CWE-863) allows remote unauthenticated attackers who can socially engineer a user into installing a crafted Chrome extension to bypass the web origin policy, resulting in limited cross-origin data exposure. All Chrome releases prior to 152.0.7977.65 are affected across platforms; a vendor patch is available. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) indicates very low current exploitation probability, consistent with the absence of a CISA KEV listing.
Cross-origin data leakage through the CustomTabs component in Google Chrome for Android (versions prior to 152.0.7977.65) enables a local attacker to extract sensitive browsing data belonging to other origins via a co-installed application. The flaw is classified CWE-200 and carries a CVSS Medium score of 5.5, reflecting meaningful confidentiality impact constrained by a local-only attack vector and required user interaction. No public exploit code or active exploitation via CISA KEV has been identified; the vendor-released patch is available in Chrome 152.0.7977.65.
Incorrect authorization in Chrome's Editing component (prior to 152.0.7977.65) permits remote attackers to read sensitive information by enticing a user to visit a specially crafted HTML page. The flaw (CWE-863) affects all Chrome versions across all platforms below the fixed release, with a high confidentiality impact but no integrity or availability consequence. No public exploit code or active exploitation is confirmed; EPSS stands at 0.36% (28th percentile), indicating low real-world exploitation probability at time of analysis.
Information leak in the Animation component of Google Chrome prior to 152.0.7977.65 allows remote unauthenticated attackers to obtain sensitive browser data by inducing a user to visit a crafted HTML page. The flaw is classified CWE-200 (Exposure of Sensitive Information) and carries a CVSS confidentiality impact of High, though Chromium's internal team rated it Medium severity. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.22% (13th percentile) confirms very low observed exploitation probability, making this a normal patch-cycle priority rather than an emergency.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
Observable discrepancy in HTML rendering in Google Chrome prior to 152.0.7977.65 enables a remote attacker to extract sensitive information when a victim visits a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), where Chrome's handling of specific HTML constructs produces measurable behavioral differences - such as timing variations or rendering side-channels - that leak protected state. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating low opportunistic risk despite the High confidentiality impact rating in the CVSS vector.
Cross-origin data leakage in Google Chrome's Canvas API (versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to read pixel-level data from cross-origin resources rendered in a canvas element via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - and impact is limited to partial confidentiality loss (C:L), with no integrity or availability consequences. No public exploit code has been identified and EPSS sits at 0.27% (18th percentile), indicating low real-world exploitation probability; vendor-released patch is available.
ServiceWorker in Google Chrome versions prior to 152.0.7977.65 leaks sensitive information to remote attackers via a crafted HTML page, exploiting CWE-200 (Exposure of Sensitive Information to Unauthorized Actor). The vulnerability requires no attacker-side authentication (PR:N per CVSS) but does require user interaction - a victim must visit the malicious page. With CVSS C:H and no integrity or availability impact, the primary threat is data exfiltration; no public exploit has been identified at time of analysis and EPSS sits at a low 0.27%.
Missing authorization in Google Chrome's Network component prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions with high integrity impact by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-reachable exploitation requiring no attacker-side privileges, though a single user interaction gates the attack. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.23% (13th percentile) reflects low observed exploitation probability despite broad product exposure.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process - and further leverages social engineering - to circumvent Chrome's cross-origin security boundary via a crafted HTML page, resulting in limited confidentiality exposure. The flaw resides in the SiteIsolation authorization logic (CWE-863), meaning Chrome fails to correctly validate whether a renderer process is permitted to access data belonging to a different origin. With an EPSS of 0.23% (13th percentile) and no CISA KEV listing, real-world exploitation probability is low; the dual prerequisite of a pre-existing renderer compromise plus social engineering substantially raises the attack bar beyond what the low CVSS score alone conveys.
Improper privilege management in Google Chrome's FileSystem subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by tricking a user into loading a specially crafted HTML page. The flaw is rated CVSS 4.3 (Medium) with impact limited to low integrity bypass - no confidentiality or availability impact - and carries an EPSS of 0.23% (13th percentile), indicating minimal observed exploitation interest. Vendor patch is available in stable channel 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis.
