Monthly
Incorrect authorization in Google Chrome's Extensions subsystem (versions prior to 152.0.7977.65) permits a remote attacker to bypass system access restrictions through a crafted Chrome extension delivered via social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms mandatory user interaction limits opportunistic exploitation, and impact is constrained to integrity with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the social-engineering dependency.
Memory disclosure in Google Chrome's Video component (versions prior to 152.0.7977.65) allows a remote attacker to read memory contents from within the Chrome sandbox by directing a victim to a specially crafted HTML page. The uninitialized resource flaw (CWE-908) means the Video subsystem may expose stale memory - potentially including session tokens, credentials, or other sensitive browser data - without requiring any authentication from the attacker. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.34% (26th percentile) confirms low automated exploitation probability.
Injection in Google Chrome's Tabs component (versions prior to 152.0.7977.65) enables remote attackers to partially bypass system access restrictions by directing a user to a specially crafted HTML page. The flaw is classified CWE-74 (Injection) and carries only a low integrity impact (I:L) with no confidentiality or availability consequences, consistent with Chromium's own 'Medium' severity rating. No public exploit code has been identified and EPSS probability is low at 0.38% (31st percentile), indicating limited real-world exploitation pressure despite the browser's ubiquitous deployment footprint.
Incorrect authorization in Chrome's WebProtect component exposes sensitive browser information to remote attackers via crafted HTML pages, affecting all Chrome versions prior to 152.0.7977.65. The flaw carries a CVSS 6.5 score with high confidentiality impact; an unauthenticated attacker requires only that a target user visit a malicious page, making social-engineering delivery viable. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS of 0.32% (24th percentile) indicates low current exploitation activity despite the broad attack surface.
ServiceWorker incorrect authorization in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web origin policy by inducing a victim to visit a crafted HTML page. The flaw (CWE-863) allows a ServiceWorker to access cross-origin resources it should be forbidden from reading, yielding a low confidentiality impact with no integrity or availability consequence. No public exploit or active exploitation has been identified; vendor-released patch 152.0.7977.65 is available.
Google Chrome's Preload subsystem prior to version 152.0.7977.65 contains a missing authorization flaw (CWE-862) that permits unauthenticated remote attackers to bypass the web origin policy. By delivering a crafted HTML page to a victim running an unpatched Chrome browser, an attacker can cause the Preload mechanism to speculatively fetch cross-origin resources without enforcing same-origin access controls, resulting in limited confidentiality exposure. No public exploit has been identified at time of analysis, and a vendor-released patch is available in Chrome 152.0.7977.65.
Improper resource exposure in Google Chrome's Preload mechanism prior to version 152.0.7977.65 enables remote attackers to bypass Site Isolation by luring a user to a crafted HTML page. The flaw (CWE-668) allows cross-origin resource data to leak across security boundaries, undermining Chrome's core renderer isolation architecture and potentially exposing sensitive information from other origins loaded in the browser. No public exploit has been identified at time of analysis; EPSS at 0.39% (32nd percentile) and the absence of a CISA KEV listing indicate low but non-zero exploitation probability.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already achieved renderer process compromise to read limited cross-origin data via a crafted HTML page. The vulnerability stems from CWE-863 (Incorrect Authorization) in Chrome's Input component, which fails to enforce origin boundaries correctly when processing renderer-supplied input. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.24% (15th percentile), consistent with low observed exploitation pressure.
WebProtect race condition in Google Chrome prior to 152.0.7977.65 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) enables a second-stage information disclosure step within a broader browser exploitation chain, requiring a victim to interact with a crafted HTML page. No public exploit code has been identified and EPSS sits at 0.29% (22nd percentile), indicating limited real-world exploitation pressure at this time; a vendor patch is available.
Web origin policy bypass in Google Chrome for Windows (prior to 152.0.7977.65) stems from inadequate encryption strength in the browser's Notifications subsystem, exploitable via a crafted HTML page using social engineering. An unauthenticated remote attacker who tricks a user into visiting a malicious page can read limited cross-origin notification data, violating the same-origin boundary. No public exploit code has been identified and EPSS is extremely low (0.13%, 3rd percentile), consistent with the Chromium team's own Medium severity rating.
Cross-origin data leakage in Google Chrome's Payments subsystem (prior to 152.0.7977.65) exposes information from other origins when a user visits a crafted HTML page. The vulnerability stems from improper isolation within the Payments component, allowing a remote unauthenticated attacker to read data across origin boundaries - a violation of the Same-Origin Policy that underpins browser security. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates low observed exploitation probability in the wild.
HttpsUpgrades protection mechanism failure in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy via crafted network traffic. The vulnerability affects all desktop Chrome installations before the patched stable channel release and requires user interaction to trigger, consistent with CVSS UI:R. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.26% (18th percentile) indicates low current exploitation probability.
The Viz compositor component in Google Chrome prior to 152.0.7977.65 can be exploited by an attacker who has already achieved renderer process compromise to bypass Chrome's web origin policy via a crafted HTML page. This is a chained exploit primitive, not a standalone initial-access vector - it escalates an existing renderer foothold into cross-origin data access. EPSS sits at 0.29% (21st percentile), no CISA KEV listing exists, and no public exploit code has been identified, placing real-world urgency below what raw CVSS metrics alone might suggest.
Incorrect reference resolution in Chrome's Loader component prior to version 152.0.7977.65 enables unauthenticated remote attackers to bypass the browser's web origin policy via crafted network traffic, with user interaction required. The flaw (CWE-706) allows misattribution of resource origins, potentially exposing cross-origin data; CVSS rates impact as limited confidentiality loss only. With an EPSS of 0.30% at the 22nd percentile and no CISA KEV listing, exploitation appears theoretical at this time rather than actively occurring, though origin policy bypass is a meaningful primitive for targeted attacks.
Web origin policy bypass in Google Chrome's Variations component (the Finch A/B testing and feature-flag delivery system) affects all Chrome versions prior to 152.0.7977.65. A remote attacker can deliver crafted network traffic to a user running a vulnerable browser version, potentially circumventing same-origin protections and reading cross-origin data. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.22% (12th percentile) signals low current exploitation activity.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) permits a remote attacker who has already compromised the renderer process to circumvent same-origin policy enforcement via a crafted HTML page, yielding limited cross-origin data disclosure. The flaw arises from improper input validation (CWE-20) in the network stack and functions as a second-stage amplifier within an exploit chain rather than a standalone initial-access vector. EPSS is very low at 0.28% (20th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data exfiltration via Skia, Chrome's graphics rendering engine, affects all Google Chrome versions prior to 152.0.7977.65, enabling remote unauthenticated attackers to read pixel-level cross-origin data from a victim's browser session. Exploitation requires user interaction - the victim must visit a crafted HTML page - and impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates minimal observed exploitation pressure.
DOM information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive browser data by inducing a victim to visit a crafted HTML page via social engineering. The vulnerability (CWE-200) reflects improper information exposure within Chrome's Document Object Model, with high confidentiality impact per CVSS. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 13th percentile (0.22%), and a vendor-released patch is available in stable channel 152.0.7977.65.
Canvas API information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy and read cross-origin pixel data via a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) and results in low confidentiality impact - pixel-level canvas data leakage rather than credential or file system exposure. No public exploit has been identified and EPSS at 0.39% (32nd percentile) confirms low real-world exploitation probability; no CISA KEV listing exists.
Race condition in Google Chrome's Permissions component on Android allows a remote attacker, through social engineering, to bypass the web origin policy and access limited cross-origin data. Affected are all Chrome for Android versions prior to 152.0.7977.65. Exploitation requires user interaction with a crafted HTML page; no public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.26% (18th percentile) reflects low observed exploitation probability.
Observable discrepancy (CWE-203) in Google Chrome's network stack prior to version 152.0.7977.65 enables remote attackers to extract sensitive information by exploiting behavioral differences observable from a crafted HTML page. Exploitation requires high attack complexity and user interaction - the victim must visit a malicious page - constraining real-world impact despite the high confidentiality rating in the CVSS vector. No public exploit code exists and no active exploitation has been reported; Google has released a patch in Chrome 152.0.7977.65.
Incorrect authorization in the Downloads component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system-level file access restrictions through a crafted HTML page delivered via social engineering. The flaw (CWE-863) requires user interaction to trigger, limiting opportunistic mass exploitation; however, Chrome's ubiquitous install base makes even low-probability attack paths operationally significant. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits low at 0.32% (24th percentile).
Incorrect authorization in the Navigation subsystem of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy by luring a victim to a crafted HTML page. The flaw, classified under CWE-863 (Incorrect Authorization), allows partial cross-origin data reads (limited confidentiality impact per CVSS C:L). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.29% (21st percentile) reflects a currently low real-world exploitation probability. Vendor-released patch 152.0.7977.65 is available.
Chrome's Network component prior to version 152.0.7977.65 contains an improper input validation flaw that allows a pre-positioned attacker - one who has already compromised the renderer process - to bypass system access restrictions via a crafted HTML page. All Google Chrome desktop releases below 152.0.7977.65 on Windows, macOS, and Linux are affected. With a CVSS score of 6.8, an EPSS of 0.24%, no CISA KEV listing, and no public exploit identified at time of analysis, the threat is real but confined to sophisticated chained-attack scenarios.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 enables cross-origin information disclosure via a crafted HTML page, but only when an attacker has already achieved renderer process compromise through a separate, chained exploit. The flaw, tracked internally as Chromium issue 498327743, carries a CVSS score of 3.1 reflecting the high-complexity, multi-stage attack prerequisite. No public exploit code or active exploitation has been identified; EPSS exploitation probability stands at 0.33% (25th percentile), consistent with no observed widespread abuse.
