Monthly
Insufficient UI warning of dangerous operations in Microsoft Edge (Chromium-based) before version 150.0.4078.48 enables network-based spoofing attacks against users who interact with adversary-controlled content. Per the CVSS vector (PR:N, UI:R), an unauthenticated remote attacker can exploit this flaw without any privileges, but requires the victim to interact with the browser during the attack. No public exploit identified at time of analysis; the Medium CVSS score of 4.3 and confidentiality-only impact (C:L) reflect a bounded but real risk primarily useful for phishing, credential harvesting, or identity spoofing scenarios.
Cross-site scripting in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 enables network-based spoofing attacks against users who interact with attacker-controlled content. The flaw stems from improper input neutralization during web page generation (CWE-79), allowing injected scripts to execute within the browser's context and manipulate rendered content. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
Absolute path traversal in Microsoft Edge for Android (Chromium-based) prior to version 150.0.4078.48 enables local, unauthenticated information disclosure by allowing crafted paths to escape the application's intended directory scope. The CVSS vector (AV:L/C:H/I:N/A:N) confirms the impact is limited to confidentiality loss on the local device, with no integrity or availability consequences. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in Microsoft Edge (Chromium-based) before version 150.0.4078.48 lets a remote attacker trick a victim into rendering attacker-controlled script that spoofs UI or content over the network. Because the CVSS scope is changed (S:C) and user interaction is required (UI:R), a lured user visiting or interacting with a malicious page can be deceived into trusting forged content, undermining browser security-context integrity. Reported by Microsoft with a vendor patch available; EPSS is low (0.28%, 20th percentile) and no public exploit identified at time of analysis.
Spoofing in Microsoft Edge (Chromium-based) lets a remote, unauthenticated attacker misrepresent trusted UI or content to a victim by abusing improper access control (CWE-284), per Microsoft's own advisory (MSRC CVE-2026-58286). The high CVSS 8.1 is driven by a scope-changed impact (S:C) with high integrity effect, though the AC:H rating signals the attack is not trivially reliable. Currently there is no public exploit identified at time of analysis and no CISA KEV listing, so this is a proactively-patched issue rather than one under active exploitation.
Server-side request forgery in Microsoft Edge (Chromium-based) versions before 150.0.4078.48 enables unauthenticated remote attackers to perform network spoofing by inducing the browser to issue forged requests on behalf of a victim. The attack requires user interaction - a victim must visit or interact with attacker-controlled content - after which the browser can be coerced into making unauthorized requests that manipulate resource integrity or availability. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; a vendor-released patch is available.
UI misrepresentation in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 enables network-based spoofing attacks against users who interact with attacker-controlled web content. The browser fails to accurately present critical security information - such as origin indicators, security status, or authentication prompts - allowing an unauthenticated remote attacker to deceive victims into believing they are interacting with a trusted source. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
Relative path traversal in Microsoft Edge for Android (Chromium-based) before version 150.0.4078.48 permits a local, unprivileged attacker to read sensitive files outside the application's intended directory scope, achieving high confidentiality impact with minor integrity exposure. The flaw (CWE-23) stems from insufficient sanitization of relative path sequences in Edge's Android file-handling logic. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be prioritized given the high confidentiality impact rating.
Spoofing in Microsoft Edge (Chromium-based) stems from a type-confusion memory-safety defect (CWE-843) that a remote, unauthenticated attacker can leverage over the network to misrepresent content or origin to the victim. Microsoft rates it CVSS 8.1 with a changed scope, driven largely by high integrity impact, though the CVSS vector's high attack complexity (AC:H) signals non-trivial exploitation. There is no public exploit identified at time of analysis (CVSS E:U), and it is not listed in CISA KEV; Microsoft has already shipped an official fix (RL:O).
Spoofing in Microsoft Edge (Chromium-based) lets a remote, unauthenticated attacker bypass an origin/security-context access control (CWE-284) to misrepresent trusted content or UI over a network. The flaw carries CVSS 8.1 with a scope-changed vector and high integrity impact, meaning a successful spoof can influence resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has shipped an official fix.
Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 expose sensitive information to unauthorized network actors, enabling spoofing attacks against users who interact with attacker-controlled content. The vulnerability maps to CWE-200, indicating that browser-internal sensitive data (likely origin, URL, or session context) is improperly disclosed across a network boundary, allowing an attacker to impersonate trusted content or identities. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS score of 6.5 with a network attack vector and no privilege requirement underscores meaningful real-world risk for any unpatched Edge deployment.
Server-side request forgery in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 allows unauthenticated network attackers to perform spoofing by inducing a victim user to visit a malicious page, causing the browser to issue forged requests to internal or external resources. The confidentiality impact is rated High (CVSS C:H), indicating that sensitive data accessible via the browser's network context may be exfiltrated through the SSRF channel. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Race condition in Microsoft Edge (Chromium-based) permits a locally authenticated, low-privileged attacker to disclose information beyond the intended security boundary, with the CVSS scope change (S:C) indicating impact can extend outside the directly vulnerable component - potentially across process or sandbox boundaries within the browser. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, placing it in a lower operational priority tier despite the scope change. Microsoft has released a patch via the MSRC advisory.
Improper export of Android application components in the ASUS Router App enables any co-installed third-party application on the same Android device to send a crafted Intent that forces the ASUS Router App to navigate to an attacker-specified URL. The flaw, classified as CWE-926, allows an attacker-controlled application to abuse the exposed component as an open redirect, potentially rendering phishing content or harvesting router management credentials within the app's trusted interface context. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated OAuth client secret disclosure in Dragonfly Manager (dragonflyoss/dragonfly <= v2.4.3) exposes GitHub and Google OAuth client_secret values to any host that can reach the Manager REST API port. The GET /api/v1/oauth and GET /api/v1/oauth/:id handlers omit the jwt.MiddlewareFunc() and RBAC middleware enforced on every other admin route group in the same router file - including the write methods (POST, DELETE, PATCH) in the same /oauth group - and the models.Oauth struct serializes ClientSecret without redaction. A detailed proof-of-concept with captured output is included in the advisory; no CISA KEV listing is present and EPSS data is unavailable.
Uninitialized memory use in Dawn, Chrome's WebGPU graphics subsystem, exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.46. The flaw is classified CWE-457 and carries a CVSS 3.1 score of 6.5 with high confidentiality impact; however, real-world exploitation risk is tempered by the requirement for user interaction, a very low EPSS of 0.20% (10th percentile), and SSVC assessment of no current exploitation. No public exploit identified at time of analysis; vendor-released patch is available in Chrome 150.0.7871.46.
Uninitialized memory exposure in Google Chrome's Dawn WebGPU component (versions prior to 150.0.7871.46) allows remote attackers to read potentially sensitive data from the Chrome renderer process. Exploitation requires a victim to visit a crafted HTML page, after which residual process memory - potentially containing credentials, session tokens, or other in-memory secrets - may be disclosed to the attacker. No public exploit identified at time of analysis; EPSS of 0.20% (10th percentile) and SSVC exploitation status of 'none' confirm low immediate exploitation likelihood despite the medium-severity CVSS rating.
Uninitialized memory use in Dawn, Chrome's WebGPU implementation, on ChromeOS prior to version 150.0.7871.46 enables remote attackers to read potentially sensitive contents from GPU process memory by serving a crafted HTML page. The flaw (CWE-457) allows stale or uninitialized buffer data to be exposed back to the requesting JavaScript context without proper sanitization. No public exploit has been identified at time of analysis, and CISA SSVC rates this as non-automatable with partial technical impact, though the CVSS confidentiality rating is High.
Cross-origin data leakage in Google Chrome's ANGLE graphics subsystem (all versions prior to 150.0.7871.46) enables remote attackers to read sensitive data from other browser origins by luring a victim to a crafted HTML page. The flaw stems from uninitialized memory use in ANGLE, Chrome's GPU abstraction layer, which may expose stale cross-origin pixel buffers or texture memory to attacker-controlled JavaScript. No public exploit has been identified and CISA's SSVC framework rates exploitation as none with a non-automatable attack path, indicating limited immediate real-world threat despite the network-accessible vector.
Uninitialized memory read in ANGLE - Chrome's graphics abstraction layer - exposes potentially sensitive process memory to remote attackers on Windows systems running Chrome prior to 150.0.7871.46. Exploitation requires the victim to visit a crafted HTML page, after which the ANGLE Direct3D translation path leaks heap or stack contents that may include session tokens, cached credentials, or other browser-resident data. No active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.20% at the 10th percentile reflects very low current exploitation activity despite the CVSS C:H rating.
Out-of-bounds read in Chrome's V8 JavaScript engine allows a memory disclosure attack against users running Google Chrome prior to 150.0.7871.46. An attacker who socially engineers a victim into installing a crafted malicious extension can trigger the OOB read to leak sensitive data from the renderer process memory, such as tokens or session material. No public exploit code has been identified and SSVC classifies exploitation as none, but the high confidentiality impact and Chrome's global install base make patching the appropriate near-term action.
Out-of-bounds read in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome prior to 150.0.7871.46 exposes process memory to remote attackers via a crafted HTML page. An unauthenticated remote attacker can cause a victim's browser to disclose potentially sensitive process memory - such as cached credentials or heap artifacts - with no integrity or availability impact. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS at 0.23% (14th percentile) confirms low near-term exploitation probability.
Out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction layer) prior to version 150.0.7871.46 allows a remote attacker to extract potentially sensitive data from the browser's process memory by directing a victim to a crafted HTML page. The CVSS vector confirms network delivery with no authentication required but mandates user interaction, and the High confidentiality impact (C:H) indicates that in-memory data such as session tokens, cached credentials, or page content could be exposed. SSVC assessment records no active exploitation and the flaw is absent from the CISA KEV catalog; a vendor patch has been released and no public exploit code has been identified at time of analysis.