Web origin policy bypass in Google Chrome's StorageAccessAPI enables an attacker who has already compromised the renderer process to exfiltrate cross-origin storage data via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The vulnerability is rated medium severity (CVSS 4.3) and requires both user interaction and a pre-existing renderer compromise, making it a second-stage chained exploit component rather than a standalone initial access vector. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.
Race condition in Google Chrome's Workers implementation before version 152.0.7977.65 allows a remote attacker to bypass system access restrictions, resulting in high integrity impact. Exploitation requires a victim to visit a crafted HTML page, placing this in the social-engineering-dependent threat category. No public exploit has been identified, and the EPSS score of 0.19% (9th percentile) indicates negligible observed exploitation in the wild at time of analysis.
Observable discrepancy in the Forms component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by serving a crafted HTML page that induces measurable behavioral side-channel differences. The CVSS vector (AC:H/UI:R) confirms exploitation requires both high attack complexity - precise timing or environmental control to reliably observe the discrepancy - and active user interaction to visit the malicious page. No public exploit has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) signals limited automated exploitation interest despite the high confidentiality impact designation.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to exfiltrate sensitive information by luring a user to a crafted HTML page. The flaw (CWE-863) bypasses DOM-level permission checks, resulting in High confidentiality impact with no integrity or availability consequences. No public exploit has been identified at time of analysis, and EPSS at 0.36% (28th percentile) indicates minimal observed exploitation pressure despite the patch now being available from Google.
Incorrect authorization in Google Chrome's Network subsystem (all versions before 152.0.7977.65) permits remote unauthenticated attackers to bypass system access restrictions by inducing a user to visit a crafted HTML page. Classified as CWE-863, the flaw allows a limited integrity violation against the affected system without confidentiality or availability impact. No public exploit has been identified at time of analysis, and the low EPSS score (0.38%, 31st percentile) indicates minimal current exploitation pressure.
CustomTabs in Google Chrome on Android before version 152.0.7977.65 leaks cross-origin data through an observable discrepancy (CWE-203) exploitable by a co-installed malicious application. The information disclosure is constrained to local attack scenarios where an adversary controls a second app on the same Android device, limiting real-world exposure significantly. EPSS stands at 0.18% (7th percentile), no public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog.
Improper input validation in Google Chrome's Safebrowsing component prior to version 152.0.7977.65 allows remote attackers to bypass system access restrictions via a crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is network-reachable without authentication but requires user interaction, constraining opportunistic or automated exploitation at scale. EPSS at 0.22% (12th percentile) and absence from CISA KEV indicate low real-world exploitation probability at time of analysis; no public exploit code has been identified.
Cross-origin data leakage in Google Chrome's FindInPage component affects all versions prior to 152.0.7977.65. Exploitation requires a remote attacker to have already compromised the renderer process and then deliver a crafted HTML page that triggers improper input validation, exposing data from a different origin accessible in the browser session. No public exploit code has been identified; EPSS scores this at 0.22% (13th percentile), consistent with the compound, chained nature of exploitation required.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to cross origin security boundaries via a crafted HTML page, resulting in limited cross-site data disclosure. The flaw is an incorrect authorization check (CWE-863) in Chrome's SiteIsolation subsystem - a defense-in-depth mechanism that keeps different origins in separate OS processes. No public exploit has been identified and EPSS stands at 0.38%, consistent with the high prerequisite of prior renderer compromise; this vulnerability is not listed in CISA KEV.
Memory read outside Chrome's sandbox via an uninitialized resource in ANGLE affects Google Chrome prior to 152.0.7977.65, enabling an attacker who has already compromised the renderer process to exfiltrate memory beyond sandbox boundaries using a crafted HTML page. This is a chained exploit component - it does not enable initial access but extends an attacker's reach post-renderer-compromise, making it a meaningful escalation primitive in a multi-stage browser exploit chain. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.29% (21st percentile), consistent with its role as a secondary exploit stage.