Remote same-origin policy bypass in Google Chrome prior to 152.0.7977.65 exploits a use-after-free condition (CWE-672) in the Network component, allowing an attacker who has already achieved renderer process compromise to escape origin boundaries via a crafted HTML page. The vulnerability carries a CVSS 4.3 and EPSS of 0.66% (49th percentile), consistent with its role as a second-stage exploit chain component rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-origin data leakage in Google Chrome's SVG rendering engine (prior to 152.0.7977.65) allows a remote attacker to bypass same-origin policy boundaries through observable behavioral discrepancies. Exploitation requires the victim to interact with a crafted HTML page (UI:R), limiting opportunistic mass exploitation. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.37% (30th percentile) confirms low current exploitation probability.
Web Workers race condition in Google Chrome prior to 152.0.7977.65 enables Same-Origin Policy bypass for attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) allows a timing attack between origin validation and Worker data access, permitting cross-origin data reads from within a compromised renderer. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.19% (9th percentile) reflects the chained-exploit prerequisite that substantially limits real-world attacker reach.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already achieved renderer process compromise to make unauthorized cross-origin network requests via a crafted HTML page. The incorrect authorization check (CWE-863) in Chrome's Network component fails to enforce origin boundaries when the renderer is compromised, exposing limited confidentiality data from foreign origins. No public exploit has been identified, EPSS probability stands at a low 0.23%, and the vulnerability is not listed in CISA KEV - consistent with the high attack complexity imposed by the renderer-compromise prerequisite.
Chrome's QUIC protocol implementation prior to version 152.0.7977.65 permits remote attackers to bypass the browser's web origin policy by directing a user to a crafted HTML page. The flaw is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), meaning an attacker can influence a reference within the QUIC layer to access cross-origin resources that should be restricted. Impact is limited to partial confidentiality loss; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
UI misrepresentation in the Chrome Extensions subsystem (CWE-451) enables remote attackers to use social engineering and a crafted extension to deceive users into disclosing sensitive information. All Google Chrome desktop installations prior to version 152.0.7977.65 are affected. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV; however, the high confidentiality impact in the CVSS vector reflects the potential for credential or sensitive-data theft if a user is successfully deceived into installing a malicious extension.
Web origin policy bypass in Google Chrome before 152.0.7977.65 exploits improper input validation (CWE-20) in the browser's Input component, allowing a remote attacker who has already compromised the renderer process to circumvent same-origin protections via a crafted HTML page combined with social engineering. The confidentiality impact is limited (CVSS C:L) with no integrity or availability consequence, and the Chromium team rates this Medium severity. No public exploit code exists and EPSS at 0.24% (15th percentile) reflects the low opportunistic exploitation probability given the chained pre-conditions required.
Web origin policy bypass in Google Chrome's network layer prior to version 152.0.7977.65 allows a remote attacker to circumvent the browser's same-origin enforcement by luring a user to a crafted HTML page. The flaw stems from incorrect authorization logic (CWE-863) in Chrome's networking stack, resulting in limited confidentiality exposure (C:L) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low observed exploitation probability at time of analysis.
Incorrect authorization in Google Chrome Core prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass the web origin policy by combining that foothold with social engineering via a crafted HTML page. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser's Core incorrectly validates authorization checks across origins under this specific post-compromise condition. No public exploit or CISA KEV listing is present, and the EPSS score of 0.34% (26th percentile) reflects limited real-world exploitation probability at this time.
Cross-origin data disclosure in Google Chrome's Skia graphics library (versions prior to 152.0.7977.65) enables a remote attacker who has already achieved renderer process compromise to leak cross-origin data by loading a crafted HTML page. The uninitialized resource flaw (CWE-908) exposes stale Skia memory contents that may contain pixel or data residue from other origins. No public exploit code has been identified, the vulnerability is absent from CISA KEV, and an EPSS of 0.34% (26th percentile) reflects low current exploitation activity.
Missing authorization in the WebAppInstalls component of Google Chrome for Android (prior to 152.0.7977.65) enables an attacker who has already achieved renderer process compromise to extract sensitive information by issuing crafted IPC requests that bypass browser-process authorization checks. This is a chained exploit primitive rather than a standalone attack - it elevates a pre-existing renderer compromise into an unauthorized data disclosure. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.38% at the 30th percentile reflects the high practical barrier imposed by the required renderer prerequisite.
Sensor API information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to read sensitive device sensor data by loading a crafted HTML page. The flaw (CWE-862, Missing Authorization) does not provide initial access on its own - it is a post-exploitation primitive that extends the capability of a pre-existing renderer compromise. No public exploit code has been identified at time of analysis, and EPSS stands at 0.26% (17th percentile), reflecting low current exploitation probability.
Incorrect authorization in Chrome's FileSystem API (CWE-863) allows a remote attacker to bypass system access restrictions through a crafted HTML page delivered via social engineering, achieving high-integrity impact on versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network delivery with mandatory user interaction and no confidentiality exposure - only unauthorized writes or modification of normally restricted filesystem locations. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.38% (31st percentile), consistent with the social-engineering friction required. A vendor patch is available in stable channel 152.0.7977.65.
Chrome's browser Sync subsystem in versions prior to 152.0.7977.65 leaks sensitive user data due to improper validation of crafted inbound network traffic (CWE-20), enabling a remote attacker to read high-confidentiality synchronized content such as credentials or browsing history. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable with no privilege requirement, but a user interaction step limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists; EPSS at 0.25% (16th percentile) corroborates low near-term exploitation probability, and the vendor-released patch (152.0.7977.65) is already available.
Incorrect authorization in Chrome's CustomTabs feature on Android (prior to 152.0.7977.65) allows a co-installed malicious application to bypass the browser's web origin policy. The flaw is classified CWE-863 and is limited to Android deployments where an attacker controls a separately installed app on the same device. A vendor patch was released in Chrome 152.0.7977.65; no public exploit code or CISA KEV listing exists, and EPSS sits at 0.14% (3rd percentile), indicating minimal observed exploitation pressure.
Sensitive information disclosure via the QUIC protocol stack in Google Chrome affects all versions prior to 152.0.7977.65, exploitable by remote unauthenticated attackers through a crafted HTML page. When a victim navigates to an attacker-controlled page, Chrome's QUIC (HTTP/3) implementation improperly exposes confidential data, with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified at time of analysis; CISA SSVC rates exploitation status as none and EPSS is 0.31% (23rd percentile), indicating low near-term exploitation probability despite the medium-severity classification.
Memory disclosure via uninitialized GPU resource in Google Chrome prior to 152.0.7977.65 enables a remote attacker - who has already compromised the renderer process - to read memory contents outside the Chrome sandbox through a crafted HTML page. This is a chained, second-stage attack: the GPU component fails to initialize memory before use (CWE-908), leaking data only after renderer compromise. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS of 0.40% (33rd percentile) further signals limited real-world exploitation pressure. A vendor-released patch is available in Chrome 152.0.7977.65.
Observable discrepancy in Chrome's Autofill subsystem allows remote information disclosure via a crafted HTML page, affecting all desktop Chrome versions before 152.0.7977.65. The flaw (CWE-203) enables a network-reachable attacker to infer sensitive stored autofill data - such as addresses or payment fields - by measuring behavioral or timing differences triggered by form elements on a malicious page. Google has issued a patch in stable channel version 152.0.7977.65; no public exploit code exists and no CISA KEV listing has been recorded at time of analysis.
Cross-origin data exposure via the GPU subsystem in Google Chrome prior to 152.0.7977.65 allows a remote, unauthenticated attacker to read data from other web origins by luring a user to a crafted HTML page. The vulnerability resides in Chrome's GPU rendering path and violates the browser's same-origin policy, potentially exposing session tokens, rendered content, or other sensitive cross-origin data. No public exploit code or CISA KEV listing has been identified, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Incorrect authorization in the Chrome Extensions subsystem (CWE-863) allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by delivering a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. Chromium rated this High severity despite the NVD CVSS base score of 4.3, because the same-origin policy bypass has meaningful privacy implications even though it requires a pre-compromised renderer as a prerequisite. No public exploit code has been identified and EPSS stands at 0.34% (26th percentile), consistent with no active exploitation confirmed at time of analysis.
Race condition in Google Chrome's Autofill subsystem (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to bypass the browser's same-origin policy via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer exploit, making it a chained-attack component rather than a standalone threat. No public exploit code has been identified, and EPSS at 0.31% (24th percentile) reflects low opportunistic exploitation probability with no CISA KEV listing.
Incorrect authorization in Google Chrome's Extensions subsystem (all versions before 152.0.7977.65) allows an attacker who has already compromised the renderer process to bypass the web origin policy and reach privileged browser pages via a crafted HTML page. This is a chained, second-stage vulnerability - a prior renderer compromise is required - substantially narrowing the realistic attacker pool despite the network-accessible vector. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS probability of 0.24% at the 15th percentile is consistent with this chained attack profile.