Cross-origin data exfiltration in Google Chrome's ANGLE graphics layer exposes sensitive browser memory contents to remote attackers who can induce a victim to visit a crafted HTML page. The out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction engine) affects all Chrome desktop versions prior to 150.0.7871.46, confirmed by Google's stable channel advisory. No public exploit code or active exploitation has been identified at time of analysis; an EPSS of 0.17% (7th percentile) reflects minimal current weaponization pressure despite the high confidentiality impact assigned in CVSS.
Cross-origin data leakage in Google Chrome on Windows prior to 150.0.7871.46 stems from an out-of-bounds read in ANGLE, the browser's graphics abstraction layer. Remote attackers can exploit this by serving a crafted HTML page to a Windows user, causing the ANGLE subsystem to read memory beyond its intended buffer boundary and exposing data belonging to a separate web origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates low exploitation probability in the near term.
Integer overflow in Chrome's ANGLE graphics abstraction layer on Windows enables a remote attacker, who has already compromised the renderer process, to read potentially sensitive data from process memory. The attack requires a user to visit a crafted HTML page, making this a second-stage component in a multi-step exploit chain rather than a standalone critical flaw. No public exploit code has been identified and CISA has not added this to the KEV catalog; Chrome 150.0.7871.46 resolves the issue.
Insufficient input validation in Skia, Chrome's 2D graphics library, exposes process memory to an attacker who has already achieved renderer process compromise. Affected versions of Chrome prior to 150.0.7871.46 can leak potentially sensitive in-memory data when the victim visits a crafted HTML page. No public exploit code exists and no active exploitation is confirmed - EPSS at 0.22% (12th percentile) and SSVC Exploitation: none corroborate low near-term risk despite the High confidentiality impact rating.
UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 150.0.7871.46) enables remote attackers to misrepresent security indicators during Progressive Web App installation prompts via a crafted HTML page. The incorrect security UI (CWE-451) can deceive users into believing they are installing a legitimate, trusted application when they are not, resulting in a low-integrity impact. EPSS is 0.18% (8th percentile), no public exploit code exists, and this vulnerability has not been added to CISA KEV, indicating minimal active exploitation risk at time of analysis.
UI spoofing in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.46) allows a remote attacker who has already compromised the renderer process to mislead users through a crafted HTML page. The attack requires renderer process compromise as a prerequisite, making this a chained exploit component rather than a standalone threat. EPSS at 0.18% (8th percentile) and absence from CISA KEV confirm no known active exploitation; Chromium's own team rated this Low severity.
UI spoofing via a crafted PDF file in Google Chrome's PDFium rendering engine allows a remote, unauthenticated attacker to visually mislead users into performing unintended actions or trusting falsified content. All Chrome versions prior to 150.0.7871.46 are affected. Exploitation requires the victim to open a malicious PDF - no special configuration is needed beyond default Chrome behavior. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Race condition in the Linux kernel HSR (High-availability Seamless Redundancy) subsystem triggers a WARN_ONCE() during device teardown, potentially causing denial of service on affected systems. The flaw exists in hsr_addr_is_self() at net/hsr/hsr_framereg.c:39, where hsr->self_node is NULLed by hsr_del_self_node() before unregister_netdevice_many() completes, leaving a window for concurrent packet transmission to access a NULL pointer. On kernels configured with panic_on_warn=1, this warning escalates to a full kernel panic; no public exploit identified at time of analysis, and the vulnerability was discovered by Google's syzbot kernel fuzzer with EPSS at the 5th percentile.
Reflected Cross-Site Scripting in Wp Google Places Review Slider (WordPress plugin, versions ≤ 18.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized `place` GET parameter in `admin/partials/googlecrawl_dfs.php`. The raw user input is URL-decoded and passed through `stripslashes()` before being echoed directly into an HTML value attribute — bypassing WordPress's standard `esc_attr()` — but only when the supplied place value is not already present as a key in the `wprev_google_crawls` stored option. No public exploit identified at time of analysis; successful exploitation requires tricking an authenticated WordPress administrator into clicking a specially crafted link.
Same-origin policy bypass in Google Chrome's StorageAccessAPI allows an attacker who has already compromised the Chrome renderer process to further escalate access via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The integrity impact is rated High (I:H) in the CVSS vector, meaning cross-origin data writes or manipulations become possible, but only as a second-stage component in a chained exploit. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none with partial technical impact - consistent with the renderer pre-compromise prerequisite that substantially limits standalone risk.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 exposes sensitive user data from other origins when a victim visits a specially crafted HTML page that exploits insufficient policy enforcement in the StorageAccessAPI. The API, designed to manage third-party storage access in privacy-restricting browser contexts, fails to enforce cross-origin boundaries correctly, allowing an attacker to read data belonging to unrelated origins. No active exploitation has been confirmed - CVE is absent from CISA KEV, EPSS rates exploitation likelihood at 0.17% (7th percentile), and SSVC classifies exploitation status as none - though the CVSS confidentiality impact is rated High.
UI spoofing in Google Chrome's DevTools component allows an attacker to misrepresent critical interface information to users who have been socially engineered into installing a malicious Chrome Extension. Affected versions are all Chrome releases prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-451) in DevTools, enabling an extension to manipulate how DevTools renders UI elements - potentially deceiving developers or power users into trusting falsified debugging output or security indicators. No public exploit code has been identified at time of analysis, and this vulnerability is not in the CISA KEV catalog.
UI spoofing in the Glic component of Google Chrome (all versions prior to 150.0.7871.47) enables a remote attacker to misrepresent browser interface elements via a crafted HTML page, provided the victim is socially engineered into performing specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns high confidentiality impact, suggesting the spoofed UI can be leveraged to elicit disclosure of sensitive information such as credentials or session data. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
UI spoofing via the Speech component in Google Chrome prior to 150.0.7871.47 requires an attacker to have already compromised the renderer process, making this a chained, second-stage exploit rather than a standalone remote attack. The vulnerability stems from insufficient input validation (CWE-20) in Chrome's Speech subsystem, enabling a renderer-compromised attacker to manipulate browser UI elements through a crafted HTML page. No public exploit code exists, SSVC assessment confirms no active exploitation, and an EPSS score of 0.17% (7th percentile) reflects a very low probability of mass exploitation - consistent with Google's own 'Low' internal severity rating.
Type confusion in the CSS processing engine of Google Chrome prior to 150.0.7871.47 enables remote attackers to read potentially sensitive data from renderer process memory by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no attacker privileges required, though a single user interaction - visiting the malicious page - is necessary. No public exploit code has been identified, CISA SSVC rates exploitation as none at time of analysis, and Chromium's own team classified severity as Low, suggesting limited practical memory disclosure value despite the NVD CVSS C:H rating.
Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 150.0.7871.47 allows remote attackers to inject arbitrary scripts or HTML across origin boundaries by exploiting an inappropriate implementation in Chrome's CSS engine via a crafted HTML page. Unlike application-level XSS, this browser-level flaw bypasses same-origin protections, meaning injected scripts can execute in the context of any open origin. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a patch-promptly, not emergency-response, priority.
Cross-origin data leak in Google Chrome's CSS implementation (versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive data from other origins when a victim visits a specially crafted HTML page. The vulnerability stems from inappropriate CSS handling that creates a side-channel bypassing same-origin policy protections, resulting in high-confidentiality-impact information disclosure with no integrity or availability consequences. No public exploit has been identified and exploitation has not been observed in the wild; CISA SSVC rates exploitation as none and technical impact as partial, aligning with Google's internal Low severity classification despite the NVD CVSS 6.5 score.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML by luring a user to a crafted web page, with the scope change (S:C) in the CVSS vector indicating potential Same-Origin Policy bypass affecting other loaded origins. No public exploit or active exploitation is identified at time of analysis - EPSS sits at 0.17% (6th percentile) and SSVC exploitation status is rated 'none.' A vendor-released patch is available in stable channel 150.0.7871.47.
UI spoofing in Google Chrome's Views component (versions prior to 150.0.7871.47) allows a remote attacker to misrepresent security-critical browser interface elements through a crafted HTML page. Exploitation requires convincing a target user to perform specific UI gestures, making the attack conditional on social engineering. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; Google has released a patch as part of the stable channel update.
UI spoofing in Google Chrome's Passwords feature on iOS (versions prior to 150.0.7871.47) enables remote attackers to manipulate the presentation of security-critical password UI elements via a specially crafted HTML page. Users who visit a malicious page in Chrome on iOS may see misleading security indicators or spoofed password dialogs, potentially deceiving them into unintended credential interactions. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and SSVC confirms no observed exploitation - risk is real but low-priority relative to the broader threat landscape.
UI spoofing in Google Chrome's Extensions implementation (all versions prior to 150.0.7871.47) enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to render deceptive UI elements through a crafted HTML page, potentially misleading users into unintended interactions. The vulnerability carries a CVSS 5.4 Medium score, though Chromium's internal rating is Low, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation probability. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Domain spoofing via incorrect security UI in Google Chrome's Document Picture-in-Picture feature on Android (prior to 150.0.7871.47) allows a remote attacker to deceive users about the origin of displayed content. By serving a crafted HTML page, an attacker can cause Chrome on Android to render a misleading security UI - misrepresenting the domain shown to the user. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none, making this a low operational priority despite its network-accessible attack vector.
UI spoofing in Google Chrome for Android prior to 150.0.7871.47 enables remote unauthenticated attackers to deceive users about page origin or content through insufficient validation of untrusted input in the browser's Input component. Exploitation requires user interaction - a victim must visit a crafted HTML page - and produces only limited integrity impact (visual deception), with no code execution or data exfiltration capability. No public exploit identified at time of analysis; EPSS sits at 0.18% (8th percentile) and CISA SSVC confirms zero observed exploitation, consistent with Google's own 'Low' severity classification for this Chromium issue.
UI spoofing in Google Chrome's TabStrip component prior to version 150.0.7871.47 allows a remote attacker to misrepresent tab or page identity through a crafted HTML page, contingent on convincing the victim to perform specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) places real-world risk in the lower tier: high attack complexity, mandatory user interaction, and no confidentiality impact combine to limit practical exploitation. No public exploit code exists and CISA has not added this to the KEV catalog, consistent with Google's own Low severity classification.