Site isolation boundary bypass in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read cross-origin data via a crafted PDF file. This is a chained, second-stage attack technique - not a standalone exploit - requiring renderer process compromise as a hard prerequisite before the missing authorization check (CWE-862) in SiteIsolation becomes actionable. No public exploit code or CISA KEV listing has been identified; the EPSS score of 0.35% (27th percentile) aligns with the complex prerequisites that suppress widespread exploitation.
Site Isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape Chrome's cross-origin boundary enforcement and access a privileged page via a crafted HTML page. This is a chaining vulnerability rather than a standalone exploit - it requires a pre-existing renderer compromise (typically from a separate, higher-severity CVE) before the SiteIsolation authorization flaw can be leveraged. No public exploit code has been identified and EPSS at 0.27% (19th percentile) reflects low standalone exploitation probability, though this class of flaw is historically weaponized as a second stage in full browser sandbox escape chains.
Web origin policy bypass in Google Chrome's Preload component (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a specially crafted HTML page. Classified as CWE-20 (Improper Input Validation) with a vendor-assigned CVSS score of 4.3 (Medium), the vulnerability is a second-stage attack primitive rather than a standalone exploit - requiring prior renderer compromise as a hard prerequisite. No public exploit code or active exploitation has been confirmed at time of analysis; Google has released a fix in Chrome 152.0.7977.65.
Missing authorization in Google Chrome's BFCache (Back/Forward Cache) component allows a remote attacker who has already compromised the renderer process to bypass system access restrictions via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. The integrity impact is rated High, enabling unauthorized writes or modifications to protected resources beyond the renderer sandbox. EPSS is low at 0.38% (31st percentile), and no active exploitation or public POC has been identified, but the vulnerability is noteworthy as a sandbox-escape primitive in a chained attack.
Out-of-bounds memory read in the GPU component of Google Chrome on Android (prior to 152.0.7977.65) exposes process memory outside the renderer sandbox when a victim visits a crafted HTML page. The flaw targets Android-specific GPU code paths in Chrome's rendering pipeline, producing a high confidentiality impact limited to the GPU process memory space, with no integrity or availability consequence. No public exploit has been identified at time of analysis, and an EPSS probability of 0.24% at the 15th percentile indicates low near-term opportunistic exploitation likelihood.
Chrome's FileSystem API implementation prior to version 152.0.7977.65 contains incorrect authorization logic (CWE-863) that permits a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page via social engineering. The bypass produces a limited integrity impact - unauthorized write or access to filesystem-restricted resources - with no confidentiality or availability consequence per the CVSS vector (I:L, C:N, A:N). No public exploit code exists and the vulnerability is absent from CISA KEV; EPSS of 0.27% (19th percentile) reflects low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Performance API implementation prior to version 152.0.7977.65 enables remote information disclosure via observable timing discrepancies. By serving a crafted HTML page, a remote unauthenticated attacker can exploit CWE-203 side-channel behavior to infer or extract data belonging to other web origins, violating the browser Same-Origin Policy. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.37% (30th percentile), indicating low near-term exploitation probability despite the high confidentiality impact rating in CVSS.
UI misrepresentation in Google Chrome prior to 152.0.7977.65 enables remote attackers to spoof browser interface elements via a crafted HTML page, potentially deceiving users about the identity or security state of a site they are visiting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) confirms network delivery with no attacker authentication required, though user interaction is a hard prerequisite. No public exploit code and no active exploitation have been identified; the EPSS score of 0.22% at the 13th percentile reflects very low near-term exploitation probability.
UI spoofing in Google Chrome on macOS prior to version 152.0.7977.65 enables a remote attacker to misrepresent input UI elements by serving a crafted HTML page, classified under CWE-451 (UI Misrepresentation of Critical Information). Victims who visit the malicious page may be deceived by falsified browser UI elements - such as address bar content, form fields, or security indicators - potentially leading to credential theft or other social engineering outcomes. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.22%; a vendor patch is available at 152.0.7977.65.
