Monthly
Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable through a CSS policy bypass, enabling remote unauthenticated attackers to exfiltrate data across origin boundaries when a victim visits a crafted HTML page. The root cause is improper origin validation (CWE-346) in Chrome's CSS subsystem, allowing CSS mechanisms to circumvent same-origin policy enforcement and read restricted cross-origin content. No public exploit code exists and no active exploitation has been identified; EPSS probability is 0.18% (8th percentile), consistent with the SSVC 'Exploitation: none' assessment and Chrome's own 'Low' severity designation for this issue.
Insufficient policy enforcement in the Extensions subsystem of Google Chrome prior to 151.0.7922.72 allows an attacker to bypass discretionary access controls by deploying a malicious extension that uses a specially crafted domain name. The attack is fully dependent on social engineering - the victim must be convinced to install the malicious extension, which significantly constrains opportunistic exploitation. With a CVSS score of 4.3, EPSS at 0.12% (2nd percentile), no CISA KEV listing, and a 'Low' Chromium-internal severity rating, no public exploit identified at time of analysis, this represents a minimal real-world priority for most organizations, particularly those with enterprise extension management controls in place.
Process memory leakage in Google Chrome's IME (Input Method Editor) implementation on macOS allows remote unauthenticated attackers to obtain potentially sensitive data from Chrome's process memory by luring a user to a specially crafted HTML page. The flaw affects all Chrome for Mac versions prior to 151.0.7922.72, is platform-scoped to macOS only, and carries a CVSS 6.5 (Medium) despite Chromium's own 'Low' severity designation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) allows a local attacker to circumvent browser navigation policies via a crafted HTML page. The insufficient policy enforcement within DevTools produces an integrity-high impact (CVSS I:H) without requiring attacker privileges. No public exploit code or CISA KEV listing exists; an EPSS score of 0.12% (2nd percentile) and Google's internal 'Low' Chromium severity rating together confirm this as a low immediate exploitation priority.
Information disclosure in the Views UI component of Google Chrome on macOS allows a local attacker to read potentially sensitive data from browser process memory by inducing a user to open a crafted HTML page on versions prior to 151.0.7922.72. The flaw is Mac-platform-specific, categorized by Chromium itself as Low severity, and carries no integrity or availability impact. No public exploit exists and no active exploitation has been identified; EPSS probability sits at 0.11% (2nd percentile) and CISA SSVC classifies exploitation as none.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote, unauthenticated attacker to misrepresent security-critical interface elements - such as the address bar or origin indicators - by serving a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no privileges, but does require the user to interact with the malicious page, limiting its reach. No public exploit or active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world risk at this time.
UI spoofing in Google Chrome's Passwords component allows an attacker occupying a privileged network position (man-in-the-middle) to manipulate password-related interface elements via malicious network traffic. All Chrome releases prior to 151.0.7922.72 on desktop are affected. Exploitation requires both a privileged network position and user interaction, substantially constraining real-world risk; no public exploit code exists and EPSS sits at the 2nd percentile, consistent with no observed exploitation in the wild.
Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.
Information disclosure in Google Chrome's Views UI framework on macOS prior to version 151.0.7922.72 exposes potentially sensitive data from browser process memory to local attackers. The flaw is triggered by an inappropriate implementation in the Views rendering layer, reachable via a specially crafted HTML page. No public exploit code exists and the EPSS score sits at the 2nd percentile, indicating very low observed exploitation probability; Chrome's own severity rating of 'Low' is consistent with the local-only attack vector and read-only confidentiality impact.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to deceive users by manipulating security indicators through a crafted HTML page. The vulnerability causes incorrect rendering of Chrome's browser-managed security UI elements - such as origin display or HTTPS trust badges - potentially causing victims to mistake malicious pages for legitimate or secure ones. No active exploitation has been confirmed (not in CISA KEV), EPSS at 0.17% (7th percentile) indicates low near-term exploitation probability, and a vendor-released patch is available in version 151.0.7922.72.
Domain spoofing in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading security UI indicators to users via a crafted HTML page. The flaw stems from CWE-451 - user interface misrepresentation of critical information - where Chrome's Android UI fails to accurately convey the true origin or domain of the page being visited. No public exploit code exists, EPSS sits at 0.17% (7th percentile), and SSVC confirms exploitation status as none, collectively indicating low urgency despite the broad user base.
Cross-origin data leakage in Google Chrome's SVG implementation affects all versions prior to 151.0.7922.72, exploitable by a remote attacker who can convince a user to visit a crafted HTML page. The flaw violates the browser's Same-Origin Policy via improper SVG origin validation (CWE-346), allowing an attacker's page to infer or extract data belonging to cross-origin resources the victim's browser can reach. No active exploitation has been identified - CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at a low 0.17% (7th percentile) - placing real-world urgency in the lower-priority tier despite the network attack vector.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Blink rendering engine prior to version 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML that execute across origin boundaries via a crafted HTML page. Unlike conventional XSS constrained to a single origin, this flaw bypasses the Same-Origin Policy enforced by Blink, potentially allowing script execution in the context of unrelated sites visited by the victim. No active exploitation is confirmed (absent from CISA KEV), EPSS exploitation probability is 0.17% (7th percentile), and the vendor itself classifies this as Low severity - all signals converging on low current real-world risk.
Navigation restriction bypass in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to circumvent session-based navigation controls by inducing a victim to load a crafted HTML page. The root cause is an improper access control implementation (CWE-284) specific to Chrome's Session component on the Android platform. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with only partial technical impact, consistent with the low EPSS score of 0.18%.
No-referrer policy bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to exfiltrate origin page URL information that the site operator explicitly suppressed via the Referrer-Policy header. Exploitation requires luring a victim to a crafted HTML page, classifying this as a social-engineering-dependent, low-severity integrity/confidentiality boundary failure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 8th percentile (0.18%), and SSVC rates technical impact as only partial - signaling a low operational priority despite the network attack vector.
Cross-origin data leakage in Google Chrome's network layer prior to version 151.0.7922.72 enables remote attackers to read sensitive cross-origin data by luring a victim to a crafted HTML page. Rooted in an inappropriate network implementation (CWE-346, Origin Validation Error), the flaw breaks the browser's cross-origin boundary enforcement without requiring any attacker authentication. No public exploit has been identified at time of analysis; EPSS places exploitation probability at 0.17% (7th percentile), and SSVC confirms no active exploitation, making this a low-urgency but valid information disclosure risk given Chrome's ubiquitous deployment.
UI spoofing in Google Chrome's Views component (prior to 151.0.7922.72) enables a remote unauthenticated attacker to deceive a victim about browser UI state or page origin by serving a crafted HTML page that triggers CWE-451 misrepresentation of critical interface elements. The CVSS vector (PR:N/UI:R) confirms the attack requires no authentication but does require the victim to visit the attacker-controlled page, limiting automated mass exploitation. No public exploit exists and SSVC rates current exploitation as none, with EPSS at only 0.17% (7th percentile), consistent with a low-severity, user-interaction-dependent flaw.
Cross-origin data leakage in Google Chrome's CORS implementation enables a post-exploitation information disclosure step for attackers who have already compromised the renderer process. All Chrome versions prior to 151.0.7922.72 are affected, with exploitation requiring both a pre-existing renderer compromise and user interaction with a crafted HTML page. No public exploit code exists and no CISA KEV listing; EPSS at 0.17% (7th percentile) and SSVC Exploitation: none confirm this is a low-priority, chained-attack-only vulnerability in practice.
UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) permits remote attackers to deceive users by rendering fraudulent payment-related interface elements through a specially crafted HTML page. The flaw carries a CVSS score of 4.3 and Chromium's own 'Low' severity rating, consistent with EPSS at 0.17% (7th percentile), signaling negligible real-world exploitation probability. No public exploit code exists and the vulnerability is absent from CISA's KEV catalog; Google has issued a patch in stable channel version 151.0.7922.72.