UI spoofing in Google Chrome's WebAppInstalls component on Windows (versions prior to 150.0.7871.47) enables a remote attacker to misrepresent the browser interface by luring a user into performing specific UI interaction gestures on a crafted HTML page. The flaw is Windows-platform-specific and rooted in an inappropriate implementation of the Progressive Web App installation UI flow. Google rates this Low severity; no public exploit identified at time of analysis, and EPSS data is not present in the provided intelligence, but the CVSS 4.2 score and required high-complexity user interaction significantly limit real-world risk.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to manipulate browser interface elements via a crafted HTML page, provided the attacker can lure the victim into performing specific UI gestures. The root cause is insufficient validation of untrusted HTML input (CWE-20) within Chrome's iOS-specific rendering layer, resulting in low-integrity and low-availability impact. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog; Chromium's own severity classification is Low.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent browser interface elements by delivering a crafted HTML page to a victim who visits it. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw arises from insufficient validation of untrusted HTML input in the iOS-specific Chrome rendering pipeline, enabling manipulation of trust signals such as address bar display or security indicators. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation: none confirm negligible current threat actor interest.
UI spoofing in Google Chrome's Network component (versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, allowing browser UI elements to be faked via a crafted HTML page. This is a chained exploit - not a standalone flaw - requiring both prior renderer compromise and user interaction, which significantly constrains real-world risk. No public exploit code exists and no confirmed active exploitation has been recorded; EPSS at 0.18% (8th percentile) and Chromium's own 'Low' severity rating reinforce this assessment.
UI spoofing via Google Chrome's Autofill implementation on Android (prior to 150.0.7871.47) allows remote unauthenticated attackers to misrepresent interface elements through a crafted HTML page, potentially deceiving users into disclosing sensitive input or taking unintended actions. The vulnerability is platform-specific to Android and carries a Chromium-internal severity of Low, consistent with its limited integrity-only impact and requirement for user interaction. No public exploit code or active exploitation has been identified at time of analysis, and EPSS probability sits at 0.17% (7th percentile), confirming minimal real-world threat pressure.
UI spoofing via race condition in Google Chrome's History Embeddings component (versions prior to 150.0.7871.47) enables remote attackers to present falsified browser interface elements to users through a crafted HTML page. The flaw requires both high attack complexity - a precisely timed race window - and victim interaction, yielding only limited confidentiality and integrity impact with no code execution capability. No public exploit or active exploitation has been identified; EPSS at 0.14% (4th percentile) and SSVC exploitation status of 'none' confirm extremely low real-world exploitation probability at time of analysis.
UI spoofing in Google Chrome's WebXR component (all versions prior to 150.0.7871.47) allows remote attackers to misrepresent browser interface elements when a victim visits a crafted HTML page. The flaw stems from an inappropriate implementation in the WebXR Device API, enabling manipulation of what the user perceives as trusted UI - potentially obscuring origin indicators, security state, or page identity. No public exploit code exists and EPSS stands at 0.18% (8th percentile); CISA SSVC rates exploitation as none with partial technical impact, placing this firmly in the lower-priority tier despite its network-accessible vector.
UI spoofing in Google Chrome's WebAppInstalls component (prior to 150.0.7871.47) is reachable only after an attacker has already compromised the Chrome renderer process, making this a chained, post-exploitation capability rather than a standalone entry point. With a compromised renderer, the attacker can serve a crafted HTML page that bypasses insufficient input validation in WebAppInstalls to forge Chrome's native UI - potentially deceiving users into trusting malicious web app install prompts or dialogs. No public exploit or active exploitation (CISA KEV) is confirmed; EPSS sits at 0.18% (8th percentile), consistent with the high prerequisite barrier and Chromium's own 'Low' severity rating.
UI spoofing in Google Chrome's Omnibox (address bar) prior to version 150.0.7871.47 allows a remote attacker to misrepresent origin or security indicators to a victim via a crafted HTML page. Rooted in CWE-451 (misrepresentation of critical security information), the flaw can enable phishing or origin-confusion attacks by deceiving users into trusting a false domain indicator. No public exploit code exists, CISA SSVC rates exploitation as none, and the EPSS score of 0.18% (8th percentile) confirms this is low-priority outside phishing-sensitive deployments.
UI spoofing in Google Chrome for Android (prior to 150.0.7871.47) via the PreviewTab feature allows remote attackers to misrepresent interface elements through a crafted HTML page. Successful exploitation requires high attack complexity - specifically, the attacker must convince a victim to perform particular UI gestures - limiting this to targeted rather than opportunistic attacks. No active exploitation or public proof-of-concept has been identified; the Chromium security team rates this as Low severity, consistent with its constrained CVSS 4.2 score.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to display false URL content in the browser's address bar by luring a user to a crafted HTML page, creating a credible phishing vector. The flaw stems from inappropriate implementation in the iOS-specific Omnibox rendering logic (CWE-451), distinct from Chrome's desktop codebase. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible opportunistic exploitation probability at this time.
UI spoofing in Google Chrome's Printing subsystem (all versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, enabling misrepresentation of critical browser UI via a crafted HTML page. This is a post-exploitation primitive rather than an initial-access vector - the renderer must be independently compromised before this flaw is reachable. No public exploit code exists and CISA SSVC rates exploitation as none, consistent with the low EPSS score of 0.18% (8th percentile), placing real-world urgency squarely in routine maintenance rather than emergency response.
Domain spoofing in Google Chrome for Android (versions prior to 150.0.7871.47) allows remote attackers to deceive users about the origin of a webpage by exploiting incorrect rendering of security-critical UI elements via a crafted HTML page. User interaction is required - the victim must navigate to the attacker-controlled page - and impact is limited to integrity (UI misrepresentation), with no direct confidentiality or availability consequences. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.17% at the 7th percentile reflects minimal real-world exploitation activity; Google itself rates this 'Low' severity.
Uninitialized memory use in Chrome's ANGLE graphics layer exposes potentially sensitive process memory contents to remote attackers who can entice a user to visit a crafted HTML page. The flaw affects all Chrome versions prior to 150.0.7871.47, with High confidentiality impact per CVSS despite Google's own Chromium severity rating of Low - a discrepancy suggesting practical extraction of meaningful data is constrained in real-world conditions. No public exploit identified at time of analysis, and no CISA KEV listing; a vendor patch has been released.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to display a fraudulent URL in the browser's address bar by delivering a crafted HTML page. The root cause is classified as CWE-451 (UI Misrepresentation of Critical Information), meaning the security UI fails to accurately reflect the true origin of displayed content - a condition that directly undermines phishing defenses. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates very low observed exploitation pressure, consistent with the Chromium team's own 'Low' severity rating.
Type confusion in Chrome's Bluetooth stack on Windows (versions prior to 150.0.7871.47) enables an adjacent-network attacker to exfiltrate sensitive data from Chrome process memory by presenting a malicious Bluetooth peripheral. The CVSS 6.5 score reflects high confidentiality impact but no integrity or availability exposure; notably, Chromium's internal security team rated this Low severity, suggesting the memory regions accessible are constrained. No public exploit code and no CISA KEV listing exist at time of analysis, and exploitation is physically bounded by Bluetooth range.
Cross-origin data leak in Google Chrome DevTools prior to version 150.0.7871.47 exposes sensitive information from foreign origins when a victim visits a crafted HTML page and performs attacker-directed UI gestures. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability consequences. No public exploit identified at time of analysis, and EPSS of 0.18% at the 8th percentile - combined with Chromium's own 'Low' severity classification - signals limited real-world exploitation likelihood despite the Medium NVD score.
Memory disclosure via DevTools in Google Chrome on Windows (prior to 150.0.7871.47) enables a remote attacker to read sensitive process memory contents by delivering a crafted HTML page and manipulating the victim into performing specific UI gestures. The vulnerability is Windows-platform-exclusive and carries a Chromium-internal severity of Low, consistent with SSVC's assessment of no current exploitation and non-automatable delivery. No active exploitation or public exploit code has been identified at time of analysis, though the CVSS C:H rating reflects meaningful confidentiality risk if successfully triggered.
Cross-origin data leakage in Google Chrome's DevTools component (all versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive cross-origin information by convincing a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from CWE-20 (Improper Input Validation) within DevTools, allowing the Same-Origin Policy to be bypassed under attacker-directed user interaction. No active exploitation is confirmed - SSVC rates exploitation as 'none,' EPSS is 0.18% (8th percentile), and the vulnerability is absent from the CISA KEV catalog - with a vendor-released patch available as Chrome 150.0.7871.47.
Process memory disclosure in Google Chrome Enterprise (versions prior to 150.0.7871.47) enables a remote unauthenticated attacker to leak potentially sensitive contents from the browser's process memory by serving a crafted HTML page that induces the victim into performing specific UI gestures. The underlying flaw is classified as CWE-203 (Observable Discrepancy), indicating a side-channel in Chrome's Enterprise component where behavioral differences during UI interactions expose in-memory data. No public exploit code exists and this vulnerability is absent from CISA KEV; EPSS at 0.22% (12th percentile) and SSVC exploitation status of 'none' collectively confirm this is a low-probability exploitation target at time of analysis.
UI spoofing in Google Chrome's DarkMode implementation (all versions prior to 150.0.7871.47) enables remote attackers to misrepresent page content or interface elements by serving a crafted HTML page to a victim. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the rendering pipeline fails to present information accurately, potentially deceiving users into unsafe actions such as credential entry or approval of deceptive prompts. No public exploit has been identified at time of analysis, EPSS is 0.18% (8th percentile), and CISA's SSVC framework rates exploitation as none - signals that collectively place this at low operational priority despite its network reachability.
Same-origin-policy bypass in Google Chrome's Speech component before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page cross origin boundaries via insufficient policy enforcement. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile); notably, Google's own Chromium team rated this Low severity even though NVD scored it CVSS 9.6, a significant conflict defenders should weigh. Requires user interaction (visiting the page) and affects all Chrome desktop builds prior to the fixed stable release.