Incorrect authorization in Google Chrome Mobile on iOS (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw stems from improper authorization enforcement (CWE-863) within the iOS-specific mobile browser code path, permitting limited integrity violations without confidentiality or availability impact. No public exploit has been identified and EPSS sits at a low 0.23% (13th percentile), consistent with a medium-severity, user-interaction-dependent issue not yet seeing active targeting.
Address bar spoofing in Google Chrome prior to version 152.0.7977.65 enables remote attackers to deceive users about the true origin of a page they are visiting via a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information) in the browser's navigation subsystem. The practical impact is phishing amplification: a victim visiting the attacker's page may see a trusted domain displayed in the address bar and submit credentials or sensitive information to an attacker-controlled site. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS at 0.22% (13th percentile) confirms low automated exploitation probability, though the social-engineering utility of address bar spoofing makes targeted abuse plausible.
Cross-origin data disclosure in Google Chrome's ANGLE graphics layer on Windows allows a remote unauthenticated attacker to read data from other origins by serving a crafted HTML page to a victim user. The flaw is rooted in an uninitialized resource (CWE-908) within ANGLE, Chrome's graphics abstraction layer, affecting all Chrome versions on Windows prior to 152.0.7977.65. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS of 0.29% (21st percentile) corroborates low observed exploitation activity, though the C:H confidentiality rating reflects the severity of cross-origin data leakage if exploited.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 exploits a missing authorization flaw (CWE-862) in the Lighthouse auditing component, allowing an attacker who has already achieved renderer process compromise to cross site isolation boundaries and access limited cross-origin data. The attack chain requires high complexity - a pre-compromised renderer plus active social engineering - making this a second-stage vulnerability in a chained exploit rather than an independently weaponizable flaw. No public exploit code exists and no CISA KEV listing has been identified; EPSS at 0.32% (24th percentile) corroborates the low priority for standalone exploitation.
Web origin policy bypass in Google Chrome's Loader component (all versions prior to 152.0.7977.65) enables remote unauthenticated attackers to read limited cross-origin data by luring a user to a crafted HTML page. The flaw stems from incorrect authorization (CWE-863) in how the Loader enforces origin boundaries, allowing an attacker-controlled page to extract content from another origin the victim is browsing. EPSS is 0.34% (26th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, placing this in the lower tier of active exploitation risk despite broad product prevalence.
Improper access control in Chrome's Workers subsystem allows a remote unauthenticated attacker to bypass the web origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin data leakage. Affected versions span all Chrome releases prior to 152.0.7977.65 across desktop platforms. No public exploit identified at time of analysis and EPSS probability stands at 0.24% (15th percentile), indicating this is a low-urgency but real boundary-enforcement gap in the browser's sandboxing model.
Incorrect reference resolution in Google Chrome's Passwords feature (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by delivering a crafted file that a user must open. The integrity impact is limited (CVSS I:L), and no confidentiality or availability loss is indicated. With EPSS at 0.36% (29th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low despite the network-accessible attack vector.
Network-layer information disclosure in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive network-layer data by delivering a crafted HTML page to a victim. The CVSS score of 5.3 reflects constrained real-world risk: high confidentiality impact is offset by the requirement for a prior renderer compromise and active user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low anticipated exploitation activity.
Sensitive information disclosure in Google Chrome's Sync component (versions prior to 152.0.7977.65) allows remote unauthenticated attackers to extract synchronized user data via crafted network traffic. The flaw stems from improper input validation (CWE-20) in the Sync subsystem, which handles cross-device synchronization of browser data including passwords, history, and tokens. No public exploit code or CISA KEV listing exists; EPSS of 0.34% (27th percentile) reflects low real-world exploitation probability, though CVSS C:H signals potentially severe data exposure if exploited.
