Monthly
Integer overflow in the WebNN component of Google Chrome prior to 150.0.7871.47 allows an unauthenticated remote attacker to read potentially sensitive data from Chrome's process memory. Exploitation requires convincing a victim to visit a crafted HTML page, placing this in the class of user-interaction-dependent browser memory disclosure vulnerabilities. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as 'none' and Chromium's own triage assigns 'Low' severity, suggesting the disclosed memory is constrained in practice.
Universal Cross-Site Scripting (UXSS) in Chrome's Omnibox on iOS enables remote attackers to inject arbitrary scripts or HTML across security origins by luring users into performing specific UI gestures on a crafted page. Affected versions are Chrome for iOS prior to 150.0.7871.47; the desktop channel is not affected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating despite the scope-changed CVSS vector.
Navigation restriction bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The flaw is confined to the iOS platform - Chrome on Android, Windows, macOS, and Linux is unaffected - and requires the victim to actively visit the attacker-controlled page (UI:R). With a CVSS score of 4.3 (Medium), an EPSS of 0.19% (9th percentile), no CISA KEV listing, and a Chromium-internal severity rating of Low, this vulnerability carries minimal real-world exploitation risk but warrants patching given its zero-privilege attack vector.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables attackers who have already achieved renderer process compromise to escape certain navigation-level security controls via a crafted HTML page. The flaw resides in the PageInfo component, which handles page metadata, security indicators, and related navigation policy enforcement, and fails to adequately validate attacker-controlled input passed from a compromised renderer. With an EPSS of 0.22% (13th percentile), no CISA KEV listing, and a Chromium-internal severity of Low, real-world exploitation risk is currently low despite the CVSS 6.5 medium rating.
Out-of-bounds read in Chrome's Chromecast component allows a local attacker to leak sensitive contents from the browser's process memory by delivering malicious network traffic to the affected subsystem. Affected versions are all Chrome releases prior to 150.0.7871.47 on desktop platforms. No public exploit code or CISA KEV listing is identified at time of analysis, and Google's own severity rating is Low, though the CVSS confidentiality impact is scored High due to potential direct process memory exposure.
Process memory disclosure in Google Chrome's Views UI framework on ChromeOS allows a crafted extension, once installed by a user, to read potentially sensitive data from Chrome's process memory. All ChromeOS Chrome versions prior to 150.0.7871.47 are affected; desktop Chrome on Windows, macOS, and Linux is not confirmed in scope. No public exploit has been identified at time of analysis, and Chromium's own internal severity rating is Low - tempering the NVD CVSS 5.9 score - indicating Google's security team assessed limited practical exploitability.
Process memory disclosure in Google Chrome's Dawn WebGPU component (versions prior to 150.0.7871.47) enables remote attackers to read potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The flaw is categorized under CWE-284 (Improper Access Control) within the Dawn graphics abstraction layer, which underpins Chrome's WebGPU implementation. No public exploit code or CISA KEV listing has been identified at time of analysis, and Google's own Chromium security team rates the severity as Low despite the NVD CVSS score of 6.5.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 stems from insufficient policy enforcement in the Related-Website-Sets feature, enabling a remote attacker to read sensitive cross-origin data by delivering a crafted HTML page to a victim. The CVSS 6.5 score with High confidentiality impact reflects meaningful exposure potential, though Google internally rated this as Low severity and EPSS sits at 0.17% (7th percentile), suggesting limited real-world exploitation risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 stems from insufficient policy enforcement in the browser's Parser component, allowing a remote unauthenticated attacker to circumvent CSP protections via a crafted HTML page. The attacker achieves limited integrity impact (I:L) - able to load or execute content that a properly enforced CSP would block - but gains no confidentiality or availability impact. EPSS is low at 0.22% (13th percentile), no active exploitation has been confirmed (not in CISA KEV), and Chromium internally rated this Low severity, making it a real but low-priority finding.
Same-origin policy bypass in Google Chrome's FedCM (Federated Credential Management) implementation allows remote attackers to perform limited cross-origin integrity manipulation by luring a victim to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. With an EPSS of 0.18% (8th percentile), no CISA KEV listing, and no public exploit identified, this represents a low-probability exploitation scenario despite being trivially deliverable via a web page.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 allows a remote attacker to circumvent network-layer policy enforcement by inducing a user to visit a specially crafted HTML page. Rooted in CWE-602 (client-side enforcement of server-side security), the flaw means Chrome's network policy checks governing navigation can be subverted client-side, yielding a low-integrity impact with no confidentiality or availability consequence. No public exploit has been identified and the EPSS exploitation probability stands at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating - this is a low-urgency but genuine policy-enforcement gap.