Cross-origin data leakage in Google Chrome's MHTML parser prior to version 151.0.7922.72 enables remote attackers to read data from origins they should not have access to, violating the Same-Origin Policy. The vulnerability requires user interaction - a victim must open a crafted MHTML page - and produces a limited confidentiality impact with no integrity or availability exposure. No public exploit code exists and no active exploitation has been identified; EPSS of 0.17% (7th percentile) and Chromium's own 'Low' severity rating confirm this is a low-urgency finding despite broad product deployment.
Navigation restriction bypass in Google Chrome for Android (via WebView) prior to version 151.0.7922.72 enables a remote attacker to circumvent enforced browsing policies using a crafted HTML page, achieving high integrity impact with no privileges required. The flaw resides specifically in WebView's policy enforcement layer, meaning Android applications that embed Chrome WebView and rely on its navigation restriction mechanisms for security enforcement are also at risk. No public exploit has been identified at time of analysis and EPSS stands at 0.18% (8th percentile), though the vendor has confirmed a patch and the Chromium team internally rated this Low severity - lower than the NVD CVSS 6.5 Medium assignment.
Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.
Memory disclosure in Google Chrome's Dawn WebGPU component (prior to 151.0.7922.72) enables an attacker who has already obtained code execution in the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - not a standalone exploit - requiring a prior, separate renderer compromise before this flaw is reachable. Chromium's own severity rating is Low, consistent with the EPSS score of 0.19% and SSVC classification of no active exploitation and partial technical impact; no public exploit or KEV listing exists.
UI spoofing in Google Chrome's Navigation component prior to version 151.0.7922.72 enables an attacker who has already compromised the renderer process to manipulate browser UI elements via crafted HTML pages. The Chromium team assigned Low internal severity, consistent with a CVSS score of 4.3, EPSS at the 7th percentile (0.17%), and SSVC exploitation status of 'none'. No public exploit code or active exploitation has been identified, and the vulnerability is only meaningful as a second-stage element in a multi-vulnerability attack chain.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to serve a crafted HTML page that circumvents the browser's navigation controls, resulting in limited integrity impact. The flaw is confined to Chrome's iOS-specific implementation layer (CWE-284: Improper Access Control) and is not present in Chrome on other platforms. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.18% (8th percentile), consistent with SSVC's 'exploitation: none' determination.
Content Security Policy bypass in Google Chrome's HTML parser (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to neutralize CSP protections by serving a crafted HTML page to a victim who visits it. The vulnerability stems from an inappropriate implementation in the parser component (CWE-693, Protection Mechanism Failure), earning a Chromium internal severity of Low and a CVSS base score of 4.3. No active exploitation is confirmed - CISA KEV is not listed, EPSS sits at 0.18% (8th percentile), and SSVC assesses exploitation status as none - making this a low-priority finding for most organizations despite Chrome's ubiquitous deployment footprint.
Side-channel information leakage in Google Chrome's SVG rendering engine prior to version 151.0.7922.72 allows a remote attacker to infer cross-origin data by luring a user to a crafted HTML page. Rooted in CWE-1300 (Improper Protection of Physical Side Channels), the flaw violates the browser's same-origin policy isolation by exposing measurable signals during SVG processing that reveal data from a separate origin. No public exploit has been identified, SSVC confirms exploitation status of none, and EPSS sits at 0.17% (7th percentile), placing real-world priority firmly in the low tier for most environments.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.
UI spoofing in Google Chrome's Passwords component before version 151.0.7922.72 allows remote attackers to manipulate credential-related UI elements via malicious network traffic, exploiting insufficient input validation in the password manager subsystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable without authentication but requires user interaction, limiting automated mass exploitation. With an EPSS of 0.16% (6th percentile), no KEV listing, and no known POC, real-world exploitation risk is low despite the ubiquitous deployment footprint of Chrome.
UI spoofing in Google Chrome for Android prior to version 151.0.7922.72 stems from an inappropriate FullScreen API implementation that allows remote attackers to deceive users with a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms this is network-accessible without authentication but requires user interaction with a malicious page. With an EPSS of 0.21% at the 11th percentile, no CISA KEV listing, and Chromium's own 'Low' severity designation, real-world exploitation interest is minimal and no public exploit code has been identified at time of analysis.
Navigation restriction bypass in Google Chrome's DevTools component affects all versions prior to 151.0.7922.72, allowing a remote unauthenticated attacker to circumvent navigation controls by delivering a crafted HTML page to an unsuspecting user. The root cause is improper input validation (CWE-20) within DevTools, with impact limited to integrity (I:L) and no confidentiality or availability consequence. No public exploit exists and no CISA KEV listing is present; EPSS of 0.18% (8th percentile) and Chromium's own Low severity rating together indicate minimal real-world exploitation risk.
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) permits remote attackers to circumvent browser navigation controls when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Despite a CVSS integrity impact of High, the Chromium team internally classifies this as Low severity - a meaningful signal that real-world exploitability is more constrained than the base score implies. No public exploit code or active exploitation has been identified (EPSS: 0.18%, 8th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent browser navigation controls by delivering a crafted HTML page that exploits insufficient input validation. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation contingent on user interaction, with impact limited strictly to integrity. No public exploit has been identified, EPSS sits at 0.22% (13th percentile), and Chromium's own team rated this Low severity - signals that collectively place this well below emergency response thresholds. Vendor-released patch is available in Chrome 151.0.7922.72.
Cross-origin data leakage in Google Chrome's DOMStorage component (versions prior to 151.0.7922.72) permits a remote attacker to read storage data belonging to a different origin by luring a victim to a crafted HTML page. The flaw is rooted in an origin validation error (CWE-346) within the DOMStorage subsystem, violating same-origin policy enforcement. EPSS is very low at 0.17% (7th percentile), no active exploitation is confirmed, and Chromium itself rates this Low severity, placing this in the lower tier of browser security issues despite its network-reachable attack surface.
Use-after-free in Chrome's DataTransfer component on Windows exposes process memory to local attackers who can deliver a crafted HTML page to a victim. The flaw affects all Chrome versions on Windows prior to 151.0.7922.72 and results in high-confidence confidentiality loss with no integrity or availability impact. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with CISA SSVC classifying exploitation as 'none' and technical impact as 'partial' - making this a low operational priority despite the High confidentiality CVSS sub-score.
Navigation restriction bypass in Google Chrome DevTools (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent navigation security controls by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation within the DevTools component (CWE-693, Protection Mechanism Failure), resulting in high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation status of none collectively indicate low near-term exploitation probability.
Navigation restriction bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows a remote attacker to subvert browser navigation controls by delivering a malicious file that triggers insufficient input validation. Exploitation requires user interaction (opening the crafted file), limits opportunistic mass exploitation, and impact is confined to high integrity loss with no confidentiality or availability effects. No active exploitation is confirmed - EPSS stands at 0.17% (7th percentile), and no CISA KEV listing is present - indicating low observed threat activity at time of analysis.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows remote attackers to read sensitive data from other origins by luring a victim to a crafted HTML page that abuses an inappropriate implementation in the DataTransfer API. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability effects, and Chromium's own security team rated this Low severity. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability of exploitation is very low at 0.17% (7th percentile).
DevTools policy enforcement failure in Google Chrome prior to 151.0.7922.72 enables cross-origin data leakage through a malicious Chrome Extension that a victim is socially engineered into installing. The vulnerability is classified as information disclosure only (C:L/I:N/A:N), requires active user participation to exploit, and carries Chromium's lowest internal severity rating. No public exploit code exists and no active exploitation has been identified; EPSS places this at the 2nd percentile, and SSVC confirms exploitation status as none with non-automatable delivery.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) enables remote attackers to circumvent Chrome's browsing navigation policies via a crafted HTML page. Exploitation requires convincing a victim to perform specific UI gestures, confining the attack surface to social engineering scenarios. The Chromium team internally rates this Low severity; the CVSS 6.5 score reflects the high integrity impact of policy bypass if interaction is achieved, but EPSS at 0.18% (8th percentile) and no KEV listing confirm low real-world exploitation probability. No public exploit or POC has been identified at time of analysis.