Use-after-free in Chrome's SSL handling on ChromeOS exposes process memory contents to remote attackers who can serve a crafted HTML page. Only ChromeOS builds of Chrome prior to 150.0.7871.47 are affected - this is not a cross-platform flaw. SSVC rates exploitation status as none and technical impact as partial, and Chromium's own severity classification is Low, making this a routine patch-cycle priority rather than an emergency response item despite the CVSS 6.5 score.
Cross-origin data leakage in Google Chrome's NetworkCache component affects all desktop versions prior to 150.0.7871.47, enabling remote attackers to read sensitive cached data belonging to other origins. Exploitation requires a victim to visit a specially crafted HTML page, placing this squarely in the browser-based phishing and malvertising threat model. No public exploit code or active exploitation has been identified; an EPSS score of 0.17% (7th percentile) and Chromium's own Low severity classification indicate low immediate exploitation probability despite the Medium CVSS base score.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 allows a remote attacker who can lure a user to a crafted HTML page to bypass same-origin isolation via an inappropriate CSS implementation and exfiltrate sensitive data from other origins. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) reflects high confidentiality impact with no integrity or availability effects, though Chromium's own security team rated severity as Low and SSVC confirms no current exploitation. No public exploit code has been identified, and EPSS of 0.17% (7th percentile) aligns with the low observed exploitation probability.
Cross-origin data leakage in Google Chrome for Android (prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin information through a crafted HTML page, exploiting an inappropriate implementation in Chrome's Input component (CWE-200). The attack requires both a pre-existing renderer compromise and user interaction with a malicious page, creating a chained exploitation prerequisite that substantially lowers real-world risk below what the 6.5 CVSS score implies. No public exploit has been identified and SSVC confirms exploitation status as none, consistent with EPSS placing this in the bottom 7th percentile of exploitation likelihood.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 enables an on-path network adversary to bypass Chrome's privacy policy enforcement and observe data belonging to a different origin via crafted malicious network traffic. The flaw is classified as CWE-693 (Protection Mechanism Failure), indicating Chrome's privacy isolation layer fails to correctly enforce cross-origin restrictions under certain network conditions. EPSS sits at 0.11% (2nd percentile), no public exploit code is known, and the vulnerability has not been added to CISA KEV; Chromium itself rates this Low severity.
UI spoofing in Google Chrome's PopupBlocker component (all versions prior to 150.0.7871.47) enables a remote attacker who has already compromised the Chrome renderer process to manipulate browser UI elements through a crafted HTML page. The integrity impact is limited to UI deception - no code execution, credential theft, or availability impact is possible through this flaw alone. EPSS at 0.17% (7th percentile) and Chromium's own 'Low' severity rating align with the constrained exploit chain; no public exploit or CISA KEV listing exists at time of analysis.
Uninitialized memory read in the Canvas API of Google Chrome on Android (prior to 150.0.7871.47) exposes potentially sensitive process memory contents to remote attackers. Exploitation requires luring a target to a crafted HTML page, after which the uninitialized Canvas buffer may leak memory from the renderer process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Chromium's own security team rates severity as Low despite the NVD CVSS score of 6.5.
CSS side-channel information leakage in Google Chrome prior to 150.0.7871.47 enables remote attackers to exfiltrate cross-origin data by luring victims to a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H) with network access and no authentication required from the attacker, though user interaction is necessary. Despite the NVD Medium score of 6.5, Google's internal Chromium severity rating is Low, EPSS sits at just 0.17% (7th percentile), there is no KEV listing, and no public exploit has been identified at time of analysis - signals that collectively indicate limited real-world exploitability.
Universal Cross-Site Scripting (UXSS) in Google Chrome before 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML across security origins by serving a crafted HTML page to a victim user. The flaw stems from insufficient input validation in Chrome's HTML handling (CWE-20), and its Scope:Changed CVSS metric confirms the core danger: injected scripts escape the attacker-controlled origin and execute in the context of other web origins, undermining the browser's same-origin policy. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS stands at 0.18% (8th percentile), consistent with the vendor's own 'Low' Chromium severity classification despite a NVD CVSS score of 6.1.
Cross-origin data leakage in Google Chrome's Storage component prior to version 150.0.7871.47 enables remote attackers to read data belonging to a different origin by exploiting a race condition triggered via a crafted HTML page. The Chromium security team internally rated this as Low severity - a notable contrast to the CVSS 6.5 score reflecting High confidentiality impact - suggesting the practical exploitation window or data exposure scope is constrained in real-world conditions. No public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) confirms negligible observed exploitation activity.
Insufficient policy enforcement in Chrome's DevTools component allows a crafted malicious extension to read potentially sensitive data from process memory. Affected versions are all Google Chrome releases prior to 150.0.7871.47 on desktop platforms. An attacker must first persuade a victim to install the malicious extension, after which the extension can silently extract in-memory data - including session tokens, credentials, or page content resident in the Chrome process - without triggering further user interaction. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Navigation restriction bypass in Google Chrome for Android (prior to 150.0.7871.47) allows a remote attacker to circumvent browser navigation controls through crafted malicious network traffic targeting the TabSwitcher component. The flaw stems from insufficient input validation (CWE-20) in the tab management UI and requires user interaction to trigger, limiting its practical reach. With an EPSS score of 0.17% (7th percentile), no public exploit code, no CISA KEV listing, and Chromium's own internal severity rating of Low, real-world exploitation risk is minimal despite network reachability.
Same-origin policy bypass in Google Chrome's Network component (versions prior to 150.0.7871.47) allows a remote attacker to violate cross-origin isolation by delivering a crafted HTML page to a victim. The flaw, rooted in CWE-346 (Origin Validation Error), enables unauthorized cross-origin integrity impacts - an attacker can cause a browser to act on or submit data across origin boundaries it should enforce. With an EPSS of 0.18% at the 8th percentile, no CISA KEV listing, and no public exploit identified, active exploitation risk is low at this time, though Chrome's ubiquitous deployment ensures broad attack surface if exploitation techniques mature.
Omnibox (URL bar) spoofing in Google Chrome on macOS prior to version 150.0.7871.47 enables a remote attacker to display a falsified URL in the browser's address bar by delivering a crafted HTML page exploiting an inappropriate Select element implementation. The deception targets the user's trust in the origin indicator - the primary browser security signal - making this a phishing and social engineering enabler rather than a direct code execution or data exfiltration vector. No public exploit exists and EPSS exploitation probability stands at 0.17% (7th percentile), with no confirmed active exploitation; vendor-released patch is available in Chrome 150.0.7871.47.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 allows a remote attacker to circumvent network-level policy enforcement by delivering a crafted HTML page to a victim. The Chrome security team internally rated this as Low severity, consistent with the CVSS 4.3 score and an impact limited to integrity (I:L) with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified; EPSS places this in the 8th percentile of exploitation likelihood.
No-referrer policy bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to capture referrer URL information that the browser was supposed to suppress. Exploitation requires user interaction - the victim must visit a crafted HTML page served by the attacker - and exploits a client-side enforcement gap (CWE-602) specific to the iOS build of Chrome. EPSS is 0.19% (9th percentile) and no active exploitation or KEV listing exists, consistent with the Low Chromium severity rating.
Side-channel information leakage in the WebAuthentication component of Google Chrome on iOS (prior to 150.0.7871.47) exposes cross-origin data to remote attackers via a crafted HTML page, requiring only that a victim visit attacker-controlled content. The CVSS Confidentiality:High rating reflects the category of cross-origin data exposure, while Chromium's own internal severity classification of Low and an EPSS score of 0.21% (11th percentile) both signal that practical exploitation is considered unlikely at scale. No public exploit is identified at time of analysis and no CISA KEV listing exists.
Navigation restriction bypass in Google Chrome's WebXR component affects all versions prior to 150.0.7871.47, exploitable by a remote unauthenticated attacker who can induce a user to visit a crafted HTML page. The root cause is insufficient input validation (CWE-20) within the WebXR subsystem, resulting in limited integrity impact via unauthorized navigation. No public exploit exists and EPSS sits at 0.18% (8th percentile), consistent with the Chromium team's own Low severity classification - this represents a genuine but low-priority risk.
UI spoofing in Google Chrome's SplitView feature prior to version 150.0.7871.47 enables remote attackers to misrepresent the origin or content of browser UI elements by delivering a crafted HTML page to a victim. Exploitation is limited to integrity impact only - no data exfiltration or availability disruption is possible directly - though the spoofing could facilitate social engineering leading to credential theft. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), classifying this as a routine-patch-cycle item despite Chrome's ubiquitous deployment.
Side-channel information leakage via the WebAudio API in Google Chrome prior to 150.0.7871.47 enables a remote attacker to extract cross-origin data from a victim's browser session through a crafted HTML page. The vulnerability abuses WebAudio's timing or spectral measurement capabilities to infer data that should be isolated by the Same-Origin Policy, exposing potentially sensitive cross-origin resources. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.17% at the 7th percentile reflects very low current exploitation probability; Chromium's own team rated the severity as Low despite the NVD's Medium (6.5) CVSS assignment.
Integer overflow in Chrome's WebNN (Web Neural Network API) component prior to version 150.0.7871.47 enables remote attackers to read potentially sensitive data from browser process memory by luring a user to a crafted HTML page. The attack requires no privileges and no special configuration, but mandates user interaction - the victim must navigate to a malicious page. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none with partial technical impact, and Google itself assigned a Low Chromium severity, suggesting real-world impact is constrained by browser sandboxing despite the CVSS C:H rating.
Insufficient UI warning of dangerous operations in Microsoft Edge (Chromium-based) before version 150.0.4078.48 enables network-based spoofing attacks against users who interact with adversary-controlled content. Per the CVSS vector (PR:N, UI:R), an unauthenticated remote attacker can exploit this flaw without any privileges, but requires the victim to interact with the browser during the attack. No public exploit identified at time of analysis; the Medium CVSS score of 4.3 and confidentiality-only impact (C:L) reflect a bounded but real risk primarily useful for phishing, credential harvesting, or identity spoofing scenarios.