Cross-origin data leakage in Google Chrome's Extensions subsystem (versions prior to 150.0.7871.47) enables a remote attacker - who has first achieved renderer process compromise - to bypass same-origin policy enforcement and read cross-origin data via a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error) and rated Low severity by the Chromium security team. EPSS is extremely low at 0.17% (7th percentile), no CISA KEV listing exists, and no public exploit code has been identified, consistent with the significant chained exploitation barrier imposed by the renderer-compromise prerequisite.
FileSystem policy enforcement bypass in Google Chrome prior to version 150.0.7871.47 allows a remote attacker to circumvent discretionary access control via a crafted HTML page, resulting in limited unauthorized write operations within the browser's sandboxed filesystem scope. The vulnerability requires user interaction - the victim must navigate to a malicious page - and produces only an integrity impact (I:L) with no confidentiality or availability consequence. With an EPSS of 0.18% (8th percentile) and no CISA KEV listing, real-world exploitation probability is very low; no public exploit has been identified at time of analysis.
Uninitialized memory exposure in Google Chrome's GamepadAPI allows an attacker who has already achieved renderer process compromise to read potentially sensitive contents from process memory by serving a crafted HTML page that triggers the flaw. Affected versions are all Chrome releases prior to 150.0.7871.47. While the CVSS base score is 6.5 with high confidentiality impact, Chromium's own severity rating is Low, reflecting the significant prerequisite of prior renderer compromise that dramatically constrains real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor patch is available.
Cross-origin data leakage in Google Chrome's Passwords component prior to version 150.0.7871.47 enables remote attackers to exfiltrate credential-related or other sensitive cross-origin data by directing victims to a crafted HTML page. The root cause (CWE-693, Protection Mechanism Failure) represents a breakdown in the policy enforcement layer governing cross-origin access in the Passwords subsystem - a bypass of the isolation guarantees Chrome's same-origin model is meant to provide. No public exploit has been identified at time of analysis; EPSS of 0.17% (7th percentile) and the absence of a CISA KEV listing place real-world exploitation probability very low, and Chromium's own team rated the severity as Low despite the NVD CVSS 6.5 Medium score.
Memory disclosure in Google Chrome's GPU component (prior to 150.0.7871.47) allows an attacker who has already achieved renderer process compromise to extract potentially sensitive information from process memory via a crafted HTML page. The attack requires both user interaction and a pre-existing renderer compromise, making this a second-stage vulnerability most useful for ASLR bypass or credential harvesting within an exploit chain. No public exploit code or active exploitation (CISA KEV) has been identified; Google rates this as Low severity internally despite the NVD CVSS 5.3 Medium score.
Use-after-free in Chrome's Chromecast component exposes process memory to attackers on the same local network segment via a malicious peripheral, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H), meaning successful exploitation leaks potentially sensitive data from the Chrome process heap. No public exploit or CISA KEV listing is identified at time of analysis, and Google has released a patch in the stable channel.
Content Security Policy bypass in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 allows an attacker who socially engineers a victim into installing a crafted malicious extension to circumvent CSP protections, yielding limited integrity impact. CVSS UI:R and EPSS at 0.12% (2nd percentile) confirm this is a low-probability, user-interaction-dependent attack with no confidentiality or availability consequence. No KEV listing, no known POC, and Google's own 'Low' severity rating collectively position this as a low operational priority despite broad product prevalence.
Same-origin policy bypass in Google Chrome's CustomTabs component on Android (versions prior to 150.0.7871.47) permits remote attackers to perform limited cross-origin integrity violations by directing a victim to a crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's CustomTabs implementation incorrectly validates or enforces origin boundaries when rendering attacker-controlled content. No active exploitation has been confirmed (not in CISA KEV) and the EPSS score of 0.18% (8th percentile) reflects very low observed exploitation probability, consistent with the Low severity rating assigned by the Chromium security team.