Same-origin policy bypass in the Cast component of Google Chrome on Android prior to 151.0.7922.72 allows a remote, unauthenticated attacker to perform cross-origin write operations by luring a user to a crafted HTML page. The vulnerability stems from an origin validation error (CWE-346) in Chrome's Cast media-streaming feature, exclusive to the Android platform. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.18% (8th percentile) reflects low real-world exploitation probability consistent with the vendor's own 'Low' Chromium severity rating.
Navigation restriction bypass in Google Chrome Enterprise (versions prior to 151.0.7922.72) enables a remote attacker to circumvent administrator-configured policy controls by supplying a crafted domain name, fully defeating enterprise navigation enforcement with high integrity impact. The vulnerability is Enterprise-specific, requiring user interaction to trigger (UI:R), and is limited to deployments using Chrome managed policies for domain-level access control. No public exploit has been identified at time of analysis, and no active exploitation is confirmed; EPSS is 0.17% (7th percentile) and SSVC rates exploitation as none, consistent with low urgency despite the CVSS 6.5 Medium score.
Navigation restriction bypass in Google Chrome prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to circumvent navigation controls via a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) records high integrity impact with no confidentiality or availability loss, reflecting the attacker's ability to redirect or manipulate navigation to otherwise restricted contexts. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) and Chromium's own internal severity rating of Low collectively indicate minimal real-world exploitation probability despite the Medium NVD score.
Privilege escalation in Google Chrome Enterprise on macOS allows a local attacker with physical device access to bypass enterprise policy controls and gain elevated privileges. Affected are all Chrome versions prior to 151.0.7922.72 in managed Enterprise deployments on Mac. The attack requires physical presence at the target device, substantially limiting the threat surface, though the confidentiality, integrity, and availability impact is rated high once exploited. No public exploit identified at time of analysis.
Insufficient policy enforcement in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to bypass discretionary access controls (CWE-284) by delivering a crafted HTML page to a victim, resulting in high integrity impact with no confidentiality or availability consequence. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no attacker privileges needed, though user interaction is required. With EPSS at 0.18% (8th percentile), SSVC exploitation classified as none, and no public exploit identified at time of analysis, real-world mass exploitation risk is low despite the meaningful integrity bypass potential on a widely-used mobile browser.
UI spoofing in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker to mislead users about the origin or security context of displayed content via a crafted HTML page. Classified by Chromium as Low severity and rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could be leveraged to facilitate phishing or social engineering by making malicious content visually indistinguishable from trusted interfaces. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating this is a routine patch-cycle issue rather than an active threat.
Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.
UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to redirect users to unintended URLs via a crafted HTML page, exploiting a CWE-601 open redirect condition. The Chromium team rated this Low severity, consistent with the CVSS 4.3 score and the limited integrity-only impact (no confidentiality or availability consequences). No public exploit identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation interest from the threat actor community.
Cross-origin data leakage in Google Chrome versions prior to 151.0.7922.72 stems from insufficient policy enforcement in the SVG rendering engine, allowing remote attackers to read data across origin boundaries by enticing a victim to visit a crafted HTML page. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation but mandates active user interaction, constraining mass exploitation. No public exploit has been identified at time of analysis; EPSS stands at 0.17% (7th percentile) and SSVC signals exploitation status of none, placing this firmly in routine-patch priority.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the browser's Web NFC API, classified under CWE-346 (Origin Validation Error). A remote attacker can serve a crafted HTML page that - when visited by a victim on an Android device - causes Chrome to violate its cross-origin isolation policy via the NFC subsystem, exposing cross-origin data to the attacker-controlled page. No public exploit has been identified at time of analysis; EPSS is 0.17% (7th percentile) and CISA SSVC rates exploitation as none, confirming low real-world urgency despite the network-accessible vector.
Cross-origin data leakage in Google Chrome's Isolated Web Apps (IWA) feature, versions prior to 151.0.7922.72, enables remote attackers to exfiltrate data across origin boundaries via crafted network traffic, contingent on user interaction. With an EPSS of 0.16% (6th percentile), no CISA KEV listing, and Chromium's own 'Low' severity classification, real-world exploitation risk is constrained despite the network-accessible vector. No public exploit has been identified at time of analysis, and impact is limited to partial confidentiality loss with no integrity or availability consequence.
Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.
Side-channel information leakage in Google Chrome's Network component prior to version 151.0.7922.72 enables remote attackers to infer cross-origin data by directing users to a crafted HTML page, violating Same-Origin Policy boundaries at the side-channel layer. The Chromium team rated this Low severity internally; with no public exploit code and no CISA KEV listing, the EPSS score of 0.17% (7th percentile) confirms that near-term mass exploitation is highly unlikely. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequences, making this a low-urgency patch for most environments, though higher priority in privacy-sensitive or intelligence-adjacent deployments.
Sandbox escape in Google Chrome's Bluetooth component (all versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox by sending crafted Bluetooth IPC messages triggered via a malicious HTML page. This is a second-stage, chained exploit - not a standalone remote attack - requiring prior renderer compromise as a hard prerequisite, which is why Chromium rates it Low severity internally despite the sandbox escape classification. No public exploit code or CISA KEV listing has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability consistent with the high attack chain complexity.
SurfaceCapture in Google Chrome prior to 151.0.7922.72 leaks cross-origin data to remote attackers through a crafted HTML page, violating browser same-origin isolation. The flaw is classified as CWE-346 (Origin Validation Error), meaning the SurfaceCapture subsystem fails to properly enforce origin boundaries, allowing data from one origin to be read by another. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the NFC subsystem, enabling a remote attacker to read data across origin boundaries. An unauthenticated attacker (per PR:N in the CVSS vector) can serve a crafted HTML page that, when visited by a target on Android Chrome, bypasses same-origin policy checks tied to NFC API handling, resulting in limited confidentiality disclosure. No active exploitation has been identified at time of analysis, EPSS sits at 0.17% (7th percentile), and Chromium itself rates this Low severity - placing real-world risk well below its nominal network-accessible footprint.
Insufficient policy enforcement in the Chromecast component of Google Chrome prior to 151.0.7922.72 enables an adjacent-network attacker to inject malicious scripts or HTML into a privileged browser page by sending crafted network traffic on the local network segment. The flaw is classified CWE-79 (Cross-Site Scripting), meaning attacker-controlled content executes in a privileged Chrome page context without requiring authentication or victim interaction. No public exploit code has been identified and EPSS is extremely low at 0.11% (2nd percentile), consistent with Chromium's own Low severity rating; a vendor patch is available.
Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.
Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient input validation in the Sharing component, enabling a remote attacker to circumvent Chrome's navigation controls via malicious network traffic when a user interacts with the Share feature. The flaw yields limited integrity impact only - no confidentiality or availability compromise - consistent with Chromium's own 'Low' severity classification and an EPSS of 0.17% (7th percentile). No public exploit code exists and no active exploitation has been confirmed; a vendor-released patch is available.
Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable by remote unauthenticated attackers who can lure a victim to a crafted HTML page that abuses an inappropriate implementation in Chrome's Opaque Response Blocking (ORB) mechanism. ORB is specifically designed to prevent unauthorized cross-origin reads; this flaw undermines that protection, allowing an attacker's page to read data belonging to a different origin in violation of the same-origin policy. EPSS is 0.18% (8th percentile), SSVC classifies exploitation as none, and no active exploitation or public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's DataTransfer API implementation (prior to 151.0.7922.72) allows a remote unauthenticated attacker to read sensitive data from a different origin when a victim performs specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. The vulnerability is rated CVSS 4.3 (Medium) with an EPSS probability of just 0.18% (8th percentile), indicating very low observed exploitation activity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but Chrome's widespread deployment makes even medium-severity browser flaws worth prioritizing for rapid patching.
Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.
Memory disclosure in Google Chrome's WebXR implementation allows remote attackers to read sensitive data from process memory by directing a victim to a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on desktop platforms. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current exploitation activity, making this a moderate-priority patching item despite the High confidentiality impact in the CVSS score.