Uninitialized memory in Chrome's ANGLE graphics abstraction layer, across all desktop platforms prior to version 152.0.7977.65, enables remote attackers to read cross-origin data by delivering a crafted HTML page to a victim user. The flaw breaks the browser's same-origin policy through the graphics pipeline rather than through JavaScript or DOM manipulation. No public exploit or CISA KEV listing exists; EPSS of 0.24% at the 15th percentile reflects low current exploitation pressure.
Cross-origin information leak in Google Chrome's Paint rendering component (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy by delivering a crafted HTML page. The vulnerability is confined to the confidentiality dimension - no integrity or availability impact - and requires user interaction (visiting the attacker-controlled page) to trigger. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.33% places it in the 25th percentile, indicating low exploitation probability in the near term.
Cross-origin pixel data leakage in the Canvas API of Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web same-origin policy by enticing a victim to visit a crafted HTML page. The flaw is classified High severity by the Chromium team and Medium (CVSS 4.3) by NVD, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing is identified at time of analysis, and EPSS at 0.33% indicates very low observed exploitation probability.
Incorrect authorization in Google Chrome's Transactions Platform (versions prior to 152.0.7977.65) permits a remote attacker who has already achieved renderer process compromise to bypass the browser's web origin policy via a crafted HTML page. The flaw is classified CWE-863 and carries a vendor severity of High, though the CVSS base score of 4.3 reflects the limited confidentiality-only impact and required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.24% (15th percentile) indicates low observed exploitation probability.
Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. The impact is limited to a partial confidentiality breach via cross-origin data access; no integrity or availability impact has been identified. No public exploit code exists and EPSS probability sits at 0.20% (10th percentile), indicating very low near-term exploitation likelihood despite Chromium's internal 'High' severity rating.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (versions prior to 152.0.7977.65) allows an unauthenticated remote attacker to read limited data across origin boundaries by inducing a victim to visit a crafted HTML page. The root cause is an uninitialized resource (CWE-908) in ANGLE, Chrome's graphics abstraction engine, which can expose residual GPU buffer contents from other origins. No public exploit identified at time of analysis; EPSS is low at 0.40% (33rd percentile), and the vulnerability is not listed in CISA KEV.
Information disclosure in Google Chrome's Autofill component on Android (prior to 152.0.7977.65) enables a remote attacker to extract sensitive user data - likely form-fill credentials or PII - by luring a victim to a specially crafted HTML page. The vulnerability stems from CWE-20 improper input validation in the Autofill subsystem, which fails to sanitize attacker-controlled HTML before processing it. No public exploit code or CISA KEV listing is present at time of analysis; EPSS sits at the 13th percentile, indicating low current exploitation momentum despite the high confidentiality impact.
Incorrect authorization in the Paint component of Google Chrome before version 152.0.7977.65 enables remote unauthenticated attackers to potentially bypass the Same-Origin Policy via a crafted HTML page, resulting in limited cross-origin data exposure. Exploitation requires user interaction - the victim must navigate to the attacker-controlled page - and impact is confined to partial confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and the low EPSS score of 0.24% (15th percentile) corroborates low observed exploitation activity; a vendor patch was released in the Chrome 152 stable channel.
Missing authorization in Google Chrome's Passwords component prior to version 152.0.7977.65 allows a remote attacker, who has already compromised the renderer process, to bypass web origin policy and access stored password data for other origins via a crafted HTML page combined with social engineering. The attack requires two chained prerequisites - renderer compromise and user interaction - which significantly constrains real-world exploitability despite the network-facing attack vector. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at a very low 0.24% (15th percentile). A vendor patch is available.
Cross-origin data exposure in Google Chrome's GPU component prior to version 152.0.7977.65 can be triggered by a remote attacker who has already compromised the renderer process. The vulnerability stems from an uninitialized GPU resource (CWE-908) that leaks memory contents readable across origin boundaries. Exploitation requires chaining this issue with a separate renderer compromise, significantly raising the bar; no public exploit code has been identified and EPSS probability sits at 0.40%.
Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Privilege escalation from userspace to kernel level is possible in Google's Fuchsia OS via a Use-After-Free condition in the Zircon kernel pager proxy component, affecting Android F30.1.1. An attacker with low-privileged code execution on the device can exploit the memory corruption flaw to gain kernel-level control, achieving full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current active exploitation.
Path traversal in achorein expo-share-intent up to version 8.0.0 allows a local attacker to write files outside the intended cache directory by supplying a crafted `_display_name` value during Android file sharing operations. The `getDataColumn` function in `ExpoShareIntentModule.kt` constructed file paths directly from the unvalidated content-provider display name, enabling directory escape via sequences such as `../../`. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch (v8.0.1) resolves the issue.
Memory disclosure outside the Chrome renderer sandbox is possible via uninitialized GPU resource access in Google Chrome prior to 151.0.7922.169. An attacker who has already compromised the renderer process can trigger the flaw through a crafted HTML page, allowing reads of memory belonging to processes outside the sandbox boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is confirmed available.
Skia graphics library in Google Chrome prior to 151.0.7922.169 leaks information in a way that allows remote attackers to potentially bypass the web Same-Origin Policy via a specially crafted HTML page. Affected users on all desktop platforms running any Chrome version before 151.0.7922.169 are exposed to cross-origin data disclosure triggered by visiting a malicious page. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Incorrect reference resolution in the Core component of Google Chrome on Android exposes sensitive information to remote attackers who can socially engineer users into visiting a malicious HTML page. Affected versions are all Chrome for Android builds prior to 151.0.7922.169. Exploitation requires user interaction but no authentication, and the vulnerability is platform-specific to Android. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Site isolation bypass in Google Chrome prior to 151.0.7922.169 enables a renderer-compromised attacker to cross origin boundaries via a flawed CORS implementation, reading or modifying data from otherwise isolated sites. This is a chained exploitation scenario: it requires a preceding renderer compromise as a prerequisite, making it a sandbox-escape-class vulnerability rather than a standalone browser attack. No public exploit code or active exploitation has been identified at the time of analysis, and a vendor patch is available in the 151.0.7922.169 stable channel release.
Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.
SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege users to cause the server to make outbound HTTP requests to attacker-selected non-standard ports by uploading a crafted APK. The `get_browsable_activities()` function in `manifest_analysis.py` validates only the `android:host` attribute via `valid_host()`, which enforces a 80/443-only port allowlist, but then appends the separately supplied `android:port` attribute to the assembled URL without re-validating the combined result - enabling port restriction bypass. When combined with DNS rebinding between the validation lookup and the `requests.get()` connection, the outbound request can reach internal services; however, the path is fixed to `/.well-known/assetlinks.json` and redirects are disabled. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions to exfiltrate server-side files by embedding traversal sequences in the android:icon attribute of a crafted AndroidManifest.xml inside a ZIP or APK upload. The vulnerable find_icon_path_zip() function resolves the attacker-controlled icon path without containment checks, copies the target file to a predictable location in DWD_DIR, and exposes it through the /download/ endpoint. A fully functional proof-of-concept script is publicly available in the GHSA advisory; this issue is not listed in the CISA KEV catalog.
Clickjacking in Firefox for Android's Downloads component enables remote attackers to trick users into performing unintended download-related actions through UI redress. All Firefox for Android versions prior to 154 are affected, with the fix confirmed in Mozilla Security Advisory mfsa2026-74. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.
UI spoofing in the Downloads component of Firefox for Android allows network-accessible attackers to misrepresent critical information to users, potentially deceiving them about the nature or origin of downloaded content. Affected versions are those prior to Firefox 154 on Android, as confirmed by Mozilla's security advisory MFSA2026-74. No public exploit code exists and CISA has not added this to the KEV catalog; SSVC signals exploitation status as none with partial technical impact.
Clickjacking in Firefox for Android before version 154 allows remote unauthenticated attackers to overlay transparent or opaque UI frames over legitimate browser content, capturing user interactions intended for other elements. The CVSS vector (PR:N, UI:R, I:H) indicates no privileges are needed but a victim must interact with an attacker-controlled page, resulting in high-integrity impact through unintended user actions such as inadvertent permission grants or form submissions. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
DualSafe Password Manager & Digital Vault Extension (versions up to and including 1.4.35 for Chrome) exposes stored credentials and TOTP codes through an unauthenticated postMessage-based bridge, enabling cross-origin secret exfiltration by any webpage the victim visits. The extension's bridge component processes incoming postMessage calls without validating the sender's origin, meaning an attacker-controlled page can query the vault directly without any extension-level authentication. A publicly available proof-of-concept hosted on GitHub demonstrates the technique; the vulnerability has not been added to the CISA KEV catalog as of this analysis.
Cross-site scripting in the Alaev SEO Tools Chrome Extension (versions up to 1.0.10) exposes users to script injection via the popup UI's addDiv function, which fails to sanitize externally sourced page SEO field data before inserting it into the DOM. A working proof-of-concept exploit is publicly available on GitHub, demonstrating injection through crafted page metadata. The vendor did not respond to responsible disclosure, and no patch has been released, leaving all users of affected versions without an official fix.