Cross-origin data leakage in Google Chrome's Network component (versions prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data via a specially crafted HTML page. This is a chained vulnerability - renderer-process compromise is a hard prerequisite, meaning real-world risk is substantially lower than the network-accessible CVSS vector implies. No public exploit code has been identified and EPSS sits at the 7th percentile (0.17%), consistent with limited exploitation interest. Google has released a fix in the stable channel update to 150.0.7871.47.
UI spoofing in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to misrepresent security-relevant interface elements to victims via a specially crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability is rooted in CWE-451 (UI Misrepresentation of Critical Information) and is limited to low-integrity impact with no confidentiality or availability consequence. No public exploit identified at time of analysis; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' both indicate negligible real-world exploitation likelihood.
Same-origin policy bypass in Google Chrome's GetUserMedia implementation prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to achieve limited cross-origin integrity impact by delivering a crafted HTML page to a victim. Chromium's own severity classification is Low, consistent with the CVSS 4.3 score and an EPSS exploitation probability of just 0.18% (8th percentile). No public exploit code and no active exploitation have been identified at time of analysis; Google has issued a remediated build in Chrome 150.0.7871.47.
Insufficient Bluetooth policy enforcement in Google Chrome prior to 150.0.7871.47 allows remote attackers to read potentially sensitive data from browser process memory by luring a victim to a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 Medium at NVD, though Chromium's own severity rating is 'Low,' suggesting Chrome's sandbox architecture limits practical memory exposure. No public exploit code or active exploitation has been identified at time of analysis.
WebXR implementation flaw in Google Chrome on Android prior to 150.0.7871.47 permits remote attackers to bypass navigation restrictions by delivering a crafted HTML page to a victim. The vulnerability is Android-specific and requires user interaction to trigger, constraining its reach. With no CISA KEV listing, no public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile), this represents a low-priority integrity issue that Google itself rates as Low severity.
Site isolation bypass in Google Chrome's Media component on Windows allows remote attackers to circumvent cross-origin security boundaries by delivering a specially crafted HTML page to a victim. All Chrome for Windows releases prior to 150.0.7871.47 are affected. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC exploitation status of 'none' consistently indicate low current real-world risk despite the potential severity of an isolation bypass.
UI spoofing in Google Chrome's File Input component (versions prior to 150.0.7871.47) enables remote unauthenticated attackers to misrepresent the file selection interface through a crafted HTML page, potentially deceiving users into interacting with fraudulent UI elements. The flaw is classified as CWE-451 (UI Misrepresentation of Critical Information) and requires active user interaction with the malicious page, consistent with the CVSS UI:R metric. No public exploit code exists, CISA SSVC confirms exploitation status as none, and EPSS sits at a low 0.17% (7th percentile), collectively indicating negligible real-world exploitation pressure.
Omnibox (URL bar) spoofing in Google Chrome on Linux prior to 150.0.7871.47 is possible through an inappropriate SplitView implementation, allowing remote attackers to display false URLs to victims who are tricked into performing specific UI gestures on a crafted HTML page. This CWE-451 class flaw undermines browser trust indicators and enables phishing scenarios, though exploitation is constrained by high attack complexity and mandatory user interaction. No public exploit code or active exploitation has been identified; a vendor patch is available in the stable channel release.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to misrepresent security indicators to users who are socially engineered into performing specific UI gestures on a crafted HTML page. The root cause is incorrect rendering of security UI elements (CWE-451), classified by the Chromium team as Low severity. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, aligning with the modest CVSS 4.2 score and the high-complexity attack requirements.
UI spoofing via incorrect security rendering in Chrome's SplitView component allows a remote attacker to misrepresent security-critical UI elements to a victim running any Chrome version prior to 150.0.7871.47. The attacker must serve a crafted HTML page and successfully induce the victim into performing specific UI gestures, after which SplitView renders misleading security indicators - enabling phishing-class deception within a trusted browser context. No public exploit code exists and no active exploitation has been confirmed; the Chromium team itself rated this Low severity, consistent with the CVSS 4.2 score and high attack complexity.