Cross-site scripting in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 enables network-based spoofing attacks against users who interact with attacker-controlled content. The flaw stems from improper input neutralization during web page generation (CWE-79), allowing injected scripts to execute within the browser's context and manipulate rendered content. No public exploit code or active exploitation has been identified at time of analysis, and Microsoft has released a patch addressing the issue.
Absolute path traversal in Microsoft Edge for Android (Chromium-based) prior to version 150.0.4078.48 enables local, unauthenticated information disclosure by allowing crafted paths to escape the application's intended directory scope. The CVSS vector (AV:L/C:H/I:N/A:N) confirms the impact is limited to confidentiality loss on the local device, with no integrity or availability consequences. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Cross-site scripting in Microsoft Edge (Chromium-based) before version 150.0.4078.48 lets a remote attacker trick a victim into rendering attacker-controlled script that spoofs UI or content over the network. Because the CVSS scope is changed (S:C) and user interaction is required (UI:R), a lured user visiting or interacting with a malicious page can be deceived into trusting forged content, undermining browser security-context integrity. Reported by Microsoft with a vendor patch available; EPSS is low (0.28%, 20th percentile) and no public exploit identified at time of analysis.
Spoofing in Microsoft Edge (Chromium-based) lets a remote, unauthenticated attacker misrepresent trusted UI or content to a victim by abusing improper access control (CWE-284), per Microsoft's own advisory (MSRC CVE-2026-58286). The high CVSS 8.1 is driven by a scope-changed impact (S:C) with high integrity effect, though the AC:H rating signals the attack is not trivially reliable. Currently there is no public exploit identified at time of analysis and no CISA KEV listing, so this is a proactively-patched issue rather than one under active exploitation.
Server-side request forgery in Microsoft Edge (Chromium-based) versions before 150.0.4078.48 enables unauthenticated remote attackers to perform network spoofing by inducing the browser to issue forged requests on behalf of a victim. The attack requires user interaction - a victim must visit or interact with attacker-controlled content - after which the browser can be coerced into making unauthorized requests that manipulate resource integrity or availability. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; a vendor-released patch is available.
UI misrepresentation in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 enables network-based spoofing attacks against users who interact with attacker-controlled web content. The browser fails to accurately present critical security information - such as origin indicators, security status, or authentication prompts - allowing an unauthenticated remote attacker to deceive victims into believing they are interacting with a trusted source. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and a vendor patch is available.
Relative path traversal in Microsoft Edge for Android (Chromium-based) before version 150.0.4078.48 permits a local, unprivileged attacker to read sensitive files outside the application's intended directory scope, achieving high confidentiality impact with minor integrity exposure. The flaw (CWE-23) stems from insufficient sanitization of relative path sequences in Edge's Android file-handling logic. No public exploit code or active exploitation has been identified at time of analysis, though a vendor patch is available and should be prioritized given the high confidentiality impact rating.
Spoofing in Microsoft Edge (Chromium-based) stems from a type-confusion memory-safety defect (CWE-843) that a remote, unauthenticated attacker can leverage over the network to misrepresent content or origin to the victim. Microsoft rates it CVSS 8.1 with a changed scope, driven largely by high integrity impact, though the CVSS vector's high attack complexity (AC:H) signals non-trivial exploitation. There is no public exploit identified at time of analysis (CVSS E:U), and it is not listed in CISA KEV; Microsoft has already shipped an official fix (RL:O).
Spoofing in Microsoft Edge (Chromium-based) lets a remote, unauthenticated attacker bypass an origin/security-context access control (CWE-284) to misrepresent trusted content or UI over a network. The flaw carries CVSS 8.1 with a scope-changed vector and high integrity impact, meaning a successful spoof can influence resources beyond the initially vulnerable component. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but Microsoft has shipped an official fix.
Microsoft Edge (Chromium-based) versions prior to 150.0.4078.48 expose sensitive information to unauthorized network actors, enabling spoofing attacks against users who interact with attacker-controlled content. The vulnerability maps to CWE-200, indicating that browser-internal sensitive data (likely origin, URL, or session context) is improperly disclosed across a network boundary, allowing an attacker to impersonate trusted content or identities. No public exploit code or CISA KEV listing exists at time of analysis; however, the CVSS score of 6.5 with a network attack vector and no privilege requirement underscores meaningful real-world risk for any unpatched Edge deployment.
Server-side request forgery in Microsoft Edge (Chromium-based) prior to version 150.0.4078.48 allows unauthenticated network attackers to perform spoofing by inducing a victim user to visit a malicious page, causing the browser to issue forged requests to internal or external resources. The confidentiality impact is rated High (CVSS C:H), indicating that sensitive data accessible via the browser's network context may be exfiltrated through the SSRF channel. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Race condition in Microsoft Edge (Chromium-based) permits a locally authenticated, low-privileged attacker to disclose information beyond the intended security boundary, with the CVSS scope change (S:C) indicating impact can extend outside the directly vulnerable component - potentially across process or sandbox boundaries within the browser. No public exploit code has been identified and this CVE is not listed in the CISA KEV catalog, placing it in a lower operational priority tier despite the scope change. Microsoft has released a patch via the MSRC advisory.
Improper export of Android application components in the ASUS Router App enables any co-installed third-party application on the same Android device to send a crafted Intent that forces the ASUS Router App to navigate to an attacker-specified URL. The flaw, classified as CWE-926, allows an attacker-controlled application to abuse the exposed component as an open redirect, potentially rendering phishing content or harvesting router management credentials within the app's trusted interface context. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Unauthenticated OAuth client secret disclosure in Dragonfly Manager (dragonflyoss/dragonfly <= v2.4.3) exposes GitHub and Google OAuth client_secret values to any host that can reach the Manager REST API port. The GET /api/v1/oauth and GET /api/v1/oauth/:id handlers omit the jwt.MiddlewareFunc() and RBAC middleware enforced on every other admin route group in the same router file - including the write methods (POST, DELETE, PATCH) in the same /oauth group - and the models.Oauth struct serializes ClientSecret without redaction. A detailed proof-of-concept with captured output is included in the advisory; no CISA KEV listing is present and EPSS data is unavailable.
Uninitialized memory use in Dawn, Chrome's WebGPU graphics subsystem, exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.46. The flaw is classified CWE-457 and carries a CVSS 3.1 score of 6.5 with high confidentiality impact; however, real-world exploitation risk is tempered by the requirement for user interaction, a very low EPSS of 0.20% (10th percentile), and SSVC assessment of no current exploitation. No public exploit identified at time of analysis; vendor-released patch is available in Chrome 150.0.7871.46.
Uninitialized memory exposure in Google Chrome's Dawn WebGPU component (versions prior to 150.0.7871.46) allows remote attackers to read potentially sensitive data from the Chrome renderer process. Exploitation requires a victim to visit a crafted HTML page, after which residual process memory - potentially containing credentials, session tokens, or other in-memory secrets - may be disclosed to the attacker. No public exploit identified at time of analysis; EPSS of 0.20% (10th percentile) and SSVC exploitation status of 'none' confirm low immediate exploitation likelihood despite the medium-severity CVSS rating.
Uninitialized memory use in Dawn, Chrome's WebGPU implementation, on ChromeOS prior to version 150.0.7871.46 enables remote attackers to read potentially sensitive contents from GPU process memory by serving a crafted HTML page. The flaw (CWE-457) allows stale or uninitialized buffer data to be exposed back to the requesting JavaScript context without proper sanitization. No public exploit has been identified at time of analysis, and CISA SSVC rates this as non-automatable with partial technical impact, though the CVSS confidentiality rating is High.
Cross-origin data leakage in Google Chrome's ANGLE graphics subsystem (all versions prior to 150.0.7871.46) enables remote attackers to read sensitive data from other browser origins by luring a victim to a crafted HTML page. The flaw stems from uninitialized memory use in ANGLE, Chrome's GPU abstraction layer, which may expose stale cross-origin pixel buffers or texture memory to attacker-controlled JavaScript. No public exploit has been identified and CISA's SSVC framework rates exploitation as none with a non-automatable attack path, indicating limited immediate real-world threat despite the network-accessible vector.
Uninitialized memory read in ANGLE - Chrome's graphics abstraction layer - exposes potentially sensitive process memory to remote attackers on Windows systems running Chrome prior to 150.0.7871.46. Exploitation requires the victim to visit a crafted HTML page, after which the ANGLE Direct3D translation path leaks heap or stack contents that may include session tokens, cached credentials, or other browser-resident data. No active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.20% at the 10th percentile reflects very low current exploitation activity despite the CVSS C:H rating.
Out-of-bounds read in Chrome's V8 JavaScript engine allows a memory disclosure attack against users running Google Chrome prior to 150.0.7871.46. An attacker who socially engineers a victim into installing a crafted malicious extension can trigger the OOB read to leak sensitive data from the renderer process memory, such as tokens or session material. No public exploit code has been identified and SSVC classifies exploitation as none, but the high confidentiality impact and Chrome's global install base make patching the appropriate near-term action.
Out-of-bounds read in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome prior to 150.0.7871.46 exposes process memory to remote attackers via a crafted HTML page. An unauthenticated remote attacker can cause a victim's browser to disclose potentially sensitive process memory - such as cached credentials or heap artifacts - with no integrity or availability impact. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS at 0.23% (14th percentile) confirms low near-term exploitation probability.
Out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction layer) prior to version 150.0.7871.46 allows a remote attacker to extract potentially sensitive data from the browser's process memory by directing a victim to a crafted HTML page. The CVSS vector confirms network delivery with no authentication required but mandates user interaction, and the High confidentiality impact (C:H) indicates that in-memory data such as session tokens, cached credentials, or page content could be exposed. SSVC assessment records no active exploitation and the flaw is absent from the CISA KEV catalog; a vendor patch has been released and no public exploit code has been identified at time of analysis.