Incorrect authorization in Chrome's Network component allows remote unauthenticated attackers to bypass system access restrictions via a crafted HTML page, resulting in low-integrity impact. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS at 0.23% (13th percentile) reflects low real-world exploitation probability; a vendor patch has been issued in the stable channel.
Information disclosure in Google Chrome's SignIn component (versions prior to 152.0.7977.65) allows remote, unauthenticated attackers to obtain sensitive user information by sending crafted network traffic during the sign-in flow. The CVSS vector assigns High complexity (AC:H), indicating exploitation is not straightforward and requires specific network conditions to be met. No public exploit code has been identified, and EPSS places exploitation probability at just 0.21%, reinforcing that real-world opportunistic exploitation is unlikely at this time.
Missing authorization in the Payments component of Google Chrome on Android (prior to 152.0.7977.65) allows remote attackers to potentially bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw is classified as CWE-862 and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to integrity. No public exploit code has been identified at time of analysis, and EPSS scoring of 0.32% (24th percentile) indicates statistically low exploitation probability at scale.
Origin policy bypass in Google Chrome prior to 152.0.7977.65 exposes users to potential cross-site data leakage when a victim visits an attacker-controlled page. The Network component fails to properly validate input (CWE-20), enabling circumvention of the browser's web origin policy - a fundamental Same-Origin Policy enforcement mechanism - allowing a remote attacker to read data from origins other than the page's own. No public exploit has been identified and EPSS stands at 0.24% (15th percentile), indicating low current exploitation probability, though Chrome's ubiquitous global deployment amplifies the aggregate exposure.
Missing authorization in Google Chrome's HTTP/2 implementation prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers via crafted network traffic. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication is required but high attack complexity, consistent with a need for specific network positioning or traffic crafting. No public exploit code or active exploitation has been identified; EPSS at 0.20% (10th percentile) confirms low current exploitation probability.
Safebrowsing in Google Chrome prior to 152.0.7977.65 fails to properly validate input from crafted files, permitting remote attackers to bypass system access restrictions that the component is designed to enforce. The attack requires user interaction - specifically opening a crafted file - and results in limited integrity impact with no confidentiality or availability compromise. No public exploit code or CISA KEV listing has been identified; EPSS exploitation probability is very low at 0.22% (12th percentile), consistent with the Chromium team's Medium severity classification.
Origin policy bypass in Google Chrome's Editing component (prior to 152.0.7977.65) requires an attacker who has already compromised the renderer process to additionally leverage social engineering against the user via a crafted HTML page. Successful exploitation leaks limited cross-origin data by circumventing the same-origin policy through improper input validation in the editing subsystem. No public exploit code exists and EPSS sits at the 15th percentile, indicating low near-term exploitation probability; no active exploitation confirmed by CISA KEV.
Incorrect authorization in Chrome's WebAppInstalls component on Android (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. The flaw (CWE-863) results in a low-integrity impact with no confidentiality or availability consequence, consistent with CVSS 4.3 Medium. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS of 0.24% (15th percentile) signals low current exploitation interest.
Missing authorization in Google Chrome's Network component, prior to version 152.0.7977.65, allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by serving a crafted HTML page to a user. This is effectively a second-stage sandbox-bypass vulnerability requiring a pre-compromised renderer as a prerequisite, making it a chained exploit component rather than a standalone critical flaw. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.23% (13th percentile), consistent with low near-term exploitation probability. A vendor patch is available in stable channel release 152.0.7977.65.
Memory disclosure in Google Chrome's ANGLE graphics subsystem (prior to 152.0.7977.65) exposes out-of-sandbox memory contents when a user visits a crafted HTML page. The uninitialized resource flaw (CWE-908) in ANGLE - Chrome's cross-platform graphics abstraction layer - allows a remote attacker to read memory that should be isolated within the renderer sandbox, leading to high-confidence confidentiality impact. No public exploit has been identified at time of analysis, and EPSS at 0.29% reflects currently low exploitation probability despite the high CVSS confidentiality rating.