Persistent ad-blocking bypass in Adblock for Youtube Extension versions up to 7.2.1 on Google Chrome allows remote web content to silently disable the extension's filtering rules by exploiting an improper authorization flaw (CWE-285) in the contentscript.js event listener. The updateDynamicRules function processes the yt-anti-adblock-detected DOM event without verifying the caller's origin or authorization, meaning any adversarial webpage can trigger the function and persistently disable ad blocking. Publicly available exploit code demonstrates this technique; the vulnerability is not listed in the CISA KEV catalog and no vendor patch exists, as the maintainer did not respond to pre-disclosure outreach.
OS command injection in android-mcp-server's `build/index.js` allows local low-privilege attackers to execute arbitrary shell commands by supplying malicious values for parameters such as `deviceId`, `packageName`, `permission`, or `extras` fields passed to the `child_process.exec()` ADB command builder. The vulnerable code interpolates user-supplied input directly into shell command strings without sanitization, making exploitation trivial for any local user with access to the MCP server process. A publicly available proof-of-concept exists via the GitHub issue tracker, and a patch commit has been published; no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework (CCF) and the I2C adapter lock, which triggers when an I2C-controlled clock generator client (like the Si5351) is registered or modified under the CCF. During an i2c client clock (generator) frequency change, the CCF acquires its global 'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's chip registers, stalling for the adapter's I2C bus lock. Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO expander handling LEDs) can hold the I2C adapter lock. Inside this parallel transfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host controller's input clock to calculate bus timings. This call attempts to acquire the blocked CCF 'prepare_lock', creating a circular dependency that freezes the system. The jz4780 host controller clock itself is static and never changes at runtime. However, calling clk_get_rate() inside the active transfer path introduces an unnecessary dependency on the CCF internal locks. Eliminate this synchronous clk_get_rate() call from the active transfer path by caching the static host peripheral clock rate once - inside the private jz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed() to use this cached value, safely decoupling active I2C transactions from the CCF internal locks without any risk of stale timings. Assisted-by web based Google AI (pinpointing the bug and writing the message).
Cross-site request forgery in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to execute arbitrary SQL against the site's database by tricking a recently logged-in administrator into visiting an attacker-controlled page. The missing CSRF token on the AI Assistant's execute_tool action in admin/ai.php, combined with an absent SameSite cookie attribute exploitable via Chrome's Lax+POST grace window, permits full database read across all tables and write access to all tables except blog - sufficient to overwrite the user table and seize administrator account control. No patch is available as of this review, no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in the Embed Google Photos album WordPress plugin (all versions through 2.2.1) allows authenticated Contributor-role users to inject arbitrary JavaScript via an unescaped shortcode attribute rendered directly into an HTML attribute context. The injected script executes silently in the browser of any user who views the affected post, including administrators, enabling session hijacking and potential full site takeover. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects negligible current exploitation activity.
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an established man-in-the-middle network position to intercept and modify application-layer communications between the client and backend infrastructure. Affected platforms are desktop and non-mobile variants - iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the confidentiality and integrity impacts are rated High given successful interception enables full visibility and manipulation of application traffic outside the VPN tunnel.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain unauthorized access to the agent's protected processes and files, effectively disabling endpoint security enforcement. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly not impacted. No public exploit code has been identified and no active exploitation has been confirmed (CVSS E:U), keeping real-world risk constrained to insider threat and post-compromise scenarios.
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrator to circumvent the agent's security inspection enforcement, subsequently enabling injection and interception of arbitrary network traffic. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected by the vendor. No public exploit has been identified at time of analysis, and exploitation requires pre-existing local administrator access, significantly narrowing the realistic threat population.
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to delete a limited set of system files and disable the agent entirely. Only Linux deployments are affected - macOS, Windows, iOS, Android, and Chrome OS are explicitly confirmed safe by the vendor. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 4.0 supplemental vector classifies exploitation as unlikely (E:U) with Amber urgency, making this a low-priority but genuine patch target for Linux endpoint fleets.
Cross-team credential disclosure in the Apache Airflow Google Provider's Cloud Secret Manager backend exposes every team's Connections and Variables to every other team in multi-team deployments. The backend's public methods accepted a team_name parameter but silently discarded it before the internal secret lookup, collapsing all team namespaces into one shared, unscoped lookup. No public exploit has been identified at time of analysis; the vendor-released fix is apache-airflow-providers-google 22.3.0.
Session token exposure in the Mira Android app (Quanovate Tech Inc.) leaks live authentication credentials to third-party web properties and referrer logs whenever users trigger in-app WebView flows such as shop redirects. The app appends the active session token as a URL query string parameter and embeds a persistent user identifier in the WebView User-Agent header, both of which are transmitted to any destination or JavaScript context receiving that traffic. Reported by ICS-CERT under medical advisory ICSMA-26-223-01, this vulnerability affects a healthcare-adjacent platform, amplifying the sensitivity of exposed credentials; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Edge (Chromium-based) below version 151.0.4129.78 stems from a type confusion flaw (CWE-843) in the browser engine, exploitable over the network when a user visits or interacts with attacker-controlled content. The vendor has confirmed patch availability and the flaw is tagged as causing memory corruption, which aligns with the typical consequence of type confusion in browser engines. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the unauthenticated network vector with low attack complexity warrants prioritized patching in enterprise environments.
Information disclosure in Nuxt's development server exposes the project's absolute filesystem root path and a persistent per-project workspace UUID to unauthenticated LAN-adjacent attackers via the Chrome DevTools workspace endpoint. The prior security fix (GHSA-rq7w-g337-39qq) introduced a local-request gate that trusts the attacker-supplied Host header instead of the actual TCP peer address, meaning a non-browser client such as curl can bypass it by omitting Sec-Fetch-Site, Origin, and Referer headers while forging Host: localhost. Impact is confined to information disclosure; no public exploit has been independently identified at time of analysis, though the official advisory provides a working proof-of-concept curl command. Production builds are entirely unaffected.
Improper cryptographic signature verification in Estonian RIA's libdigidocpp core library and its consumer applications - DigiDoc4, DigiDoc for Android, and DigiDoc for iOS - enables bypassing of XAdES signature validity checks through unhandled exceptional conditions during BDOC container parsing. Affected versions span libdigidocpp 4.1.0-4.2.0, DigiDoc4 4.7.0-4.8.1, DigiDoc Android 2.7.0-2.7.1, and DigiDoc iOS 2.8.0, all of which have vendor-released patches. A proof-of-concept is indicated by the CVSS 4.0 E:P exploit maturity modifier, though no active exploitation has been confirmed and this CVE is not listed in CISA KEV.
Incorrect authorization in Google Chrome's Extensions subsystem (versions prior to 152.0.7977.65) permits a remote attacker to bypass system access restrictions through a crafted Chrome extension delivered via social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms mandatory user interaction limits opportunistic exploitation, and impact is constrained to integrity with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the social-engineering dependency.
Memory disclosure in Google Chrome's Video component (versions prior to 152.0.7977.65) allows a remote attacker to read memory contents from within the Chrome sandbox by directing a victim to a specially crafted HTML page. The uninitialized resource flaw (CWE-908) means the Video subsystem may expose stale memory - potentially including session tokens, credentials, or other sensitive browser data - without requiring any authentication from the attacker. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.34% (26th percentile) confirms low automated exploitation probability.
Injection in Google Chrome's Tabs component (versions prior to 152.0.7977.65) enables remote attackers to partially bypass system access restrictions by directing a user to a specially crafted HTML page. The flaw is classified CWE-74 (Injection) and carries only a low integrity impact (I:L) with no confidentiality or availability consequences, consistent with Chromium's own 'Medium' severity rating. No public exploit code has been identified and EPSS probability is low at 0.38% (31st percentile), indicating limited real-world exploitation pressure despite the browser's ubiquitous deployment footprint.
Incorrect authorization in Chrome's WebProtect component exposes sensitive browser information to remote attackers via crafted HTML pages, affecting all Chrome versions prior to 152.0.7977.65. The flaw carries a CVSS 6.5 score with high confidentiality impact; an unauthenticated attacker requires only that a target user visit a malicious page, making social-engineering delivery viable. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS of 0.32% (24th percentile) indicates low current exploitation activity despite the broad attack surface.
ServiceWorker incorrect authorization in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web origin policy by inducing a victim to visit a crafted HTML page. The flaw (CWE-863) allows a ServiceWorker to access cross-origin resources it should be forbidden from reading, yielding a low confidentiality impact with no integrity or availability consequence. No public exploit or active exploitation has been identified; vendor-released patch 152.0.7977.65 is available.
Google Chrome's Preload subsystem prior to version 152.0.7977.65 contains a missing authorization flaw (CWE-862) that permits unauthenticated remote attackers to bypass the web origin policy. By delivering a crafted HTML page to a victim running an unpatched Chrome browser, an attacker can cause the Preload mechanism to speculatively fetch cross-origin resources without enforcing same-origin access controls, resulting in limited confidentiality exposure. No public exploit has been identified at time of analysis, and a vendor-released patch is available in Chrome 152.0.7977.65.