Same-origin policy bypass in Google Chrome's SanitizerAPI before version 150.0.7871.47 allows a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page that exploits insufficient input validation. The flaw targets a security-critical browser API whose purpose is precisely to prevent unsafe HTML injection, making the bypass particularly notable. EPSS at 0.22% (13th percentile) indicates low near-term exploitation probability, and no active exploitation or public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's Network component (versions prior to 150.0.7871.47) enables a remote attacker who has already achieved renderer process compromise to bypass same-origin policy protections and exfiltrate sensitive cross-origin data via a crafted HTML page. This vulnerability functions as a second-stage exploit primitive within a chain - it does not enable initial access but extends the impact of an existing renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS of 0.21% (11th percentile) reflects low observed exploitation activity.
Cross-origin data leakage in Google Chrome's StorageAccessAPI (prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to read storage or cookie data belonging to other origins by delivering a crafted HTML page. This is a chained attack - the StorageAccessAPI policy bypass is the second stage of a multi-step compromise, not a standalone entry point. EPSS is very low (0.17%, 7th percentile), no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
UI spoofing in Google Chrome's WebXR subsystem (versions prior to 150.0.7871.47) is achievable by an attacker who has already compromised the renderer process, allowing manipulation of browser UI elements via a crafted HTML page. The vulnerability is a second-stage attack component, not a standalone entry point - exploitation chains through a separate renderer compromise before WebXR's insufficient input validation can be abused. EPSS at 0.17% (7th percentile) and no CISA KEV listing indicate minimal observed exploitation activity; patch is available as of Chrome 150.0.7871.47.
Cross-origin credential data leakage in Google Chrome's built-in Passwords feature (all versions prior to 150.0.7871.47) can be triggered remotely via a crafted HTML page requiring only user interaction. The flaw is rooted in an inappropriate implementation in Chrome's password management subsystem (CWE-522 - Insufficiently Protected Credentials), allowing a remote attacker to read data across origin boundaries that should be strictly isolated. No public exploit code is identified and EPSS stands at 0.17% (7th percentile), indicating limited exploitation pressure at time of analysis; however, Chrome's ubiquitous deployment makes the aggregate exposure significant.
Cross-origin data leakage in Google Chrome's SVG implementation prior to version 150.0.7871.47 allows a remote attacker to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw exploits improper SVG handling that bypasses same-origin policy protections, exposing potentially sensitive session data or authenticated content from third-party origins. No active exploitation has been confirmed (not listed in CISA KEV), and EPSS stands at 0.17% (7th percentile), indicating low observed exploitation probability at time of analysis.
Cross-origin data exfiltration in Google Chrome's WebRTC subsystem on Windows allows remote attackers to leak sensitive data from other origins by directing victims to a specially crafted HTML page. All Chrome on Windows versions prior to 150.0.7871.47 are affected. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) signals low near-term exploitation probability despite the CVSS High confidentiality impact - consistent with Chromium's own 'Medium' severity designation and the inherent timing-sensitivity of race condition attacks.
UI spoofing in Google Chrome's Paint rendering component (versions prior to 150.0.7871.47) enables remote attackers to misrepresent browser interface elements through a specially crafted HTML page, with the victim's visit being the sole prerequisite. The CVSS vector confirms high integrity impact (I:H) with no confidentiality or availability exposure, consistent with CWE-451 misrepresentation of critical UI information rather than code execution. No public exploit has been identified and EPSS sits at the 7th percentile (0.17%), indicating very low near-term exploitation probability; a vendor patch is confirmed available in the Chrome stable channel.
UI spoofing in Google Chrome prior to version 150.0.7871.47 is caused by an inappropriate SVG rendering implementation, enabling remote attackers to visually misrepresent browser UI elements through a crafted HTML page. Exploitation requires user interaction - the victim must visit a malicious page - and the direct impact is limited to integrity via visual deception, with no confidentiality or availability consequence. No public exploit has been identified and the EPSS score of 0.17% (7th percentile) confirms minimal exploitation activity at time of analysis.
CSS side-channel information leakage in Google Chrome prior to 150.0.7871.47 enables a remote attacker to read potentially sensitive data from the browser's process memory by inducing a victim to visit a specially crafted HTML page. The vulnerability is classified under CWE-1300 (Improper Protection of Physical Side Channels), indicating that observable rendering or timing behavior in Chrome's CSS engine can be exploited to infer in-memory state. No public exploit identified at time of analysis; however, the CVSS-assessed confidentiality impact is rated High, and Google has released a fix in Chrome stable channel version 150.0.7871.47.