Sandbox escape in Google Chrome's ANGLE graphics layer on Android enables an attacker who has already compromised the renderer process to break out of the Chrome sandbox via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. This is a second-stage exploit primitive requiring a prior renderer compromise; no public exploit code exists and SSVC reports exploitation as none, keeping real-world risk moderate despite the scope-change nature of the flaw.
Sandbox escape in Google Chrome DevTools prior to version 151.0.7922.72 requires a pre-compromised renderer process and user interaction with a crafted HTML page to break out of the browser sandbox. The root cause is insufficient input validation (CWE-20) in the DevTools component, where attacker-controlled input from the renderer is not properly sanitized before being processed. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.18%, indicating low observed exploitation pressure despite the meaningful impact of a successful sandbox escape.
Cross-origin data leakage in Google Chrome's WebXR implementation (versions prior to 151.0.7922.72) arises from an uninitialized memory use flaw exploitable by a remote attacker via a crafted HTML page that must be visited by the victim. The flaw allows partial disclosure of cross-origin data, with no integrity or availability impact. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.20% at the 10th percentile confirms this is a low-probability exploitation target in the near term.
Cross-origin data leakage in Google Chrome's Paint subsystem (all versions prior to 151.0.7922.72) allows a remote attacker to read data belonging to other web origins by delivering a crafted HTML page to a victim. The root cause is an origin validation error (CWE-346) in the Paint rendering component, permitting cross-origin information to surface where it should be isolated. No public exploit code exists and EPSS registers 0.18% (8th percentile), confirming low exploitation probability - this is a medium-severity patch-cycle priority, not an emergency.
Same-Origin Policy bypass in Google Chrome's Headless component prior to version 151.0.7922.72 allows remote attackers to perform unauthorized cross-origin integrity violations via a specially crafted HTML page. The flaw (CWE-346, Origin Validation Error) is specific to Chrome's Headless rendering mode and requires the victim to interact with attacker-controlled HTML (UI:R per CVSS). No public exploit code or CISA KEV listing has been identified; EPSS at 0.19% (9th percentile) reflects low near-term exploitation probability, though the zero-authentication requirement and low attack complexity elevate the concern for environments where Headless Chrome processes untrusted input.
Policy bypass in the Extensions subsystem of Google Chrome (all versions prior to 151.0.7922.72) allows site isolation circumvention when a user is convinced to install a crafted malicious extension. The CVSS vector (I:H, S:U) and CWE-693 indicate this is a protection mechanism failure that undermines Chrome's cross-origin boundary enforcement, potentially enabling manipulation of content across isolated sites. No public exploit has been identified at time of analysis; EPSS at 0.12% (3rd percentile) reflects low current exploitation probability, and CISA KEV listing is absent.
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) can be triggered remotely by luring a victim to a crafted HTML page, exposing data that should be isolated under the Same-Origin Policy. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's Autofill implementation fails to properly enforce cross-origin boundaries when processing form data. No public exploit exists and the EPSS score of 0.22% (12th percentile) reflects low near-term exploitation likelihood; the issue is patched in the stable channel release 151.0.7922.72.
Cross-origin data leakage in Google Chrome's Autofill subsystem (versions prior to 151.0.7922.72) enables remote attackers to extract sensitive cross-origin information by directing a user to a specially crafted HTML page. The root cause is an inappropriate implementation within Autofill that fails to enforce proper origin boundaries (CWE-346), allowing page-level interactions to surface data from contexts the page should not be able to read. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.22% (12th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation allows remote attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. All Chrome versions prior to 151.0.7922.72 on all platforms are affected. An unauthenticated remote attacker can bypass the browser's same-origin policy, enabling script execution in the context of third-party origins visited by the victim. No public exploit identified at time of analysis and EPSS sits at 0.18% (8th percentile), suggesting limited active exploitation pressure despite the broad attack surface of a ubiquitous browser.
Cross-origin data leakage in Google Chrome's Payments component (all versions prior to 151.0.7922.72) enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is an inappropriate implementation in the Payments subsystem (CWE-346: Origin Validation Error), violating the browser's same-origin policy for payment-related data flows. EPSS is 0.18% (8th percentile) and no CISA KEV listing or public exploit has been identified, indicating low exploitation probability despite ubiquitous product deployment.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.
Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), enabling a remote attacker to exfiltrate limited cross-origin credential-related data via a crafted HTML page. Exploitation requires the target user to perform specific, undisclosed UI gestures - such as interacting with a password field or autofill prompt - on the attacker's page, limiting mass-scale automation. No public exploit code or CISA KEV listing exists; EPSS at 0.18% (8th percentile) confirms low real-world exploitation probability, consistent with the mandatory social-engineering prerequisite.
Cross-origin data leakage in Google Chrome's Cast component allows an unauthenticated attacker positioned on the same local network segment to read data from origins they should not have access to via maliciously crafted network traffic. All Chrome versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA has not listed this in the KEV catalog, placing real-world risk at low-to-moderate despite the unauthenticated attack vector.
Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.
Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.
Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.
Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.
Cross-origin data leakage in Google Chrome prior to version 151.0.7922.72 allows remote attackers to read data across origin boundaries by inducing a user to visit a specially crafted HTML page. The flaw resides in Chrome's network layer and is classified as CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce origin boundaries during certain network operations. No active exploitation has been confirmed (not in CISA KEV), and EPSS places exploitation probability at 0.18% (8th percentile), indicating low current threat activity despite widespread browser deployment.
Same-origin policy bypass in Google Chrome's WebMCP component (prior to 151.0.7922.72) enables a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page, requiring only that a victim visit the malicious page. The root cause is insufficient policy enforcement in the WebMCP subsystem, classified by Chromium's security team as Medium severity (CWE-346: Origin Validation Error). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.19% (9th percentile) corroborates low current threat activity.
Script and HTML injection into privileged DevTools pages in Google Chrome prior to 151.0.7922.72 is enabled when an attacker has already compromised the renderer process, exploiting an inappropriate implementation in DevTools (CWE-79). The vulnerability requires chaining with a prior renderer exploit: alone it cannot be triggered by a remote unauthenticated attacker without that precondition, making it a sandbox-escape amplifier rather than a standalone remote attack. EPSS is 0.18% (8th percentile), no public exploit has been identified, and it does not appear in CISA KEV, reflecting low observed exploitation pressure despite the Medium CVSS rating.
Same-origin policy bypass in Google Chrome's Media Router component allows a remote attacker to violate cross-origin integrity guarantees by luring a user to a crafted HTML page. Affected are all Chrome versions prior to 151.0.7922.72 across desktop platforms. No public exploit or active exploitation has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low observed exploitation activity; however, the high integrity impact (I:H) and no-privilege-required attack path make patching a meaningful priority for browser-fleet administrators.
Side-channel information leakage in Chrome's Autofill component exposes cross-origin data to remote attackers who have already achieved renderer process compromise. All Chrome versions prior to 151.0.7922.72 are affected across all platforms. With an EPSS of 0.22% (12th percentile), no CISA KEV listing, and a mandatory renderer-compromise prerequisite, real-world exploitation risk is substantially lower than the CVSS base score implies - this is a chained second-stage disclosure, not a standalone attack. No public exploit identified at time of analysis.
Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable through a CSS policy bypass, enabling remote unauthenticated attackers to exfiltrate data across origin boundaries when a victim visits a crafted HTML page. The root cause is improper origin validation (CWE-346) in Chrome's CSS subsystem, allowing CSS mechanisms to circumvent same-origin policy enforcement and read restricted cross-origin content. No public exploit code exists and no active exploitation has been identified; EPSS probability is 0.18% (8th percentile), consistent with the SSVC 'Exploitation: none' assessment and Chrome's own 'Low' severity designation for this issue.