Improper resource exposure in Google Chrome's Preload mechanism prior to version 152.0.7977.65 enables remote attackers to bypass Site Isolation by luring a user to a crafted HTML page. The flaw (CWE-668) allows cross-origin resource data to leak across security boundaries, undermining Chrome's core renderer isolation architecture and potentially exposing sensitive information from other origins loaded in the browser. No public exploit has been identified at time of analysis; EPSS at 0.39% (32nd percentile) and the absence of a CISA KEV listing indicate low but non-zero exploitation probability.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already achieved renderer process compromise to read limited cross-origin data via a crafted HTML page. The vulnerability stems from CWE-863 (Incorrect Authorization) in Chrome's Input component, which fails to enforce origin boundaries correctly when processing renderer-supplied input. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.24% (15th percentile), consistent with low observed exploitation pressure.
WebProtect race condition in Google Chrome prior to 152.0.7977.65 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) enables a second-stage information disclosure step within a broader browser exploitation chain, requiring a victim to interact with a crafted HTML page. No public exploit code has been identified and EPSS sits at 0.29% (22nd percentile), indicating limited real-world exploitation pressure at this time; a vendor patch is available.
Web origin policy bypass in Google Chrome for Windows (prior to 152.0.7977.65) stems from inadequate encryption strength in the browser's Notifications subsystem, exploitable via a crafted HTML page using social engineering. An unauthenticated remote attacker who tricks a user into visiting a malicious page can read limited cross-origin notification data, violating the same-origin boundary. No public exploit code has been identified and EPSS is extremely low (0.13%, 3rd percentile), consistent with the Chromium team's own Medium severity rating.
Cross-origin data leakage in Google Chrome's Payments subsystem (prior to 152.0.7977.65) exposes information from other origins when a user visits a crafted HTML page. The vulnerability stems from improper isolation within the Payments component, allowing a remote unauthenticated attacker to read data across origin boundaries - a violation of the Same-Origin Policy that underpins browser security. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates low observed exploitation probability in the wild.
HttpsUpgrades protection mechanism failure in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy via crafted network traffic. The vulnerability affects all desktop Chrome installations before the patched stable channel release and requires user interaction to trigger, consistent with CVSS UI:R. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.26% (18th percentile) indicates low current exploitation probability.
The Viz compositor component in Google Chrome prior to 152.0.7977.65 can be exploited by an attacker who has already achieved renderer process compromise to bypass Chrome's web origin policy via a crafted HTML page. This is a chained exploit primitive, not a standalone initial-access vector - it escalates an existing renderer foothold into cross-origin data access. EPSS sits at 0.29% (21st percentile), no CISA KEV listing exists, and no public exploit code has been identified, placing real-world urgency below what raw CVSS metrics alone might suggest.
Incorrect reference resolution in Chrome's Loader component prior to version 152.0.7977.65 enables unauthenticated remote attackers to bypass the browser's web origin policy via crafted network traffic, with user interaction required. The flaw (CWE-706) allows misattribution of resource origins, potentially exposing cross-origin data; CVSS rates impact as limited confidentiality loss only. With an EPSS of 0.30% at the 22nd percentile and no CISA KEV listing, exploitation appears theoretical at this time rather than actively occurring, though origin policy bypass is a meaningful primitive for targeted attacks.
Web origin policy bypass in Google Chrome's Variations component (the Finch A/B testing and feature-flag delivery system) affects all Chrome versions prior to 152.0.7977.65. A remote attacker can deliver crafted network traffic to a user running a vulnerable browser version, potentially circumventing same-origin protections and reading cross-origin data. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.22% (12th percentile) signals low current exploitation activity.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) permits a remote attacker who has already compromised the renderer process to circumvent same-origin policy enforcement via a crafted HTML page, yielding limited cross-origin data disclosure. The flaw arises from improper input validation (CWE-20) in the network stack and functions as a second-stage amplifier within an exploit chain rather than a standalone initial-access vector. EPSS is very low at 0.28% (20th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data exfiltration via Skia, Chrome's graphics rendering engine, affects all Google Chrome versions prior to 152.0.7977.65, enabling remote unauthenticated attackers to read pixel-level cross-origin data from a victim's browser session. Exploitation requires user interaction - the victim must visit a crafted HTML page - and impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates minimal observed exploitation pressure.
DOM information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive browser data by inducing a victim to visit a crafted HTML page via social engineering. The vulnerability (CWE-200) reflects improper information exposure within Chrome's Document Object Model, with high confidentiality impact per CVSS. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 13th percentile (0.22%), and a vendor-released patch is available in stable channel 152.0.7977.65.
Canvas API information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy and read cross-origin pixel data via a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) and results in low confidentiality impact - pixel-level canvas data leakage rather than credential or file system exposure. No public exploit has been identified and EPSS at 0.39% (32nd percentile) confirms low real-world exploitation probability; no CISA KEV listing exists.
Race condition in Google Chrome's Permissions component on Android allows a remote attacker, through social engineering, to bypass the web origin policy and access limited cross-origin data. Affected are all Chrome for Android versions prior to 152.0.7977.65. Exploitation requires user interaction with a crafted HTML page; no public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.26% (18th percentile) reflects low observed exploitation probability.
Observable discrepancy (CWE-203) in Google Chrome's network stack prior to version 152.0.7977.65 enables remote attackers to extract sensitive information by exploiting behavioral differences observable from a crafted HTML page. Exploitation requires high attack complexity and user interaction - the victim must visit a malicious page - constraining real-world impact despite the high confidentiality rating in the CVSS vector. No public exploit code exists and no active exploitation has been reported; Google has released a patch in Chrome 152.0.7977.65.
Incorrect authorization in the Downloads component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system-level file access restrictions through a crafted HTML page delivered via social engineering. The flaw (CWE-863) requires user interaction to trigger, limiting opportunistic mass exploitation; however, Chrome's ubiquitous install base makes even low-probability attack paths operationally significant. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits low at 0.32% (24th percentile).
Incorrect authorization in the Navigation subsystem of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy by luring a victim to a crafted HTML page. The flaw, classified under CWE-863 (Incorrect Authorization), allows partial cross-origin data reads (limited confidentiality impact per CVSS C:L). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.29% (21st percentile) reflects a currently low real-world exploitation probability. Vendor-released patch 152.0.7977.65 is available.
Chrome's Network component prior to version 152.0.7977.65 contains an improper input validation flaw that allows a pre-positioned attacker - one who has already compromised the renderer process - to bypass system access restrictions via a crafted HTML page. All Google Chrome desktop releases below 152.0.7977.65 on Windows, macOS, and Linux are affected. With a CVSS score of 6.8, an EPSS of 0.24%, no CISA KEV listing, and no public exploit identified at time of analysis, the threat is real but confined to sophisticated chained-attack scenarios.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 enables cross-origin information disclosure via a crafted HTML page, but only when an attacker has already achieved renderer process compromise through a separate, chained exploit. The flaw, tracked internally as Chromium issue 498327743, carries a CVSS score of 3.1 reflecting the high-complexity, multi-stage attack prerequisite. No public exploit code or active exploitation has been identified; EPSS exploitation probability stands at 0.33% (25th percentile), consistent with no observed widespread abuse.
Remote same-origin policy bypass in Google Chrome prior to 152.0.7977.65 exploits a use-after-free condition (CWE-672) in the Network component, allowing an attacker who has already achieved renderer process compromise to escape origin boundaries via a crafted HTML page. The vulnerability carries a CVSS 4.3 and EPSS of 0.66% (49th percentile), consistent with its role as a second-stage exploit chain component rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-origin data leakage in Google Chrome's SVG rendering engine (prior to 152.0.7977.65) allows a remote attacker to bypass same-origin policy boundaries through observable behavioral discrepancies. Exploitation requires the victim to interact with a crafted HTML page (UI:R), limiting opportunistic mass exploitation. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.37% (30th percentile) confirms low current exploitation probability.
Web Workers race condition in Google Chrome prior to 152.0.7977.65 enables Same-Origin Policy bypass for attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) allows a timing attack between origin validation and Worker data access, permitting cross-origin data reads from within a compromised renderer. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.19% (9th percentile) reflects the chained-exploit prerequisite that substantially limits real-world attacker reach.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already achieved renderer process compromise to make unauthorized cross-origin network requests via a crafted HTML page. The incorrect authorization check (CWE-863) in Chrome's Network component fails to enforce origin boundaries when the renderer is compromised, exposing limited confidentiality data from foreign origins. No public exploit has been identified, EPSS probability stands at a low 0.23%, and the vulnerability is not listed in CISA KEV - consistent with the high attack complexity imposed by the renderer-compromise prerequisite.
Chrome's QUIC protocol implementation prior to version 152.0.7977.65 permits remote attackers to bypass the browser's web origin policy by directing a user to a crafted HTML page. The flaw is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), meaning an attacker can influence a reference within the QUIC layer to access cross-origin resources that should be restricted. Impact is limited to partial confidentiality loss; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
UI misrepresentation in the Chrome Extensions subsystem (CWE-451) enables remote attackers to use social engineering and a crafted extension to deceive users into disclosing sensitive information. All Google Chrome desktop installations prior to version 152.0.7977.65 are affected. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV; however, the high confidentiality impact in the CVSS vector reflects the potential for credential or sensitive-data theft if a user is successfully deceived into installing a malicious extension.