Uninitialized memory use in Chrome's codec subsystem on Windows leaks process memory contents to remote attackers who can direct a user to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 on Windows are affected; exploitation requires no authentication but does require the victim to visit attacker-controlled content, placing this in the drive-by browsing threat category. No public exploit code has been identified at time of analysis, and Google has released a confirmed fix in stable channel 150.0.7871.47.
Uninitialized memory read in Google Chrome's WebXR subsystem on Android (versions prior to 150.0.7871.47) enables remote attackers to leak sensitive contents from process memory by inducing a victim to visit a crafted HTML page. The root cause is CWE-457 (use of an uninitialized variable) within the WebXR implementation, meaning memory buffers are consumed before being properly zeroed or assigned, exposing whatever residual data the process held. No public exploit or CISA KEV listing is identified at time of analysis, but the CVSS C:H rating reflects the potential for meaningful data exposure including in-memory credentials, tokens, or browsing context.
Insufficient PermissionsPolicy enforcement in Google Chrome prior to 150.0.7871.47 enables remote attackers to bypass navigation restrictions by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H) because an attacker can circumvent declarative browser navigation controls, potentially redirecting victims to unintended origins or overriding policy-enforced browsing constraints. No public exploit code exists and SSVC signals exploitation as none, placing this in a lower-priority patch tier despite the medium-high CVSS score.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 is exploitable by a remote, unauthenticated attacker who tricks a user into visiting a crafted HTML page that abuses an inappropriate CSS implementation to bypass same-origin policy protections. The confidentiality impact is rated high (C:H) because sensitive data from cross-origin resources - such as page content or authentication artifacts readable via CSS side-channels - can be exposed to the attacker-controlled page. No public exploit or active exploitation has been identified; EPSS stands at 0.21% (11th percentile) and SSVC corroborates with exploitation: none and automatable: no.
Cross-origin data leakage in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 allows crafted malicious extensions to bypass same-origin policy enforcement and exfiltrate data from web origins beyond their declared permissions. Exploitation requires convincing a target user to install the malicious extension, making this a social-engineering-dependent attack path rather than a direct network exploit. No active exploitation has been confirmed (absent from CISA KEV), no public proof-of-concept code has been identified, and EPSS at 0.11% (2nd percentile) corroborates negligible observed exploitation activity at time of analysis.
UI spoofing in Google Chrome's Geolocation implementation allows an attacker who has already compromised the renderer process to present misleading geolocation-related interface elements to the user via a crafted HTML page. Affected versions are all Chrome releases prior to 150.0.7871.47. The integrity impact is rated High (CVSS I:H) because the spoofed UI can deceive users into granting or believing geolocation permissions under false pretenses; no public exploit or CISA KEV listing exists, and the 0.17% EPSS score (7th percentile) reflects low observed exploitation probability.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Network component prior to 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML across security origins by tricking a user into visiting a crafted HTML page. Unlike application-level XSS, this browser-level flaw can bypass the Same-Origin Policy, potentially allowing injected scripts to interact with content from origins other than the attacker's page. No public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at a low 0.17% (7th percentile); a vendor-released patch is available.
Universal Cross-Site Scripting (UXSS) in Google Chrome's XML implementation permits remote attackers to inject arbitrary scripts or HTML into cross-origin browsing contexts by enticing a victim to visit a crafted HTML page. All Chrome desktop versions prior to 150.0.7871.47 are affected, with the flaw rooted in improper XML handling that bypasses the browser's same-origin policy enforcement. Despite the inherently high practical impact of UXSS, EPSS sits at 0.17% (7th percentile) and SSVC records exploitation status as none with no KEV listing, indicating no public exploit identified at time of analysis.
UI spoofing in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 enables an attacker to manipulate browser interface elements through a specifically crafted malicious extension. The root cause is insufficient input validation (CWE-20) in Chrome's extension processing pipeline, allowing crafted extension code to forge UI elements and deceive users about browser state, visited origins, or security indicators. EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no active or automated exploitation at time of analysis; no public exploit code has been identified.
UI spoofing via the File Input security indicator in Google Chrome on macOS allows a remote attacker to misrepresent security-critical interface elements when a user visits a crafted HTML page and performs specific UI gestures. Affected are all Chrome for Mac builds prior to 150.0.7871.47. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; combined with the high attack complexity and required user interaction, real-world exploitation at scale is unlikely without a targeted social engineering component.