Cross-origin data exfiltration in Google Chrome's ANGLE graphics layer exposes sensitive browser memory contents to remote attackers who can induce a victim to visit a crafted HTML page. The out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction engine) affects all Chrome desktop versions prior to 150.0.7871.46, confirmed by Google's stable channel advisory. No public exploit code or active exploitation has been identified at time of analysis; an EPSS of 0.17% (7th percentile) reflects minimal current weaponization pressure despite the high confidentiality impact assigned in CVSS.
Cross-origin data leakage in Google Chrome on Windows prior to 150.0.7871.46 stems from an out-of-bounds read in ANGLE, the browser's graphics abstraction layer. Remote attackers can exploit this by serving a crafted HTML page to a Windows user, causing the ANGLE subsystem to read memory beyond its intended buffer boundary and exposing data belonging to a separate web origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates low exploitation probability in the near term.
Integer overflow in Chrome's ANGLE graphics abstraction layer on Windows enables a remote attacker, who has already compromised the renderer process, to read potentially sensitive data from process memory. The attack requires a user to visit a crafted HTML page, making this a second-stage component in a multi-step exploit chain rather than a standalone critical flaw. No public exploit code has been identified and CISA has not added this to the KEV catalog; Chrome 150.0.7871.46 resolves the issue.
Insufficient input validation in Skia, Chrome's 2D graphics library, exposes process memory to an attacker who has already achieved renderer process compromise. Affected versions of Chrome prior to 150.0.7871.46 can leak potentially sensitive in-memory data when the victim visits a crafted HTML page. No public exploit code exists and no active exploitation is confirmed - EPSS at 0.22% (12th percentile) and SSVC Exploitation: none corroborate low near-term risk despite the High confidentiality impact rating.
UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 150.0.7871.46) enables remote attackers to misrepresent security indicators during Progressive Web App installation prompts via a crafted HTML page. The incorrect security UI (CWE-451) can deceive users into believing they are installing a legitimate, trusted application when they are not, resulting in a low-integrity impact. EPSS is 0.18% (8th percentile), no public exploit code exists, and this vulnerability has not been added to CISA KEV, indicating minimal active exploitation risk at time of analysis.
UI spoofing in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.46) allows a remote attacker who has already compromised the renderer process to mislead users through a crafted HTML page. The attack requires renderer process compromise as a prerequisite, making this a chained exploit component rather than a standalone threat. EPSS at 0.18% (8th percentile) and absence from CISA KEV confirm no known active exploitation; Chromium's own team rated this Low severity.
UI spoofing via a crafted PDF file in Google Chrome's PDFium rendering engine allows a remote, unauthenticated attacker to visually mislead users into performing unintended actions or trusting falsified content. All Chrome versions prior to 150.0.7871.46 are affected. Exploitation requires the victim to open a malicious PDF - no special configuration is needed beyond default Chrome behavior. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Race condition in the Linux kernel HSR (High-availability Seamless Redundancy) subsystem triggers a WARN_ONCE() during device teardown, potentially causing denial of service on affected systems. The flaw exists in hsr_addr_is_self() at net/hsr/hsr_framereg.c:39, where hsr->self_node is NULLed by hsr_del_self_node() before unregister_netdevice_many() completes, leaving a window for concurrent packet transmission to access a NULL pointer. On kernels configured with panic_on_warn=1, this warning escalates to a full kernel panic; no public exploit identified at time of analysis, and the vulnerability was discovered by Google's syzbot kernel fuzzer with EPSS at the 5th percentile.
Reflected Cross-Site Scripting in Wp Google Places Review Slider (WordPress plugin, versions ≤ 18.1) allows unauthenticated remote attackers to inject arbitrary JavaScript via the unsanitized `place` GET parameter in `admin/partials/googlecrawl_dfs.php`. The raw user input is URL-decoded and passed through `stripslashes()` before being echoed directly into an HTML value attribute — bypassing WordPress's standard `esc_attr()` — but only when the supplied place value is not already present as a key in the `wprev_google_crawls` stored option. No public exploit identified at time of analysis; successful exploitation requires tricking an authenticated WordPress administrator into clicking a specially crafted link.
Same-origin policy bypass in Google Chrome's StorageAccessAPI allows an attacker who has already compromised the Chrome renderer process to further escalate access via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The integrity impact is rated High (I:H) in the CVSS vector, meaning cross-origin data writes or manipulations become possible, but only as a second-stage component in a chained exploit. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none with partial technical impact - consistent with the renderer pre-compromise prerequisite that substantially limits standalone risk.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 exposes sensitive user data from other origins when a victim visits a specially crafted HTML page that exploits insufficient policy enforcement in the StorageAccessAPI. The API, designed to manage third-party storage access in privacy-restricting browser contexts, fails to enforce cross-origin boundaries correctly, allowing an attacker to read data belonging to unrelated origins. No active exploitation has been confirmed - CVE is absent from CISA KEV, EPSS rates exploitation likelihood at 0.17% (7th percentile), and SSVC classifies exploitation status as none - though the CVSS confidentiality impact is rated High.
UI spoofing in Google Chrome's DevTools component allows an attacker to misrepresent critical interface information to users who have been socially engineered into installing a malicious Chrome Extension. Affected versions are all Chrome releases prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-451) in DevTools, enabling an extension to manipulate how DevTools renders UI elements - potentially deceiving developers or power users into trusting falsified debugging output or security indicators. No public exploit code has been identified at time of analysis, and this vulnerability is not in the CISA KEV catalog.
UI spoofing in the Glic component of Google Chrome (all versions prior to 150.0.7871.47) enables a remote attacker to misrepresent browser interface elements via a crafted HTML page, provided the victim is socially engineered into performing specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns high confidentiality impact, suggesting the spoofed UI can be leveraged to elicit disclosure of sensitive information such as credentials or session data. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
UI spoofing via the Speech component in Google Chrome prior to 150.0.7871.47 requires an attacker to have already compromised the renderer process, making this a chained, second-stage exploit rather than a standalone remote attack. The vulnerability stems from insufficient input validation (CWE-20) in Chrome's Speech subsystem, enabling a renderer-compromised attacker to manipulate browser UI elements through a crafted HTML page. No public exploit code exists, SSVC assessment confirms no active exploitation, and an EPSS score of 0.17% (7th percentile) reflects a very low probability of mass exploitation - consistent with Google's own 'Low' internal severity rating.
Type confusion in the CSS processing engine of Google Chrome prior to 150.0.7871.47 enables remote attackers to read potentially sensitive data from renderer process memory by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no attacker privileges required, though a single user interaction - visiting the malicious page - is necessary. No public exploit code has been identified, CISA SSVC rates exploitation as none at time of analysis, and Chromium's own team classified severity as Low, suggesting limited practical memory disclosure value despite the NVD CVSS C:H rating.
Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 150.0.7871.47 allows remote attackers to inject arbitrary scripts or HTML across origin boundaries by exploiting an inappropriate implementation in Chrome's CSS engine via a crafted HTML page. Unlike application-level XSS, this browser-level flaw bypasses same-origin protections, meaning injected scripts can execute in the context of any open origin. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a patch-promptly, not emergency-response, priority.
Cross-origin data leak in Google Chrome's CSS implementation (versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive data from other origins when a victim visits a specially crafted HTML page. The vulnerability stems from inappropriate CSS handling that creates a side-channel bypassing same-origin policy protections, resulting in high-confidentiality-impact information disclosure with no integrity or availability consequences. No public exploit has been identified and exploitation has not been observed in the wild; CISA SSVC rates exploitation as none and technical impact as partial, aligning with Google's internal Low severity classification despite the NVD CVSS 6.5 score.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML by luring a user to a crafted web page, with the scope change (S:C) in the CVSS vector indicating potential Same-Origin Policy bypass affecting other loaded origins. No public exploit or active exploitation is identified at time of analysis - EPSS sits at 0.17% (6th percentile) and SSVC exploitation status is rated 'none.' A vendor-released patch is available in stable channel 150.0.7871.47.
UI spoofing in Google Chrome's Views component (versions prior to 150.0.7871.47) allows a remote attacker to misrepresent security-critical browser interface elements through a crafted HTML page. Exploitation requires convincing a target user to perform specific UI gestures, making the attack conditional on social engineering. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; Google has released a patch as part of the stable channel update.
UI spoofing in Google Chrome's Passwords feature on iOS (versions prior to 150.0.7871.47) enables remote attackers to manipulate the presentation of security-critical password UI elements via a specially crafted HTML page. Users who visit a malicious page in Chrome on iOS may see misleading security indicators or spoofed password dialogs, potentially deceiving them into unintended credential interactions. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and SSVC confirms no observed exploitation - risk is real but low-priority relative to the broader threat landscape.
UI spoofing in Google Chrome's Extensions implementation (all versions prior to 150.0.7871.47) enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to render deceptive UI elements through a crafted HTML page, potentially misleading users into unintended interactions. The vulnerability carries a CVSS 5.4 Medium score, though Chromium's internal rating is Low, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation probability. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Domain spoofing via incorrect security UI in Google Chrome's Document Picture-in-Picture feature on Android (prior to 150.0.7871.47) allows a remote attacker to deceive users about the origin of displayed content. By serving a crafted HTML page, an attacker can cause Chrome on Android to render a misleading security UI - misrepresenting the domain shown to the user. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none, making this a low operational priority despite its network-accessible attack vector.
UI spoofing in Google Chrome for Android prior to 150.0.7871.47 enables remote unauthenticated attackers to deceive users about page origin or content through insufficient validation of untrusted input in the browser's Input component. Exploitation requires user interaction - a victim must visit a crafted HTML page - and produces only limited integrity impact (visual deception), with no code execution or data exfiltration capability. No public exploit identified at time of analysis; EPSS sits at 0.18% (8th percentile) and CISA SSVC confirms zero observed exploitation, consistent with Google's own 'Low' severity classification for this Chromium issue.
UI spoofing in Google Chrome's TabStrip component prior to version 150.0.7871.47 allows a remote attacker to misrepresent tab or page identity through a crafted HTML page, contingent on convincing the victim to perform specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) places real-world risk in the lower tier: high attack complexity, mandatory user interaction, and no confidentiality impact combine to limit practical exploitation. No public exploit code exists and CISA has not added this to the KEV catalog, consistent with Google's own Low severity classification.