Web origin policy bypass in Google Chrome before 152.0.7977.65 exploits improper input validation (CWE-20) in the browser's Input component, allowing a remote attacker who has already compromised the renderer process to circumvent same-origin protections via a crafted HTML page combined with social engineering. The confidentiality impact is limited (CVSS C:L) with no integrity or availability consequence, and the Chromium team rates this Medium severity. No public exploit code exists and EPSS at 0.24% (15th percentile) reflects the low opportunistic exploitation probability given the chained pre-conditions required.
Web origin policy bypass in Google Chrome's network layer prior to version 152.0.7977.65 allows a remote attacker to circumvent the browser's same-origin enforcement by luring a user to a crafted HTML page. The flaw stems from incorrect authorization logic (CWE-863) in Chrome's networking stack, resulting in limited confidentiality exposure (C:L) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low observed exploitation probability at time of analysis.
Incorrect authorization in Google Chrome Core prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass the web origin policy by combining that foothold with social engineering via a crafted HTML page. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser's Core incorrectly validates authorization checks across origins under this specific post-compromise condition. No public exploit or CISA KEV listing is present, and the EPSS score of 0.34% (26th percentile) reflects limited real-world exploitation probability at this time.
Cross-origin data disclosure in Google Chrome's Skia graphics library (versions prior to 152.0.7977.65) enables a remote attacker who has already achieved renderer process compromise to leak cross-origin data by loading a crafted HTML page. The uninitialized resource flaw (CWE-908) exposes stale Skia memory contents that may contain pixel or data residue from other origins. No public exploit code has been identified, the vulnerability is absent from CISA KEV, and an EPSS of 0.34% (26th percentile) reflects low current exploitation activity.
Missing authorization in the WebAppInstalls component of Google Chrome for Android (prior to 152.0.7977.65) enables an attacker who has already achieved renderer process compromise to extract sensitive information by issuing crafted IPC requests that bypass browser-process authorization checks. This is a chained exploit primitive rather than a standalone attack - it elevates a pre-existing renderer compromise into an unauthorized data disclosure. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.38% at the 30th percentile reflects the high practical barrier imposed by the required renderer prerequisite.
Sensor API information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to read sensitive device sensor data by loading a crafted HTML page. The flaw (CWE-862, Missing Authorization) does not provide initial access on its own - it is a post-exploitation primitive that extends the capability of a pre-existing renderer compromise. No public exploit code has been identified at time of analysis, and EPSS stands at 0.26% (17th percentile), reflecting low current exploitation probability.
Incorrect authorization in Chrome's FileSystem API (CWE-863) allows a remote attacker to bypass system access restrictions through a crafted HTML page delivered via social engineering, achieving high-integrity impact on versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network delivery with mandatory user interaction and no confidentiality exposure - only unauthorized writes or modification of normally restricted filesystem locations. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.38% (31st percentile), consistent with the social-engineering friction required. A vendor patch is available in stable channel 152.0.7977.65.
Chrome's browser Sync subsystem in versions prior to 152.0.7977.65 leaks sensitive user data due to improper validation of crafted inbound network traffic (CWE-20), enabling a remote attacker to read high-confidentiality synchronized content such as credentials or browsing history. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable with no privilege requirement, but a user interaction step limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists; EPSS at 0.25% (16th percentile) corroborates low near-term exploitation probability, and the vendor-released patch (152.0.7977.65) is already available.
Incorrect authorization in Chrome's CustomTabs feature on Android (prior to 152.0.7977.65) allows a co-installed malicious application to bypass the browser's web origin policy. The flaw is classified CWE-863 and is limited to Android deployments where an attacker controls a separately installed app on the same device. A vendor patch was released in Chrome 152.0.7977.65; no public exploit code or CISA KEV listing exists, and EPSS sits at 0.14% (3rd percentile), indicating minimal observed exploitation pressure.
Sensitive information disclosure via the QUIC protocol stack in Google Chrome affects all versions prior to 152.0.7977.65, exploitable by remote unauthenticated attackers through a crafted HTML page. When a victim navigates to an attacker-controlled page, Chrome's QUIC (HTTP/3) implementation improperly exposes confidential data, with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified at time of analysis; CISA SSVC rates exploitation status as none and EPSS is 0.31% (23rd percentile), indicating low near-term exploitation probability despite the medium-severity classification.
Memory disclosure via uninitialized GPU resource in Google Chrome prior to 152.0.7977.65 enables a remote attacker - who has already compromised the renderer process - to read memory contents outside the Chrome sandbox through a crafted HTML page. This is a chained, second-stage attack: the GPU component fails to initialize memory before use (CWE-908), leaking data only after renderer compromise. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS of 0.40% (33rd percentile) further signals limited real-world exploitation pressure. A vendor-released patch is available in Chrome 152.0.7977.65.
Observable discrepancy in Chrome's Autofill subsystem allows remote information disclosure via a crafted HTML page, affecting all desktop Chrome versions before 152.0.7977.65. The flaw (CWE-203) enables a network-reachable attacker to infer sensitive stored autofill data - such as addresses or payment fields - by measuring behavioral or timing differences triggered by form elements on a malicious page. Google has issued a patch in stable channel version 152.0.7977.65; no public exploit code exists and no CISA KEV listing has been recorded at time of analysis.
Cross-origin data exposure via the GPU subsystem in Google Chrome prior to 152.0.7977.65 allows a remote, unauthenticated attacker to read data from other web origins by luring a user to a crafted HTML page. The vulnerability resides in Chrome's GPU rendering path and violates the browser's same-origin policy, potentially exposing session tokens, rendered content, or other sensitive cross-origin data. No public exploit code or CISA KEV listing has been identified, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Incorrect authorization in the Chrome Extensions subsystem (CWE-863) allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by delivering a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. Chromium rated this High severity despite the NVD CVSS base score of 4.3, because the same-origin policy bypass has meaningful privacy implications even though it requires a pre-compromised renderer as a prerequisite. No public exploit code has been identified and EPSS stands at 0.34% (26th percentile), consistent with no active exploitation confirmed at time of analysis.
Race condition in Google Chrome's Autofill subsystem (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to bypass the browser's same-origin policy via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer exploit, making it a chained-attack component rather than a standalone threat. No public exploit code has been identified, and EPSS at 0.31% (24th percentile) reflects low opportunistic exploitation probability with no CISA KEV listing.
Incorrect authorization in Google Chrome's Extensions subsystem (all versions before 152.0.7977.65) allows an attacker who has already compromised the renderer process to bypass the web origin policy and reach privileged browser pages via a crafted HTML page. This is a chained, second-stage vulnerability - a prior renderer compromise is required - substantially narrowing the realistic attacker pool despite the network-accessible vector. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS probability of 0.24% at the 15th percentile is consistent with this chained attack profile.
Uninitialized memory in Chrome's ANGLE graphics abstraction layer, across all desktop platforms prior to version 152.0.7977.65, enables remote attackers to read cross-origin data by delivering a crafted HTML page to a victim user. The flaw breaks the browser's same-origin policy through the graphics pipeline rather than through JavaScript or DOM manipulation. No public exploit or CISA KEV listing exists; EPSS of 0.24% at the 15th percentile reflects low current exploitation pressure.
Cross-origin information leak in Google Chrome's Paint rendering component (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy by delivering a crafted HTML page. The vulnerability is confined to the confidentiality dimension - no integrity or availability impact - and requires user interaction (visiting the attacker-controlled page) to trigger. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.33% places it in the 25th percentile, indicating low exploitation probability in the near term.
Cross-origin pixel data leakage in the Canvas API of Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web same-origin policy by enticing a victim to visit a crafted HTML page. The flaw is classified High severity by the Chromium team and Medium (CVSS 4.3) by NVD, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing is identified at time of analysis, and EPSS at 0.33% indicates very low observed exploitation probability.
Incorrect authorization in Google Chrome's Transactions Platform (versions prior to 152.0.7977.65) permits a remote attacker who has already achieved renderer process compromise to bypass the browser's web origin policy via a crafted HTML page. The flaw is classified CWE-863 and carries a vendor severity of High, though the CVSS base score of 4.3 reflects the limited confidentiality-only impact and required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.24% (15th percentile) indicates low observed exploitation probability.
Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. The impact is limited to a partial confidentiality breach via cross-origin data access; no integrity or availability impact has been identified. No public exploit code exists and EPSS probability sits at 0.20% (10th percentile), indicating very low near-term exploitation likelihood despite Chromium's internal 'High' severity rating.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (versions prior to 152.0.7977.65) allows an unauthenticated remote attacker to read limited data across origin boundaries by inducing a victim to visit a crafted HTML page. The root cause is an uninitialized resource (CWE-908) in ANGLE, Chrome's graphics abstraction engine, which can expose residual GPU buffer contents from other origins. No public exploit identified at time of analysis; EPSS is low at 0.40% (33rd percentile), and the vulnerability is not listed in CISA KEV.
Information disclosure in Google Chrome's Autofill component on Android (prior to 152.0.7977.65) enables a remote attacker to extract sensitive user data - likely form-fill credentials or PII - by luring a victim to a specially crafted HTML page. The vulnerability stems from CWE-20 improper input validation in the Autofill subsystem, which fails to sanitize attacker-controlled HTML before processing it. No public exploit code or CISA KEV listing is present at time of analysis; EPSS sits at the 13th percentile, indicating low current exploitation momentum despite the high confidentiality impact.