Insufficient policy enforcement in the Extensions subsystem of Google Chrome prior to 151.0.7922.72 allows an attacker to bypass discretionary access controls by deploying a malicious extension that uses a specially crafted domain name. The attack is fully dependent on social engineering - the victim must be convinced to install the malicious extension, which significantly constrains opportunistic exploitation. With a CVSS score of 4.3, EPSS at 0.12% (2nd percentile), no CISA KEV listing, and a 'Low' Chromium-internal severity rating, no public exploit identified at time of analysis, this represents a minimal real-world priority for most organizations, particularly those with enterprise extension management controls in place.
Process memory leakage in Google Chrome's IME (Input Method Editor) implementation on macOS allows remote unauthenticated attackers to obtain potentially sensitive data from Chrome's process memory by luring a user to a specially crafted HTML page. The flaw affects all Chrome for Mac versions prior to 151.0.7922.72, is platform-scoped to macOS only, and carries a CVSS 6.5 (Medium) despite Chromium's own 'Low' severity designation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) allows a local attacker to circumvent browser navigation policies via a crafted HTML page. The insufficient policy enforcement within DevTools produces an integrity-high impact (CVSS I:H) without requiring attacker privileges. No public exploit code or CISA KEV listing exists; an EPSS score of 0.12% (2nd percentile) and Google's internal 'Low' Chromium severity rating together confirm this as a low immediate exploitation priority.
Information disclosure in the Views UI component of Google Chrome on macOS allows a local attacker to read potentially sensitive data from browser process memory by inducing a user to open a crafted HTML page on versions prior to 151.0.7922.72. The flaw is Mac-platform-specific, categorized by Chromium itself as Low severity, and carries no integrity or availability impact. No public exploit exists and no active exploitation has been identified; EPSS probability sits at 0.11% (2nd percentile) and CISA SSVC classifies exploitation as none.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote, unauthenticated attacker to misrepresent security-critical interface elements - such as the address bar or origin indicators - by serving a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no privileges, but does require the user to interact with the malicious page, limiting its reach. No public exploit or active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world risk at this time.
UI spoofing in Google Chrome's Passwords component allows an attacker occupying a privileged network position (man-in-the-middle) to manipulate password-related interface elements via malicious network traffic. All Chrome releases prior to 151.0.7922.72 on desktop are affected. Exploitation requires both a privileged network position and user interaction, substantially constraining real-world risk; no public exploit code exists and EPSS sits at the 2nd percentile, consistent with no observed exploitation in the wild.
Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.
Information disclosure in Google Chrome's Views UI framework on macOS prior to version 151.0.7922.72 exposes potentially sensitive data from browser process memory to local attackers. The flaw is triggered by an inappropriate implementation in the Views rendering layer, reachable via a specially crafted HTML page. No public exploit code exists and the EPSS score sits at the 2nd percentile, indicating very low observed exploitation probability; Chrome's own severity rating of 'Low' is consistent with the local-only attack vector and read-only confidentiality impact.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to deceive users by manipulating security indicators through a crafted HTML page. The vulnerability causes incorrect rendering of Chrome's browser-managed security UI elements - such as origin display or HTTPS trust badges - potentially causing victims to mistake malicious pages for legitimate or secure ones. No active exploitation has been confirmed (not in CISA KEV), EPSS at 0.17% (7th percentile) indicates low near-term exploitation probability, and a vendor-released patch is available in version 151.0.7922.72.
Domain spoofing in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading security UI indicators to users via a crafted HTML page. The flaw stems from CWE-451 - user interface misrepresentation of critical information - where Chrome's Android UI fails to accurately convey the true origin or domain of the page being visited. No public exploit code exists, EPSS sits at 0.17% (7th percentile), and SSVC confirms exploitation status as none, collectively indicating low urgency despite the broad user base.
Cross-origin data leakage in Google Chrome's SVG implementation affects all versions prior to 151.0.7922.72, exploitable by a remote attacker who can convince a user to visit a crafted HTML page. The flaw violates the browser's Same-Origin Policy via improper SVG origin validation (CWE-346), allowing an attacker's page to infer or extract data belonging to cross-origin resources the victim's browser can reach. No active exploitation has been identified - CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at a low 0.17% (7th percentile) - placing real-world urgency in the lower-priority tier despite the network attack vector.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Blink rendering engine prior to version 151.0.7922.72 enables remote attackers to inject arbitrary scripts or HTML that execute across origin boundaries via a crafted HTML page. Unlike conventional XSS constrained to a single origin, this flaw bypasses the Same-Origin Policy enforced by Blink, potentially allowing script execution in the context of unrelated sites visited by the victim. No active exploitation is confirmed (absent from CISA KEV), EPSS exploitation probability is 0.17% (7th percentile), and the vendor itself classifies this as Low severity - all signals converging on low current real-world risk.
Navigation restriction bypass in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to circumvent session-based navigation controls by inducing a victim to load a crafted HTML page. The root cause is an improper access control implementation (CWE-284) specific to Chrome's Session component on the Android platform. No public exploit has been identified at time of analysis, and CISA's SSVC framework rates exploitation as none with only partial technical impact, consistent with the low EPSS score of 0.18%.
No-referrer policy bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote, unauthenticated attacker to exfiltrate origin page URL information that the site operator explicitly suppressed via the Referrer-Policy header. Exploitation requires luring a victim to a crafted HTML page, classifying this as a social-engineering-dependent, low-severity integrity/confidentiality boundary failure. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 8th percentile (0.18%), and SSVC rates technical impact as only partial - signaling a low operational priority despite the network attack vector.
Cross-origin data leakage in Google Chrome's network layer prior to version 151.0.7922.72 enables remote attackers to read sensitive cross-origin data by luring a victim to a crafted HTML page. Rooted in an inappropriate network implementation (CWE-346, Origin Validation Error), the flaw breaks the browser's cross-origin boundary enforcement without requiring any attacker authentication. No public exploit has been identified at time of analysis; EPSS places exploitation probability at 0.17% (7th percentile), and SSVC confirms no active exploitation, making this a low-urgency but valid information disclosure risk given Chrome's ubiquitous deployment.
UI spoofing in Google Chrome's Views component (prior to 151.0.7922.72) enables a remote unauthenticated attacker to deceive a victim about browser UI state or page origin by serving a crafted HTML page that triggers CWE-451 misrepresentation of critical interface elements. The CVSS vector (PR:N/UI:R) confirms the attack requires no authentication but does require the victim to visit the attacker-controlled page, limiting automated mass exploitation. No public exploit exists and SSVC rates current exploitation as none, with EPSS at only 0.17% (7th percentile), consistent with a low-severity, user-interaction-dependent flaw.
Cross-origin data leakage in Google Chrome's CORS implementation enables a post-exploitation information disclosure step for attackers who have already compromised the renderer process. All Chrome versions prior to 151.0.7922.72 are affected, with exploitation requiring both a pre-existing renderer compromise and user interaction with a crafted HTML page. No public exploit code exists and no CISA KEV listing; EPSS at 0.17% (7th percentile) and SSVC Exploitation: none confirm this is a low-priority, chained-attack-only vulnerability in practice.
UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) permits remote attackers to deceive users by rendering fraudulent payment-related interface elements through a specially crafted HTML page. The flaw carries a CVSS score of 4.3 and Chromium's own 'Low' severity rating, consistent with EPSS at 0.17% (7th percentile), signaling negligible real-world exploitation probability. No public exploit code exists and the vulnerability is absent from CISA's KEV catalog; Google has issued a patch in stable channel version 151.0.7922.72.
Cross-origin data leakage in Google Chrome's MHTML parser prior to version 151.0.7922.72 enables remote attackers to read data from origins they should not have access to, violating the Same-Origin Policy. The vulnerability requires user interaction - a victim must open a crafted MHTML page - and produces a limited confidentiality impact with no integrity or availability exposure. No public exploit code exists and no active exploitation has been identified; EPSS of 0.17% (7th percentile) and Chromium's own 'Low' severity rating confirm this is a low-urgency finding despite broad product deployment.