Cross-origin data disclosure in Google Chrome's ANGLE graphics translation layer affects all desktop versions prior to 152.0.7977.65. The uninitialized GPU resource (CWE-908) can be triggered by a crafted HTML page, allowing a remote attacker to read residual data across origin boundaries - a direct violation of browser isolation guarantees. No public exploit code or active exploitation is identified at the time of analysis; the 0.24% EPSS score (15th percentile) places real-world exploitation probability in low-priority territory despite the High confidentiality sub-score in the CVSS rating.
Incorrect authorization in the TabGroups feature of Google Chrome prior to 152.0.7977.65 allows a remote attacker to leak sensitive browser information by serving crafted network traffic to a victim user. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser fails to properly enforce access control within tab group contexts, and was rated Medium severity by the Chromium security team. No public exploit identified at time of analysis, and an EPSS of 0.20% at the 10th percentile confirms very low observed exploitation activity.
Chrome's Network subsystem before version 152.0.7977.65 allows remote attackers to bypass the browser's web origin policy due to improper initialization (CWE-665), exploitable via a crafted HTML page that requires user interaction. The impact is limited to partial confidentiality disclosure (C:L), with no integrity or availability consequences, and the CVSS score of 4.3 (Medium) aligns with EPSS exploitation probability of 0.36% (29th percentile). No public exploit code or CISA KEV listing exists at the time of analysis; a vendor patch is available in the stable channel.
Incorrect authorization in Google Chrome's WebProtect component before version 152.0.7977.65 allows a remote, unauthenticated attacker to exfiltrate sensitive information by directing a user to a specially crafted HTML page. The flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H) and no integrity or availability impact, scoped entirely within the browser process. No public exploit is identified at time of analysis, and the EPSS score of 0.27% (19th percentile) indicates low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Missing authorization in Chrome's CustomTabs feature on Android exposes sensitive browser information to co-installed malicious applications on versions prior to 152.0.7977.65. The vulnerability stems from CWE-862 (Missing Authorization), meaning Chrome does not properly verify whether a companion app is permitted to access data surfaced through the CustomTabs interface. No public exploit code or active exploitation has been identified; EPSS sits at the 6th percentile, confirming low real-world exploitation probability despite the High confidentiality impact in the CVSS vector.
Web origin policy bypass in Google Chrome's WebRTC component (prior to 152.0.7977.65) enables a network-positioned attacker who has already compromised the renderer process to cross same-origin boundaries via a crafted HTML page requiring user interaction. This is a chained exploitation step - not a standalone critical flaw - making it most relevant as a second-stage component in a targeted multi-stage browser exploit. No public exploit code exists and EPSS of 0.28% at the 20th percentile is consistent with no observed opportunistic exploitation; the vulnerability is not listed in CISA KEV.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to escape process-level sandboxing constraints via a crafted HTML page. The vulnerability stems from improper input validation in Chrome's Navigation subsystem (CWE-20), and exploitation requires both a prior renderer compromise and user interaction. With a CVSS score of 3.1 (Low), EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, this is a low-urgency chained escalation risk rather than a primary attack vector - but it is meaningful in advanced threat scenarios where a renderer exploit already exists.
Incorrect reference resolution in Chrome's Preload subsystem (versions prior to 152.0.7977.65) allows remote attackers to bypass the Same-Origin Policy by serving a crafted HTML page to a victim. The vulnerability is limited to confidentiality impact at the low tier - an attacker can read a constrained subset of cross-origin data but cannot modify content or cause a denial of service. No public exploit code has been identified and the EPSS score of 0.31% (23rd percentile) reflects low real-world exploitation probability at time of analysis.
Cross-origin data leakage in Google Chrome's Payments subsystem, affecting all versions prior to 152.0.7977.65, stems from a TOCTOU race condition exploitable by an attacker who has already compromised the renderer process. By delivering a crafted HTML page, the attacker can race the Payments component to read data across origin boundaries, violating the Same-Origin Policy. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.25% (16th percentile) reflects low real-world exploitation probability.