Incorrect authorization in the Paint component of Google Chrome before version 152.0.7977.65 enables remote unauthenticated attackers to potentially bypass the Same-Origin Policy via a crafted HTML page, resulting in limited cross-origin data exposure. Exploitation requires user interaction - the victim must navigate to the attacker-controlled page - and impact is confined to partial confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and the low EPSS score of 0.24% (15th percentile) corroborates low observed exploitation activity; a vendor patch was released in the Chrome 152 stable channel.
Missing authorization in Google Chrome's Passwords component prior to version 152.0.7977.65 allows a remote attacker, who has already compromised the renderer process, to bypass web origin policy and access stored password data for other origins via a crafted HTML page combined with social engineering. The attack requires two chained prerequisites - renderer compromise and user interaction - which significantly constrains real-world exploitability despite the network-facing attack vector. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at a very low 0.24% (15th percentile). A vendor patch is available.
Cross-origin data exposure in Google Chrome's GPU component prior to version 152.0.7977.65 can be triggered by a remote attacker who has already compromised the renderer process. The vulnerability stems from an uninitialized GPU resource (CWE-908) that leaks memory contents readable across origin boundaries. Exploitation requires chaining this issue with a separate renderer compromise, significantly raising the bar; no public exploit code has been identified and EPSS probability sits at 0.40%.
Denial of service in OpenThread, the open-source Thread networking stack embedded in Google Nest devices (identified as Nest 3.78.518349), lets an attacker who has already joined the same Thread mesh send crafted Mesh Link Establishment (MLE) packets that trigger reachable assertion failures and a stack-based buffer overflow, crashing affected nodes. The flaw carries a vendor CVSS 4.0 score of 10.0, though the description scopes real-world impact to denial of service rather than the code execution the score's high confidentiality/integrity metrics would imply. There is no public exploit identified at time of analysis and it is not on CISA KEV.
Privilege escalation from userspace to kernel level is possible in Google's Fuchsia OS via a Use-After-Free condition in the Zircon kernel pager proxy component, affecting Android F30.1.1. An attacker with low-privileged code execution on the device can exploit the memory corruption flaw to gain kernel-level control, achieving full compromise of confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current active exploitation.
Path traversal in achorein expo-share-intent up to version 8.0.0 allows a local attacker to write files outside the intended cache directory by supplying a crafted `_display_name` value during Android file sharing operations. The `getDataColumn` function in `ExpoShareIntentModule.kt` constructed file paths directly from the unvalidated content-provider display name, enabling directory escape via sequences such as `../../`. No public exploit code has been identified and this vulnerability is not listed in CISA KEV; a vendor-released patch (v8.0.1) resolves the issue.
Memory disclosure outside the Chrome renderer sandbox is possible via uninitialized GPU resource access in Google Chrome prior to 151.0.7922.169. An attacker who has already compromised the renderer process can trigger the flaw through a crafted HTML page, allowing reads of memory belonging to processes outside the sandbox boundary. No public exploit code or CISA KEV listing has been identified at time of analysis; vendor patch is confirmed available.
Skia graphics library in Google Chrome prior to 151.0.7922.169 leaks information in a way that allows remote attackers to potentially bypass the web Same-Origin Policy via a specially crafted HTML page. Affected users on all desktop platforms running any Chrome version before 151.0.7922.169 are exposed to cross-origin data disclosure triggered by visiting a malicious page. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Incorrect reference resolution in the Core component of Google Chrome on Android exposes sensitive information to remote attackers who can socially engineer users into visiting a malicious HTML page. Affected versions are all Chrome for Android builds prior to 151.0.7922.169. Exploitation requires user interaction but no authentication, and the vulnerability is platform-specific to Android. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Site isolation bypass in Google Chrome prior to 151.0.7922.169 enables a renderer-compromised attacker to cross origin boundaries via a flawed CORS implementation, reading or modifying data from otherwise isolated sites. This is a chained exploitation scenario: it requires a preceding renderer compromise as a prerequisite, making it a sandbox-escape-class vulnerability rather than a standalone browser attack. No public exploit code or active exploitation has been identified at the time of analysis, and a vendor patch is available in the 151.0.7922.169 stable channel release.
Froxlor's standalone AJAX endpoint (lib/ajax.php) entirely bypasses the CSRF token enforcement present in lib/init.php, allowing a remote attacker to forge state-changing POST requests on behalf of any authenticated administrator who visits a malicious page. Successful exploitation modifies administrator API key properties - specifically injecting the attacker's IP into the allowed_from whitelist and setting valid_until to -1 (never expires) - creating a persistent foothold for future API abuse if the API secret is later obtained. A working proof-of-concept HTML page is included in the public GitHub security advisory (GHSA-xpr4-8vp6-c87j); no CISA KEV listing found at time of analysis. EPSS data was not provided, but the UI:R requirement and niche product footprint constrain real-world exploitation.
SSRF port restriction bypass in MobSF (Mobile Security Framework) prior to 4.5.1 allows authenticated high-privilege users to cause the server to make outbound HTTP requests to attacker-selected non-standard ports by uploading a crafted APK. The `get_browsable_activities()` function in `manifest_analysis.py` validates only the `android:host` attribute via `valid_host()`, which enforces a 80/443-only port allowlist, but then appends the separately supplied `android:port` attribute to the assembled URL without re-validating the combined result - enabling port restriction bypass. When combined with DNS rebinding between the validation lookup and the `requests.get()` connection, the outbound request can reach internal services; however, the path is fixed to `/.well-known/assetlinks.json` and redirects are disabled. No public exploit has been identified at time of analysis, and the vulnerability is not in CISA KEV.
Arbitrary file read via path traversal in MobSF prior to 4.5.1 allows authenticated users with scan-upload permissions to exfiltrate server-side files by embedding traversal sequences in the android:icon attribute of a crafted AndroidManifest.xml inside a ZIP or APK upload. The vulnerable find_icon_path_zip() function resolves the attacker-controlled icon path without containment checks, copies the target file to a predictable location in DWD_DIR, and exposes it through the /download/ endpoint. A fully functional proof-of-concept script is publicly available in the GHSA advisory; this issue is not listed in the CISA KEV catalog.
Clickjacking in Firefox for Android's Downloads component enables remote attackers to trick users into performing unintended download-related actions through UI redress. All Firefox for Android versions prior to 154 are affected, with the fix confirmed in Mozilla Security Advisory mfsa2026-74. No public exploit has been identified at time of analysis, and the EPSS score of 0.14% (4th percentile) reflects very low observed exploitation probability.
UI spoofing in the Downloads component of Firefox for Android allows network-accessible attackers to misrepresent critical information to users, potentially deceiving them about the nature or origin of downloaded content. Affected versions are those prior to Firefox 154 on Android, as confirmed by Mozilla's security advisory MFSA2026-74. No public exploit code exists and CISA has not added this to the KEV catalog; SSVC signals exploitation status as none with partial technical impact.
Clickjacking in Firefox for Android before version 154 allows remote unauthenticated attackers to overlay transparent or opaque UI frames over legitimate browser content, capturing user interactions intended for other elements. The CVSS vector (PR:N, UI:R, I:H) indicates no privileges are needed but a victim must interact with an attacker-controlled page, resulting in high-integrity impact through unintended user actions such as inadvertent permission grants or form submissions. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
DualSafe Password Manager & Digital Vault Extension (versions up to and including 1.4.35 for Chrome) exposes stored credentials and TOTP codes through an unauthenticated postMessage-based bridge, enabling cross-origin secret exfiltration by any webpage the victim visits. The extension's bridge component processes incoming postMessage calls without validating the sender's origin, meaning an attacker-controlled page can query the vault directly without any extension-level authentication. A publicly available proof-of-concept hosted on GitHub demonstrates the technique; the vulnerability has not been added to the CISA KEV catalog as of this analysis.
Cross-site scripting in the Alaev SEO Tools Chrome Extension (versions up to 1.0.10) exposes users to script injection via the popup UI's addDiv function, which fails to sanitize externally sourced page SEO field data before inserting it into the DOM. A working proof-of-concept exploit is publicly available on GitHub, demonstrating injection through crafted page metadata. The vendor did not respond to responsible disclosure, and no patch has been released, leaving all users of affected versions without an official fix.
Persistent ad-blocking bypass in Adblock for Youtube Extension versions up to 7.2.1 on Google Chrome allows remote web content to silently disable the extension's filtering rules by exploiting an improper authorization flaw (CWE-285) in the contentscript.js event listener. The updateDynamicRules function processes the yt-anti-adblock-detected DOM event without verifying the caller's origin or authorization, meaning any adversarial webpage can trigger the function and persistently disable ad blocking. Publicly available exploit code demonstrates this technique; the vulnerability is not listed in the CISA KEV catalog and no vendor patch exists, as the maintainer did not respond to pre-disclosure outreach.
OS command injection in android-mcp-server's `build/index.js` allows local low-privilege attackers to execute arbitrary shell commands by supplying malicious values for parameters such as `deviceId`, `packageName`, `permission`, or `extras` fields passed to the `child_process.exec()` ADB command builder. The vulnerable code interpolates user-supplied input directly into shell command strings without sanitization, making exploitation trivial for any local user with access to the MCP server process. A publicly available proof-of-concept exists via the GitHub issue tracker, and a patch commit has been published; no CISA KEV listing confirms active in-the-wild exploitation at time of analysis.