Navigation restriction bypass in Google Chrome for Android (via WebView) prior to version 151.0.7922.72 enables a remote attacker to circumvent enforced browsing policies using a crafted HTML page, achieving high integrity impact with no privileges required. The flaw resides specifically in WebView's policy enforcement layer, meaning Android applications that embed Chrome WebView and rely on its navigation restriction mechanisms for security enforcement are also at risk. No public exploit has been identified at time of analysis and EPSS stands at 0.18% (8th percentile), though the vendor has confirmed a patch and the Chromium team internally rated this Low severity - lower than the NVD CVSS 6.5 Medium assignment.
Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.
Memory disclosure in Google Chrome's Dawn WebGPU component (prior to 151.0.7922.72) enables an attacker who has already obtained code execution in the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - not a standalone exploit - requiring a prior, separate renderer compromise before this flaw is reachable. Chromium's own severity rating is Low, consistent with the EPSS score of 0.19% and SSVC classification of no active exploitation and partial technical impact; no public exploit or KEV listing exists.
UI spoofing in Google Chrome's Navigation component prior to version 151.0.7922.72 enables an attacker who has already compromised the renderer process to manipulate browser UI elements via crafted HTML pages. The Chromium team assigned Low internal severity, consistent with a CVSS score of 4.3, EPSS at the 7th percentile (0.17%), and SSVC exploitation status of 'none'. No public exploit code or active exploitation has been identified, and the vulnerability is only meaningful as a second-stage element in a multi-vulnerability attack chain.
Navigation restriction bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to serve a crafted HTML page that circumvents the browser's navigation controls, resulting in limited integrity impact. The flaw is confined to Chrome's iOS-specific implementation layer (CWE-284: Improper Access Control) and is not present in Chrome on other platforms. No public exploit code has been identified at time of analysis, and EPSS exploitation probability is very low at 0.18% (8th percentile), consistent with SSVC's 'exploitation: none' determination.
Content Security Policy bypass in Google Chrome's HTML parser (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to neutralize CSP protections by serving a crafted HTML page to a victim who visits it. The vulnerability stems from an inappropriate implementation in the parser component (CWE-693, Protection Mechanism Failure), earning a Chromium internal severity of Low and a CVSS base score of 4.3. No active exploitation is confirmed - CISA KEV is not listed, EPSS sits at 0.18% (8th percentile), and SSVC assesses exploitation status as none - making this a low-priority finding for most organizations despite Chrome's ubiquitous deployment footprint.
Side-channel information leakage in Google Chrome's SVG rendering engine prior to version 151.0.7922.72 allows a remote attacker to infer cross-origin data by luring a user to a crafted HTML page. Rooted in CWE-1300 (Improper Protection of Physical Side Channels), the flaw violates the browser's same-origin policy isolation by exposing measurable signals during SVG processing that reveal data from a separate origin. No public exploit has been identified, SSVC confirms exploitation status of none, and EPSS sits at 0.17% (7th percentile), placing real-world priority firmly in the low tier for most environments.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.
UI spoofing in Google Chrome's Passwords component before version 151.0.7922.72 allows remote attackers to manipulate credential-related UI elements via malicious network traffic, exploiting insufficient input validation in the password manager subsystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable without authentication but requires user interaction, limiting automated mass exploitation. With an EPSS of 0.16% (6th percentile), no KEV listing, and no known POC, real-world exploitation risk is low despite the ubiquitous deployment footprint of Chrome.
UI spoofing in Google Chrome for Android prior to version 151.0.7922.72 stems from an inappropriate FullScreen API implementation that allows remote attackers to deceive users with a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms this is network-accessible without authentication but requires user interaction with a malicious page. With an EPSS of 0.21% at the 11th percentile, no CISA KEV listing, and Chromium's own 'Low' severity designation, real-world exploitation interest is minimal and no public exploit code has been identified at time of analysis.
Navigation restriction bypass in Google Chrome's DevTools component affects all versions prior to 151.0.7922.72, allowing a remote unauthenticated attacker to circumvent navigation controls by delivering a crafted HTML page to an unsuspecting user. The root cause is improper input validation (CWE-20) within DevTools, with impact limited to integrity (I:L) and no confidentiality or availability consequence. No public exploit exists and no CISA KEV listing is present; EPSS of 0.18% (8th percentile) and Chromium's own Low severity rating together indicate minimal real-world exploitation risk.
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) permits remote attackers to circumvent browser navigation controls when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Despite a CVSS integrity impact of High, the Chromium team internally classifies this as Low severity - a meaningful signal that real-world exploitability is more constrained than the base score implies. No public exploit code or active exploitation has been identified (EPSS: 0.18%, 8th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
Navigation restriction bypass in Google Chrome's DevTools component (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent browser navigation controls by delivering a crafted HTML page that exploits insufficient input validation. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation contingent on user interaction, with impact limited strictly to integrity. No public exploit has been identified, EPSS sits at 0.22% (13th percentile), and Chromium's own team rated this Low severity - signals that collectively place this well below emergency response thresholds. Vendor-released patch is available in Chrome 151.0.7922.72.
Cross-origin data leakage in Google Chrome's DOMStorage component (versions prior to 151.0.7922.72) permits a remote attacker to read storage data belonging to a different origin by luring a victim to a crafted HTML page. The flaw is rooted in an origin validation error (CWE-346) within the DOMStorage subsystem, violating same-origin policy enforcement. EPSS is very low at 0.17% (7th percentile), no active exploitation is confirmed, and Chromium itself rates this Low severity, placing this in the lower tier of browser security issues despite its network-reachable attack surface.
Use-after-free in Chrome's DataTransfer component on Windows exposes process memory to local attackers who can deliver a crafted HTML page to a victim. The flaw affects all Chrome versions on Windows prior to 151.0.7922.72 and results in high-confidence confidentiality loss with no integrity or availability impact. No public exploit code has been identified and EPSS sits at 0.11% (2nd percentile), consistent with CISA SSVC classifying exploitation as 'none' and technical impact as 'partial' - making this a low operational priority despite the High confidentiality CVSS sub-score.
Navigation restriction bypass in Google Chrome DevTools (all versions prior to 151.0.7922.72) enables a remote attacker to circumvent navigation security controls by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation within the DevTools component (CWE-693, Protection Mechanism Failure), resulting in high integrity impact with no confidentiality or availability exposure. No public exploit has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation status of none collectively indicate low near-term exploitation probability.
Navigation restriction bypass in Google Chrome's DevTools component prior to version 151.0.7922.72 allows a remote attacker to subvert browser navigation controls by delivering a malicious file that triggers insufficient input validation. Exploitation requires user interaction (opening the crafted file), limits opportunistic mass exploitation, and impact is confined to high integrity loss with no confidentiality or availability effects. No active exploitation is confirmed - EPSS stands at 0.17% (7th percentile), and no CISA KEV listing is present - indicating low observed threat activity at time of analysis.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows remote attackers to read sensitive data from other origins by luring a victim to a crafted HTML page that abuses an inappropriate implementation in the DataTransfer API. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability effects, and Chromium's own security team rated this Low severity. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability of exploitation is very low at 0.17% (7th percentile).
DevTools policy enforcement failure in Google Chrome prior to 151.0.7922.72 enables cross-origin data leakage through a malicious Chrome Extension that a victim is socially engineered into installing. The vulnerability is classified as information disclosure only (C:L/I:N/A:N), requires active user participation to exploit, and carries Chromium's lowest internal severity rating. No public exploit code exists and no active exploitation has been identified; EPSS places this at the 2nd percentile, and SSVC confirms exploitation status as none with non-automatable delivery.
Navigation restriction bypass in Google Chrome's DevTools component (versions prior to 151.0.7922.72) enables remote attackers to circumvent Chrome's browsing navigation policies via a crafted HTML page. Exploitation requires convincing a victim to perform specific UI gestures, confining the attack surface to social engineering scenarios. The Chromium team internally rates this Low severity; the CVSS 6.5 score reflects the high integrity impact of policy bypass if interaction is achieved, but EPSS at 0.18% (8th percentile) and no KEV listing confirm low real-world exploitation probability. No public exploit or POC has been identified at time of analysis.