UI spoofing in Google Chrome's WebAppInstalls component on Windows (versions prior to 150.0.7871.47) enables a remote attacker to misrepresent the browser interface by luring a user into performing specific UI interaction gestures on a crafted HTML page. The flaw is Windows-platform-specific and rooted in an inappropriate implementation of the Progressive Web App installation UI flow. Google rates this Low severity; no public exploit identified at time of analysis, and EPSS data is not present in the provided intelligence, but the CVSS 4.2 score and required high-complexity user interaction significantly limit real-world risk.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to manipulate browser interface elements via a crafted HTML page, provided the attacker can lure the victim into performing specific UI gestures. The root cause is insufficient validation of untrusted HTML input (CWE-20) within Chrome's iOS-specific rendering layer, resulting in low-integrity and low-availability impact. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog; Chromium's own severity classification is Low.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent browser interface elements by delivering a crafted HTML page to a victim who visits it. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw arises from insufficient validation of untrusted HTML input in the iOS-specific Chrome rendering pipeline, enabling manipulation of trust signals such as address bar display or security indicators. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation: none confirm negligible current threat actor interest.
UI spoofing in Google Chrome's Network component (versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, allowing browser UI elements to be faked via a crafted HTML page. This is a chained exploit - not a standalone flaw - requiring both prior renderer compromise and user interaction, which significantly constrains real-world risk. No public exploit code exists and no confirmed active exploitation has been recorded; EPSS at 0.18% (8th percentile) and Chromium's own 'Low' severity rating reinforce this assessment.
UI spoofing via Google Chrome's Autofill implementation on Android (prior to 150.0.7871.47) allows remote unauthenticated attackers to misrepresent interface elements through a crafted HTML page, potentially deceiving users into disclosing sensitive input or taking unintended actions. The vulnerability is platform-specific to Android and carries a Chromium-internal severity of Low, consistent with its limited integrity-only impact and requirement for user interaction. No public exploit code or active exploitation has been identified at time of analysis, and EPSS probability sits at 0.17% (7th percentile), confirming minimal real-world threat pressure.
UI spoofing via race condition in Google Chrome's History Embeddings component (versions prior to 150.0.7871.47) enables remote attackers to present falsified browser interface elements to users through a crafted HTML page. The flaw requires both high attack complexity - a precisely timed race window - and victim interaction, yielding only limited confidentiality and integrity impact with no code execution capability. No public exploit or active exploitation has been identified; EPSS at 0.14% (4th percentile) and SSVC exploitation status of 'none' confirm extremely low real-world exploitation probability at time of analysis.
UI spoofing in Google Chrome's WebXR component (all versions prior to 150.0.7871.47) allows remote attackers to misrepresent browser interface elements when a victim visits a crafted HTML page. The flaw stems from an inappropriate implementation in the WebXR Device API, enabling manipulation of what the user perceives as trusted UI - potentially obscuring origin indicators, security state, or page identity. No public exploit code exists and EPSS stands at 0.18% (8th percentile); CISA SSVC rates exploitation as none with partial technical impact, placing this firmly in the lower-priority tier despite its network-accessible vector.
UI spoofing in Google Chrome's WebAppInstalls component (prior to 150.0.7871.47) is reachable only after an attacker has already compromised the Chrome renderer process, making this a chained, post-exploitation capability rather than a standalone entry point. With a compromised renderer, the attacker can serve a crafted HTML page that bypasses insufficient input validation in WebAppInstalls to forge Chrome's native UI - potentially deceiving users into trusting malicious web app install prompts or dialogs. No public exploit or active exploitation (CISA KEV) is confirmed; EPSS sits at 0.18% (8th percentile), consistent with the high prerequisite barrier and Chromium's own 'Low' severity rating.
UI spoofing in Google Chrome's Omnibox (address bar) prior to version 150.0.7871.47 allows a remote attacker to misrepresent origin or security indicators to a victim via a crafted HTML page. Rooted in CWE-451 (misrepresentation of critical security information), the flaw can enable phishing or origin-confusion attacks by deceiving users into trusting a false domain indicator. No public exploit code exists, CISA SSVC rates exploitation as none, and the EPSS score of 0.18% (8th percentile) confirms this is low-priority outside phishing-sensitive deployments.
UI spoofing in Google Chrome for Android (prior to 150.0.7871.47) via the PreviewTab feature allows remote attackers to misrepresent interface elements through a crafted HTML page. Successful exploitation requires high attack complexity - specifically, the attacker must convince a victim to perform particular UI gestures - limiting this to targeted rather than opportunistic attacks. No active exploitation or public proof-of-concept has been identified; the Chromium security team rates this as Low severity, consistent with its constrained CVSS 4.2 score.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to display false URL content in the browser's address bar by luring a user to a crafted HTML page, creating a credible phishing vector. The flaw stems from inappropriate implementation in the iOS-specific Omnibox rendering logic (CWE-451), distinct from Chrome's desktop codebase. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible opportunistic exploitation probability at this time.
UI spoofing in Google Chrome's Printing subsystem (all versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, enabling misrepresentation of critical browser UI via a crafted HTML page. This is a post-exploitation primitive rather than an initial-access vector - the renderer must be independently compromised before this flaw is reachable. No public exploit code exists and CISA SSVC rates exploitation as none, consistent with the low EPSS score of 0.18% (8th percentile), placing real-world urgency squarely in routine maintenance rather than emergency response.
Domain spoofing in Google Chrome for Android (versions prior to 150.0.7871.47) allows remote attackers to deceive users about the origin of a webpage by exploiting incorrect rendering of security-critical UI elements via a crafted HTML page. User interaction is required - the victim must navigate to the attacker-controlled page - and impact is limited to integrity (UI misrepresentation), with no direct confidentiality or availability consequences. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.17% at the 7th percentile reflects minimal real-world exploitation activity; Google itself rates this 'Low' severity.
Uninitialized memory use in Chrome's ANGLE graphics layer exposes potentially sensitive process memory contents to remote attackers who can entice a user to visit a crafted HTML page. The flaw affects all Chrome versions prior to 150.0.7871.47, with High confidentiality impact per CVSS despite Google's own Chromium severity rating of Low - a discrepancy suggesting practical extraction of meaningful data is constrained in real-world conditions. No public exploit identified at time of analysis, and no CISA KEV listing; a vendor patch has been released.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to display a fraudulent URL in the browser's address bar by delivering a crafted HTML page. The root cause is classified as CWE-451 (UI Misrepresentation of Critical Information), meaning the security UI fails to accurately reflect the true origin of displayed content - a condition that directly undermines phishing defenses. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates very low observed exploitation pressure, consistent with the Chromium team's own 'Low' severity rating.
Type confusion in Chrome's Bluetooth stack on Windows (versions prior to 150.0.7871.47) enables an adjacent-network attacker to exfiltrate sensitive data from Chrome process memory by presenting a malicious Bluetooth peripheral. The CVSS 6.5 score reflects high confidentiality impact but no integrity or availability exposure; notably, Chromium's internal security team rated this Low severity, suggesting the memory regions accessible are constrained. No public exploit code and no CISA KEV listing exist at time of analysis, and exploitation is physically bounded by Bluetooth range.
Cross-origin data leak in Google Chrome DevTools prior to version 150.0.7871.47 exposes sensitive information from foreign origins when a victim visits a crafted HTML page and performs attacker-directed UI gestures. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability consequences. No public exploit identified at time of analysis, and EPSS of 0.18% at the 8th percentile - combined with Chromium's own 'Low' severity classification - signals limited real-world exploitation likelihood despite the Medium NVD score.
Memory disclosure via DevTools in Google Chrome on Windows (prior to 150.0.7871.47) enables a remote attacker to read sensitive process memory contents by delivering a crafted HTML page and manipulating the victim into performing specific UI gestures. The vulnerability is Windows-platform-exclusive and carries a Chromium-internal severity of Low, consistent with SSVC's assessment of no current exploitation and non-automatable delivery. No active exploitation or public exploit code has been identified at time of analysis, though the CVSS C:H rating reflects meaningful confidentiality risk if successfully triggered.
Cross-origin data leakage in Google Chrome's DevTools component (all versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive cross-origin information by convincing a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from CWE-20 (Improper Input Validation) within DevTools, allowing the Same-Origin Policy to be bypassed under attacker-directed user interaction. No active exploitation is confirmed - SSVC rates exploitation as 'none,' EPSS is 0.18% (8th percentile), and the vulnerability is absent from the CISA KEV catalog - with a vendor-released patch available as Chrome 150.0.7871.47.
Process memory disclosure in Google Chrome Enterprise (versions prior to 150.0.7871.47) enables a remote unauthenticated attacker to leak potentially sensitive contents from the browser's process memory by serving a crafted HTML page that induces the victim into performing specific UI gestures. The underlying flaw is classified as CWE-203 (Observable Discrepancy), indicating a side-channel in Chrome's Enterprise component where behavioral differences during UI interactions expose in-memory data. No public exploit code exists and this vulnerability is absent from CISA KEV; EPSS at 0.22% (12th percentile) and SSVC exploitation status of 'none' collectively confirm this is a low-probability exploitation target at time of analysis.
UI spoofing in Google Chrome's DarkMode implementation (all versions prior to 150.0.7871.47) enables remote attackers to misrepresent page content or interface elements by serving a crafted HTML page to a victim. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the rendering pipeline fails to present information accurately, potentially deceiving users into unsafe actions such as credential entry or approval of deceptive prompts. No public exploit has been identified at time of analysis, EPSS is 0.18% (8th percentile), and CISA's SSVC framework rates exploitation as none - signals that collectively place this at low operational priority despite its network reachability.