In the Linux kernel, the following vulnerability has been resolved: i2c: jz4780: Cache host clock rate at probe to prevent CCF prepare_lock deadlock Fix a severe AB/BA deadlock between the Common Clock Framework (CCF) and the I2C adapter lock, which triggers when an I2C-controlled clock generator client (like the Si5351) is registered or modified under the CCF. During an i2c client clock (generator) frequency change, the CCF acquires its global 'prepare_lock' mutex and the driver calls i2c_transfer() to update the client's chip registers, stalling for the adapter's I2C bus lock. Concurrently, an independent, parallel transfer on the same bus (e.g., a GPIO expander handling LEDs) can hold the I2C adapter lock. Inside this parallel transfer path, jz4780_i2c_set_speed() calls clk_get_rate() on the host controller's input clock to calculate bus timings. This call attempts to acquire the blocked CCF 'prepare_lock', creating a circular dependency that freezes the system. The jz4780 host controller clock itself is static and never changes at runtime. However, calling clk_get_rate() inside the active transfer path introduces an unnecessary dependency on the CCF internal locks. Eliminate this synchronous clk_get_rate() call from the active transfer path by caching the static host peripheral clock rate once - inside the private jz4780_i2c structure during jz4780_i2c_probe(). Update jz4780_i2c_set_speed() to use this cached value, safely decoupling active I2C transactions from the CCF internal locks without any risk of stale timings. Assisted-by web based Google AI (pinpointing the bug and writing the message).
Cross-site request forgery in Emlog 2.6.26 and earlier allows a remote unauthenticated attacker to execute arbitrary SQL against the site's database by tricking a recently logged-in administrator into visiting an attacker-controlled page. The missing CSRF token on the AI Assistant's execute_tool action in admin/ai.php, combined with an absent SameSite cookie attribute exploitable via Chrome's Lax+POST grace window, permits full database read across all tables and write access to all tables except blog - sufficient to overwrite the user table and seize administrator account control. No patch is available as of this review, no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
Stored cross-site scripting in the Embed Google Photos album WordPress plugin (all versions through 2.2.1) allows authenticated Contributor-role users to inject arbitrary JavaScript via an unescaped shortcode attribute rendered directly into an HTML attribute context. The injected script executes silently in the browser of any user who views the affected post, including administrators, enabling session hijacking and potential full site takeover. No public exploit code has been identified at time of analysis, and the EPSS score of 0.16% (6th percentile) reflects negligible current exploitation activity.
Local privilege escalation in Palo Alto Networks GlobalProtect app (Windows, macOS, and Linux) allows any local non-administrative user to gain NT AUTHORITY\SYSTEM on Windows or root on macOS and Linux via CWE-426 (Untrusted Search Path), enabling arbitrary command execution at the highest OS privilege level. The vulnerability is confirmed by Palo Alto Networks in their own advisory and affects desktop platforms only - iOS, Android, and Chrome OS are explicitly excluded. No public exploit code or active exploitation is confirmed at time of analysis; the CVSS 4.0 score of 5.9 Medium reflects the local-only attack vector requirement.
Remote code execution in Palo Alto Networks GlobalProtect app on Windows allows a network-adjacent man-in-the-middle attacker to execute arbitrary code with SYSTEM privileges by exploiting improper input validation in the Pre-Logon Access Provider (PLAP) component (CWE-94). Only Windows deployments with the PLAP feature configured are affected; GlobalProtect on Linux, macOS, iOS, Android, and Chrome OS is explicitly excluded from the vulnerability scope. No public exploit code exists at time of analysis and the vulnerability is not listed in the CISA KEV catalog, but the SYSTEM-level code execution outcome before user logon warrants prioritized remediation for any enterprise Windows fleet using the pre-logon VPN feature.
Improper certificate validation in Palo Alto Networks GlobalProtect app allows an unauthenticated attacker with an established man-in-the-middle network position to intercept and modify application-layer communications between the client and backend infrastructure. Affected platforms are desktop and non-mobile variants - iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected. No public exploit code has been identified and this vulnerability is not listed in CISA KEV, though the confidentiality and integrity impacts are rated High given successful interception enables full visibility and manipulation of application traffic outside the VPN tunnel.
Privilege escalation to root in Palo Alto Networks GlobalProtect App on macOS is enabled by a race condition exploitable by a locally authenticated, low-privileged user. The vulnerability is strictly macOS-specific - GlobalProtect on Linux, Windows, iOS, Android, and Chrome OS is explicitly not affected per vendor advisory. No public exploit has been identified at time of analysis, and the CVSS 4.0 score of 4.1 reflects the local, timing-dependent, and low-privilege-required nature of this attack.
Privilege escalation via an uncontrolled search path (CWE-427) in Palo Alto Networks Prisma Access Agent on Windows and macOS allows a local user to execute arbitrary code with elevated privileges. The vulnerability is platform-specific and explicitly does not affect the Linux, iOS, Android, or ChromeOS versions of the agent. No public exploit has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog; the CVSS 4.0 base score of 6.0 reflects the local-only attack vector, though the high confidentiality and integrity impact to the vulnerable system is significant for enterprise endpoint deployments.
Anti-tamper protection bypass in Palo Alto Networks Prisma Access Agent on Windows allows a local administrator to gain unauthorized access to the agent's protected processes and files, effectively disabling endpoint security enforcement. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly not impacted. No public exploit code has been identified and no active exploitation has been confirmed (CVSS E:U), keeping real-world risk constrained to insider threat and post-compromise scenarios.
Authentication bypass in the Windows network driver of Palo Alto Networks Prisma Access Agent allows a local administrator to circumvent the agent's security inspection enforcement, subsequently enabling injection and interception of arbitrary network traffic. Only the Windows platform is affected - Linux, macOS, iOS, Android, and Chrome OS deployments are explicitly confirmed unaffected by the vendor. No public exploit has been identified at time of analysis, and exploitation requires pre-existing local administrator access, significantly narrowing the realistic threat population.
Symlink-following (CWE-59) in Palo Alto Networks Prisma Access Agent on Linux allows a local low-privileged user to delete a limited set of system files and disable the agent entirely. Only Linux deployments are affected - macOS, Windows, iOS, Android, and Chrome OS are explicitly confirmed safe by the vendor. No public exploit code or active exploitation (CISA KEV) has been identified; the CVSS 4.0 supplemental vector classifies exploitation as unlikely (E:U) with Amber urgency, making this a low-priority but genuine patch target for Linux endpoint fleets.
Cross-team credential disclosure in the Apache Airflow Google Provider's Cloud Secret Manager backend exposes every team's Connections and Variables to every other team in multi-team deployments. The backend's public methods accepted a team_name parameter but silently discarded it before the internal secret lookup, collapsing all team namespaces into one shared, unscoped lookup. No public exploit has been identified at time of analysis; the vendor-released fix is apache-airflow-providers-google 22.3.0.
Session token exposure in the Mira Android app (Quanovate Tech Inc.) leaks live authentication credentials to third-party web properties and referrer logs whenever users trigger in-app WebView flows such as shop redirects. The app appends the active session token as a URL query string parameter and embeds a persistent user identifier in the WebView User-Agent header, both of which are transmitted to any destination or JavaScript context receiving that traffic. Reported by ICS-CERT under medical advisory ICSMA-26-223-01, this vulnerability affects a healthcare-adjacent platform, amplifying the sensitivity of exposed credentials; no public exploit code or CISA KEV listing has been identified at time of analysis.
Remote code execution in Microsoft Edge (Chromium-based) below version 151.0.4129.78 stems from a type confusion flaw (CWE-843) in the browser engine, exploitable over the network when a user visits or interacts with attacker-controlled content. The vendor has confirmed patch availability and the flaw is tagged as causing memory corruption, which aligns with the typical consequence of type confusion in browser engines. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, though the unauthenticated network vector with low attack complexity warrants prioritized patching in enterprise environments.
Information disclosure in Nuxt's development server exposes the project's absolute filesystem root path and a persistent per-project workspace UUID to unauthenticated LAN-adjacent attackers via the Chrome DevTools workspace endpoint. The prior security fix (GHSA-rq7w-g337-39qq) introduced a local-request gate that trusts the attacker-supplied Host header instead of the actual TCP peer address, meaning a non-browser client such as curl can bypass it by omitting Sec-Fetch-Site, Origin, and Referer headers while forging Host: localhost. Impact is confined to information disclosure; no public exploit has been independently identified at time of analysis, though the official advisory provides a working proof-of-concept curl command. Production builds are entirely unaffected.
Improper cryptographic signature verification in Estonian RIA's libdigidocpp core library and its consumer applications - DigiDoc4, DigiDoc for Android, and DigiDoc for iOS - enables bypassing of XAdES signature validity checks through unhandled exceptional conditions during BDOC container parsing. Affected versions span libdigidocpp 4.1.0-4.2.0, DigiDoc4 4.7.0-4.8.1, DigiDoc Android 2.7.0-2.7.1, and DigiDoc iOS 2.8.0, all of which have vendor-released patches. A proof-of-concept is indicated by the CVSS 4.0 E:P exploit maturity modifier, though no active exploitation has been confirmed and this CVE is not listed in CISA KEV.