Same-origin policy bypass in the Cast component of Google Chrome on Android prior to 151.0.7922.72 allows a remote, unauthenticated attacker to perform cross-origin write operations by luring a user to a crafted HTML page. The vulnerability stems from an origin validation error (CWE-346) in Chrome's Cast media-streaming feature, exclusive to the Android platform. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.18% (8th percentile) reflects low real-world exploitation probability consistent with the vendor's own 'Low' Chromium severity rating.
Navigation restriction bypass in Google Chrome Enterprise (versions prior to 151.0.7922.72) enables a remote attacker to circumvent administrator-configured policy controls by supplying a crafted domain name, fully defeating enterprise navigation enforcement with high integrity impact. The vulnerability is Enterprise-specific, requiring user interaction to trigger (UI:R), and is limited to deployments using Chrome managed policies for domain-level access control. No public exploit has been identified at time of analysis, and no active exploitation is confirmed; EPSS is 0.17% (7th percentile) and SSVC rates exploitation as none, consistent with low urgency despite the CVSS 6.5 Medium score.
Navigation restriction bypass in Google Chrome prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to circumvent navigation controls via a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) records high integrity impact with no confidentiality or availability loss, reflecting the attacker's ability to redirect or manipulate navigation to otherwise restricted contexts. No public exploit identified at time of analysis; the EPSS score of 0.18% (8th percentile) and Chromium's own internal severity rating of Low collectively indicate minimal real-world exploitation probability despite the Medium NVD score.
Privilege escalation in Google Chrome Enterprise on macOS allows a local attacker with physical device access to bypass enterprise policy controls and gain elevated privileges. Affected are all Chrome versions prior to 151.0.7922.72 in managed Enterprise deployments on Mac. The attack requires physical presence at the target device, substantially limiting the threat surface, though the confidentiality, integrity, and availability impact is rated high once exploited. No public exploit identified at time of analysis.
Insufficient policy enforcement in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to bypass discretionary access controls (CWE-284) by delivering a crafted HTML page to a victim, resulting in high integrity impact with no confidentiality or availability consequence. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no attacker privileges needed, though user interaction is required. With EPSS at 0.18% (8th percentile), SSVC exploitation classified as none, and no public exploit identified at time of analysis, real-world mass exploitation risk is low despite the meaningful integrity bypass potential on a widely-used mobile browser.
UI spoofing in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker to mislead users about the origin or security context of displayed content via a crafted HTML page. Classified by Chromium as Low severity and rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could be leveraged to facilitate phishing or social engineering by making malicious content visually indistinguishable from trusted interfaces. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating this is a routine patch-cycle issue rather than an active threat.
Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.
UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.
Navigation restriction bypass in Google Chrome for iOS (prior to 151.0.7922.72) enables a remote attacker to redirect users to unintended URLs via a crafted HTML page, exploiting a CWE-601 open redirect condition. The Chromium team rated this Low severity, consistent with the CVSS 4.3 score and the limited integrity-only impact (no confidentiality or availability consequences). No public exploit identified at time of analysis, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation interest from the threat actor community.
Cross-origin data leakage in Google Chrome versions prior to 151.0.7922.72 stems from insufficient policy enforcement in the SVG rendering engine, allowing remote attackers to read data across origin boundaries by enticing a victim to visit a crafted HTML page. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation but mandates active user interaction, constraining mass exploitation. No public exploit has been identified at time of analysis; EPSS stands at 0.17% (7th percentile) and SSVC signals exploitation status of none, placing this firmly in routine-patch priority.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the browser's Web NFC API, classified under CWE-346 (Origin Validation Error). A remote attacker can serve a crafted HTML page that - when visited by a victim on an Android device - causes Chrome to violate its cross-origin isolation policy via the NFC subsystem, exposing cross-origin data to the attacker-controlled page. No public exploit has been identified at time of analysis; EPSS is 0.17% (7th percentile) and CISA SSVC rates exploitation as none, confirming low real-world urgency despite the network-accessible vector.
Cross-origin data leakage in Google Chrome's Isolated Web Apps (IWA) feature, versions prior to 151.0.7922.72, enables remote attackers to exfiltrate data across origin boundaries via crafted network traffic, contingent on user interaction. With an EPSS of 0.16% (6th percentile), no CISA KEV listing, and Chromium's own 'Low' severity classification, real-world exploitation risk is constrained despite the network-accessible vector. No public exploit has been identified at time of analysis, and impact is limited to partial confidentiality loss with no integrity or availability consequence.
Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.
Side-channel information leakage in Google Chrome's Network component prior to version 151.0.7922.72 enables remote attackers to infer cross-origin data by directing users to a crafted HTML page, violating Same-Origin Policy boundaries at the side-channel layer. The Chromium team rated this Low severity internally; with no public exploit code and no CISA KEV listing, the EPSS score of 0.17% (7th percentile) confirms that near-term mass exploitation is highly unlikely. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequences, making this a low-urgency patch for most environments, though higher priority in privacy-sensitive or intelligence-adjacent deployments.
Sandbox escape in Google Chrome's Bluetooth component (all versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox by sending crafted Bluetooth IPC messages triggered via a malicious HTML page. This is a second-stage, chained exploit - not a standalone remote attack - requiring prior renderer compromise as a hard prerequisite, which is why Chromium rates it Low severity internally despite the sandbox escape classification. No public exploit code or CISA KEV listing has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability consistent with the high attack chain complexity.
SurfaceCapture in Google Chrome prior to 151.0.7922.72 leaks cross-origin data to remote attackers through a crafted HTML page, violating browser same-origin isolation. The flaw is classified as CWE-346 (Origin Validation Error), meaning the SurfaceCapture subsystem fails to properly enforce origin boundaries, allowing data from one origin to be read by another. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the NFC subsystem, enabling a remote attacker to read data across origin boundaries. An unauthenticated attacker (per PR:N in the CVSS vector) can serve a crafted HTML page that, when visited by a target on Android Chrome, bypasses same-origin policy checks tied to NFC API handling, resulting in limited confidentiality disclosure. No active exploitation has been identified at time of analysis, EPSS sits at 0.17% (7th percentile), and Chromium itself rates this Low severity - placing real-world risk well below its nominal network-accessible footprint.
Insufficient policy enforcement in the Chromecast component of Google Chrome prior to 151.0.7922.72 enables an adjacent-network attacker to inject malicious scripts or HTML into a privileged browser page by sending crafted network traffic on the local network segment. The flaw is classified CWE-79 (Cross-Site Scripting), meaning attacker-controlled content executes in a privileged Chrome page context without requiring authentication or victim interaction. No public exploit code has been identified and EPSS is extremely low at 0.11% (2nd percentile), consistent with Chromium's own Low severity rating; a vendor patch is available.
Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.
Navigation restriction bypass in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient input validation in the Sharing component, enabling a remote attacker to circumvent Chrome's navigation controls via malicious network traffic when a user interacts with the Share feature. The flaw yields limited integrity impact only - no confidentiality or availability compromise - consistent with Chromium's own 'Low' severity classification and an EPSS of 0.17% (7th percentile). No public exploit code exists and no active exploitation has been confirmed; a vendor-released patch is available.
Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable by remote unauthenticated attackers who can lure a victim to a crafted HTML page that abuses an inappropriate implementation in Chrome's Opaque Response Blocking (ORB) mechanism. ORB is specifically designed to prevent unauthorized cross-origin reads; this flaw undermines that protection, allowing an attacker's page to read data belonging to a different origin in violation of the same-origin policy. EPSS is 0.18% (8th percentile), SSVC classifies exploitation as none, and no active exploitation or public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's DataTransfer API implementation (prior to 151.0.7922.72) allows a remote unauthenticated attacker to read sensitive data from a different origin when a victim performs specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. The vulnerability is rated CVSS 4.3 (Medium) with an EPSS probability of just 0.18% (8th percentile), indicating very low observed exploitation activity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but Chrome's widespread deployment makes even medium-severity browser flaws worth prioritizing for rapid patching.
Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.
Memory disclosure in Google Chrome's WebXR implementation allows remote attackers to read sensitive data from process memory by directing a victim to a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on desktop platforms. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current exploitation activity, making this a moderate-priority patching item despite the High confidentiality impact in the CVSS score.
Sandbox escape in Google Chrome's ANGLE graphics layer on Android enables an attacker who has already compromised the renderer process to break out of the Chrome sandbox via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. This is a second-stage exploit primitive requiring a prior renderer compromise; no public exploit code exists and SSVC reports exploitation as none, keeping real-world risk moderate despite the scope-change nature of the flaw.
Sandbox escape in Google Chrome DevTools prior to version 151.0.7922.72 requires a pre-compromised renderer process and user interaction with a crafted HTML page to break out of the browser sandbox. The root cause is insufficient input validation (CWE-20) in the DevTools component, where attacker-controlled input from the renderer is not properly sanitized before being processed. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.18%, indicating low observed exploitation pressure despite the meaningful impact of a successful sandbox escape.
Cross-origin data leakage in Google Chrome's WebXR implementation (versions prior to 151.0.7922.72) arises from an uninitialized memory use flaw exploitable by a remote attacker via a crafted HTML page that must be visited by the victim. The flaw allows partial disclosure of cross-origin data, with no integrity or availability impact. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.20% at the 10th percentile confirms this is a low-probability exploitation target in the near term.
Cross-origin data leakage in Google Chrome's Paint subsystem (all versions prior to 151.0.7922.72) allows a remote attacker to read data belonging to other web origins by delivering a crafted HTML page to a victim. The root cause is an origin validation error (CWE-346) in the Paint rendering component, permitting cross-origin information to surface where it should be isolated. No public exploit code exists and EPSS registers 0.18% (8th percentile), confirming low exploitation probability - this is a medium-severity patch-cycle priority, not an emergency.
Same-Origin Policy bypass in Google Chrome's Headless component prior to version 151.0.7922.72 allows remote attackers to perform unauthorized cross-origin integrity violations via a specially crafted HTML page. The flaw (CWE-346, Origin Validation Error) is specific to Chrome's Headless rendering mode and requires the victim to interact with attacker-controlled HTML (UI:R per CVSS). No public exploit code or CISA KEV listing has been identified; EPSS at 0.19% (9th percentile) reflects low near-term exploitation probability, though the zero-authentication requirement and low attack complexity elevate the concern for environments where Headless Chrome processes untrusted input.
Policy bypass in the Extensions subsystem of Google Chrome (all versions prior to 151.0.7922.72) allows site isolation circumvention when a user is convinced to install a crafted malicious extension. The CVSS vector (I:H, S:U) and CWE-693 indicate this is a protection mechanism failure that undermines Chrome's cross-origin boundary enforcement, potentially enabling manipulation of content across isolated sites. No public exploit has been identified at time of analysis; EPSS at 0.12% (3rd percentile) reflects low current exploitation probability, and CISA KEV listing is absent.
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) can be triggered remotely by luring a victim to a crafted HTML page, exposing data that should be isolated under the Same-Origin Policy. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's Autofill implementation fails to properly enforce cross-origin boundaries when processing form data. No public exploit exists and the EPSS score of 0.22% (12th percentile) reflects low near-term exploitation likelihood; the issue is patched in the stable channel release 151.0.7922.72.
Cross-origin data leakage in Google Chrome's Autofill subsystem (versions prior to 151.0.7922.72) enables remote attackers to extract sensitive cross-origin information by directing a user to a specially crafted HTML page. The root cause is an inappropriate implementation within Autofill that fails to enforce proper origin boundaries (CWE-346), allowing page-level interactions to surface data from contexts the page should not be able to read. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.22% (12th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation allows remote attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. All Chrome versions prior to 151.0.7922.72 on all platforms are affected. An unauthenticated remote attacker can bypass the browser's same-origin policy, enabling script execution in the context of third-party origins visited by the victim. No public exploit identified at time of analysis and EPSS sits at 0.18% (8th percentile), suggesting limited active exploitation pressure despite the broad attack surface of a ubiquitous browser.
Cross-origin data leakage in Google Chrome's Payments component (all versions prior to 151.0.7922.72) enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is an inappropriate implementation in the Payments subsystem (CWE-346: Origin Validation Error), violating the browser's same-origin policy for payment-related data flows. EPSS is 0.18% (8th percentile) and no CISA KEV listing or public exploit has been identified, indicating low exploitation probability despite ubiquitous product deployment.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
Discretionary access control bypass in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to violate iOS access control boundaries by enticing a user to visit a specially crafted HTML page. The flaw stems from insufficient policy enforcement unique to the iOS version of Chrome, meaning desktop Chrome is not affected by this specific variant. No public exploit code has been identified and EPSS signals low exploitation probability, but the integrity-only CVSS impact and user-interaction requirement make this a realistic phishing-assisted attack path.
Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), enabling a remote attacker to exfiltrate limited cross-origin credential-related data via a crafted HTML page. Exploitation requires the target user to perform specific, undisclosed UI gestures - such as interacting with a password field or autofill prompt - on the attacker's page, limiting mass-scale automation. No public exploit code or CISA KEV listing exists; EPSS at 0.18% (8th percentile) confirms low real-world exploitation probability, consistent with the mandatory social-engineering prerequisite.
Cross-origin data leakage in Google Chrome's Cast component allows an unauthenticated attacker positioned on the same local network segment to read data from origins they should not have access to via maliciously crafted network traffic. All Chrome versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA has not listed this in the KEV catalog, placing real-world risk at low-to-moderate despite the unauthenticated attack vector.
Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.
Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.
Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.
Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.
Cross-origin data leakage in Google Chrome prior to version 151.0.7922.72 allows remote attackers to read data across origin boundaries by inducing a user to visit a specially crafted HTML page. The flaw resides in Chrome's network layer and is classified as CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce origin boundaries during certain network operations. No active exploitation has been confirmed (not in CISA KEV), and EPSS places exploitation probability at 0.18% (8th percentile), indicating low current threat activity despite widespread browser deployment.
Same-origin policy bypass in Google Chrome's WebMCP component (prior to 151.0.7922.72) enables a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page, requiring only that a victim visit the malicious page. The root cause is insufficient policy enforcement in the WebMCP subsystem, classified by Chromium's security team as Medium severity (CWE-346: Origin Validation Error). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.19% (9th percentile) corroborates low current threat activity.
Script and HTML injection into privileged DevTools pages in Google Chrome prior to 151.0.7922.72 is enabled when an attacker has already compromised the renderer process, exploiting an inappropriate implementation in DevTools (CWE-79). The vulnerability requires chaining with a prior renderer exploit: alone it cannot be triggered by a remote unauthenticated attacker without that precondition, making it a sandbox-escape amplifier rather than a standalone remote attack. EPSS is 0.18% (8th percentile), no public exploit has been identified, and it does not appear in CISA KEV, reflecting low observed exploitation pressure despite the Medium CVSS rating.
Same-origin policy bypass in Google Chrome's Media Router component allows a remote attacker to violate cross-origin integrity guarantees by luring a user to a crafted HTML page. Affected are all Chrome versions prior to 151.0.7922.72 across desktop platforms. No public exploit or active exploitation has been identified at time of analysis, and the EPSS score of 0.23% (14th percentile) reflects low observed exploitation activity; however, the high integrity impact (I:H) and no-privilege-required attack path make patching a meaningful priority for browser-fleet administrators.
Side-channel information leakage in Chrome's Autofill component exposes cross-origin data to remote attackers who have already achieved renderer process compromise. All Chrome versions prior to 151.0.7922.72 are affected across all platforms. With an EPSS of 0.22% (12th percentile), no CISA KEV listing, and a mandatory renderer-compromise prerequisite, real-world exploitation risk is substantially lower than the CVSS base score implies - this is a chained second-stage disclosure, not a standalone attack. No public exploit identified at time of analysis.