Same-origin-policy bypass in Google Chrome's Speech component before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page cross origin boundaries via insufficient policy enforcement. No public exploit identified at time of analysis and EPSS is low (0.18%, 8th percentile); notably, Google's own Chromium team rated this Low severity even though NVD scored it CVSS 9.6, a significant conflict defenders should weigh. Requires user interaction (visiting the page) and affects all Chrome desktop builds prior to the fixed stable release.
Use-after-free in Chrome's SSL handling on ChromeOS exposes process memory contents to remote attackers who can serve a crafted HTML page. Only ChromeOS builds of Chrome prior to 150.0.7871.47 are affected - this is not a cross-platform flaw. SSVC rates exploitation status as none and technical impact as partial, and Chromium's own severity classification is Low, making this a routine patch-cycle priority rather than an emergency response item despite the CVSS 6.5 score.
Cross-origin data leakage in Google Chrome's NetworkCache component affects all desktop versions prior to 150.0.7871.47, enabling remote attackers to read sensitive cached data belonging to other origins. Exploitation requires a victim to visit a specially crafted HTML page, placing this squarely in the browser-based phishing and malvertising threat model. No public exploit code or active exploitation has been identified; an EPSS score of 0.17% (7th percentile) and Chromium's own Low severity classification indicate low immediate exploitation probability despite the Medium CVSS base score.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 allows a remote attacker who can lure a user to a crafted HTML page to bypass same-origin isolation via an inappropriate CSS implementation and exfiltrate sensitive data from other origins. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) reflects high confidentiality impact with no integrity or availability effects, though Chromium's own security team rated severity as Low and SSVC confirms no current exploitation. No public exploit code has been identified, and EPSS of 0.17% (7th percentile) aligns with the low observed exploitation probability.
Cross-origin data leakage in Google Chrome for Android (prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin information through a crafted HTML page, exploiting an inappropriate implementation in Chrome's Input component (CWE-200). The attack requires both a pre-existing renderer compromise and user interaction with a malicious page, creating a chained exploitation prerequisite that substantially lowers real-world risk below what the 6.5 CVSS score implies. No public exploit has been identified and SSVC confirms exploitation status as none, consistent with EPSS placing this in the bottom 7th percentile of exploitation likelihood.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 enables an on-path network adversary to bypass Chrome's privacy policy enforcement and observe data belonging to a different origin via crafted malicious network traffic. The flaw is classified as CWE-693 (Protection Mechanism Failure), indicating Chrome's privacy isolation layer fails to correctly enforce cross-origin restrictions under certain network conditions. EPSS sits at 0.11% (2nd percentile), no public exploit code is known, and the vulnerability has not been added to CISA KEV; Chromium itself rates this Low severity.
UI spoofing in Google Chrome's PopupBlocker component (all versions prior to 150.0.7871.47) enables a remote attacker who has already compromised the Chrome renderer process to manipulate browser UI elements through a crafted HTML page. The integrity impact is limited to UI deception - no code execution, credential theft, or availability impact is possible through this flaw alone. EPSS at 0.17% (7th percentile) and Chromium's own 'Low' severity rating align with the constrained exploit chain; no public exploit or CISA KEV listing exists at time of analysis.
Uninitialized memory read in the Canvas API of Google Chrome on Android (prior to 150.0.7871.47) exposes potentially sensitive process memory contents to remote attackers. Exploitation requires luring a target to a crafted HTML page, after which the uninitialized Canvas buffer may leak memory from the renderer process. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; Chromium's own security team rates severity as Low despite the NVD CVSS score of 6.5.
CSS side-channel information leakage in Google Chrome prior to 150.0.7871.47 enables remote attackers to exfiltrate cross-origin data by luring victims to a crafted HTML page. The CVSS vector rates confidentiality impact as High (C:H) with network access and no authentication required from the attacker, though user interaction is necessary. Despite the NVD Medium score of 6.5, Google's internal Chromium severity rating is Low, EPSS sits at just 0.17% (7th percentile), there is no KEV listing, and no public exploit has been identified at time of analysis - signals that collectively indicate limited real-world exploitability.
Universal Cross-Site Scripting (UXSS) in Google Chrome before 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML across security origins by serving a crafted HTML page to a victim user. The flaw stems from insufficient input validation in Chrome's HTML handling (CWE-20), and its Scope:Changed CVSS metric confirms the core danger: injected scripts escape the attacker-controlled origin and execute in the context of other web origins, undermining the browser's same-origin policy. No public exploit code or CISA KEV listing is identified at time of analysis; EPSS stands at 0.18% (8th percentile), consistent with the vendor's own 'Low' Chromium severity classification despite a NVD CVSS score of 6.1.
Cross-origin data leakage in Google Chrome's Storage component prior to version 150.0.7871.47 enables remote attackers to read data belonging to a different origin by exploiting a race condition triggered via a crafted HTML page. The Chromium security team internally rated this as Low severity - a notable contrast to the CVSS 6.5 score reflecting High confidentiality impact - suggesting the practical exploitation window or data exposure scope is constrained in real-world conditions. No public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) confirms negligible observed exploitation activity.
Insufficient policy enforcement in Chrome's DevTools component allows a crafted malicious extension to read potentially sensitive data from process memory. Affected versions are all Google Chrome releases prior to 150.0.7871.47 on desktop platforms. An attacker must first persuade a victim to install the malicious extension, after which the extension can silently extract in-memory data - including session tokens, credentials, or page content resident in the Chrome process - without triggering further user interaction. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
Navigation restriction bypass in Google Chrome for Android (prior to 150.0.7871.47) allows a remote attacker to circumvent browser navigation controls through crafted malicious network traffic targeting the TabSwitcher component. The flaw stems from insufficient input validation (CWE-20) in the tab management UI and requires user interaction to trigger, limiting its practical reach. With an EPSS score of 0.17% (7th percentile), no public exploit code, no CISA KEV listing, and Chromium's own internal severity rating of Low, real-world exploitation risk is minimal despite network reachability.
Same-origin policy bypass in Google Chrome's Network component (versions prior to 150.0.7871.47) allows a remote attacker to violate cross-origin isolation by delivering a crafted HTML page to a victim. The flaw, rooted in CWE-346 (Origin Validation Error), enables unauthorized cross-origin integrity impacts - an attacker can cause a browser to act on or submit data across origin boundaries it should enforce. With an EPSS of 0.18% at the 8th percentile, no CISA KEV listing, and no public exploit identified, active exploitation risk is low at this time, though Chrome's ubiquitous deployment ensures broad attack surface if exploitation techniques mature.
Omnibox (URL bar) spoofing in Google Chrome on macOS prior to version 150.0.7871.47 enables a remote attacker to display a falsified URL in the browser's address bar by delivering a crafted HTML page exploiting an inappropriate Select element implementation. The deception targets the user's trust in the origin indicator - the primary browser security signal - making this a phishing and social engineering enabler rather than a direct code execution or data exfiltration vector. No public exploit exists and EPSS exploitation probability stands at 0.17% (7th percentile), with no confirmed active exploitation; vendor-released patch is available in Chrome 150.0.7871.47.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 allows a remote attacker to circumvent network-level policy enforcement by delivering a crafted HTML page to a victim. The Chrome security team internally rated this as Low severity, consistent with the CVSS 4.3 score and an impact limited to integrity (I:L) with no confidentiality or availability consequences. No public exploit code or active exploitation has been identified; EPSS places this in the 8th percentile of exploitation likelihood.
No-referrer policy bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to capture referrer URL information that the browser was supposed to suppress. Exploitation requires user interaction - the victim must visit a crafted HTML page served by the attacker - and exploits a client-side enforcement gap (CWE-602) specific to the iOS build of Chrome. EPSS is 0.19% (9th percentile) and no active exploitation or KEV listing exists, consistent with the Low Chromium severity rating.
Side-channel information leakage in the WebAuthentication component of Google Chrome on iOS (prior to 150.0.7871.47) exposes cross-origin data to remote attackers via a crafted HTML page, requiring only that a victim visit attacker-controlled content. The CVSS Confidentiality:High rating reflects the category of cross-origin data exposure, while Chromium's own internal severity classification of Low and an EPSS score of 0.21% (11th percentile) both signal that practical exploitation is considered unlikely at scale. No public exploit is identified at time of analysis and no CISA KEV listing exists.
Navigation restriction bypass in Google Chrome's WebXR component affects all versions prior to 150.0.7871.47, exploitable by a remote unauthenticated attacker who can induce a user to visit a crafted HTML page. The root cause is insufficient input validation (CWE-20) within the WebXR subsystem, resulting in limited integrity impact via unauthorized navigation. No public exploit exists and EPSS sits at 0.18% (8th percentile), consistent with the Chromium team's own Low severity classification - this represents a genuine but low-priority risk.
UI spoofing in Google Chrome's SplitView feature prior to version 150.0.7871.47 enables remote attackers to misrepresent the origin or content of browser UI elements by delivering a crafted HTML page to a victim. Exploitation is limited to integrity impact only - no data exfiltration or availability disruption is possible directly - though the spoofing could facilitate social engineering leading to credential theft. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), classifying this as a routine-patch-cycle item despite Chrome's ubiquitous deployment.
Side-channel information leakage via the WebAudio API in Google Chrome prior to 150.0.7871.47 enables a remote attacker to extract cross-origin data from a victim's browser session through a crafted HTML page. The vulnerability abuses WebAudio's timing or spectral measurement capabilities to infer data that should be isolated by the Same-Origin Policy, exposing potentially sensitive cross-origin resources. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.17% at the 7th percentile reflects very low current exploitation probability; Chromium's own team rated the severity as Low despite the NVD's Medium (6.5) CVSS assignment.
Integer overflow in Chrome's WebNN (Web Neural Network API) component prior to version 150.0.7871.47 enables remote attackers to read potentially sensitive data from browser process memory by luring a user to a crafted HTML page. The attack requires no privileges and no special configuration, but mandates user interaction - the victim must navigate to a malicious page. No public exploit identified at time of analysis; CISA SSVC rates exploitation as none with partial technical impact, and Google itself assigned a Low Chromium severity, suggesting real-world impact is constrained by browser sandboxing despite the CVSS C:H rating.