UI spoofing in the Extensions component of Google Chrome on Android (prior to 150.0.7871.47) allows a remote attacker to misrepresent security UI elements by luring a victim into performing specific UI gestures on a crafted HTML page. The root cause (CWE-451) is incorrect rendering of security-critical extension UI, potentially misleading users about which extensions are active or what permissions they hold. No public exploit identified at time of analysis; the vendor has released a patch in the stable channel update.
UI spoofing in Google Chrome's Permissions subsystem prior to version 150.0.7871.47 allows a remote attacker to misrepresent permission dialogs or security indicators to users via a crafted HTML page, potentially inducing unintended browser permission grants (camera, microphone, geolocation, notifications). The flaw is classified as medium severity, with no active exploitation confirmed - CISA KEV listing is absent, no public POC is known, and EPSS places exploitation probability at 0.17% (7th percentile). Vendor-released patch is available in Chrome 150.0.7871.47.
UI spoofing in Google Chrome's Autofill component on Android (prior to 150.0.7871.47) allows a remote attacker to render deceptive interface elements via a crafted HTML page, exploiting insufficient input validation (CWE-20) in the Autofill subsystem. The integrity-only impact (I:L, no confidentiality or availability loss) and mandatory user interaction limit the real-world severity, consistent with Google's Chromium Medium classification. No active exploitation has been identified (SSVC: exploitation none; EPSS: 0.21%, 11th percentile), and Google has released a patch in Chrome 150.0.7871.47.
UI spoofing via crafted HTML page in Google Chrome's Credential Management implementation on Android (all versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to misrepresent credential-related interface elements, potentially tricking users into submitting credentials to unintended destinations. The vulnerability is platform-scoped to Android and requires user interaction with the malicious page. No active exploitation has been confirmed - the CVE is absent from CISA KEV, EPSS stands at 0.17% (7th percentile), and SSVC lists exploitation status as none.
Domain spoofing in Google Chrome's WebAppInstalls component (versions prior to 150.0.7871.47) allows remote attackers to misrepresent the security origin displayed to a user, enabling phishing or social engineering attacks. Exploitation requires convincing the victim to perform specific UI gestures while visiting a crafted HTML page, placing this in a moderate-complexity social engineering category. No public exploit code has been identified at time of analysis, and the vendor has released a patch in Chrome 150.0.7871.47.
UI spoofing in Google Chrome on macOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser UI elements by convincing a user to perform specific UI gestures on a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw can cause security-sensitive browser chrome - such as origin indicators or permission prompts - to display falsified content, potentially deceiving users into unsafe actions. No public exploit code exists and this vulnerability is not listed in CISA KEV; the vendor has released a patch in the Chrome 150 stable channel.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to manipulate browser interface elements through a specially crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site. The flaw arises from insufficient validation of untrusted input (CWE-20) in the iOS-specific Chrome layer and requires user interaction - a victim must navigate to a malicious page. No public exploit exists, CISA has not listed this in KEV, and an EPSS score of 0.17% (7th percentile) confirms very low real-world exploitation probability at the time of analysis.
UI spoofing in Google Chrome for Windows (prior to 150.0.7871.47) is enabled by insufficient input validation in the DataTransfer subsystem when the renderer process has already been compromised. A remote attacker who controls a compromised renderer can deliver a crafted HTML page that manipulates visual UI elements, potentially deceiving users into approving malicious permissions, revealing credentials, or performing unintended actions. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.17% at the 7th percentile reflects minimal observed exploitation probability; however, exploitation as a second-stage payload in a renderer RCE chain remains a realistic concern for high-value targets.
UI spoofing in Google Chrome's PageInfo component affects all desktop versions prior to 150.0.7871.47, enabling an attacker who has already compromised the renderer process to present deceptive browser security indicators to the user via a crafted HTML page. The vulnerability stems from an inappropriate implementation in the PageInfo subsystem (CWE-451), which controls the trusted security panel users consult to assess site authenticity. No active exploitation is confirmed - EPSS is 0.17% (7th percentile), SSVC rates exploitation as none, and this CVE is absent from the CISA KEV catalog - but the integrity impact is high where the attack chain is achievable.
UI spoofing in Google Chrome's Paint rendering component (all desktop versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to misrepresent critical browser interface information by directing a victim to a crafted HTML page. The flaw, rooted in CWE-451 (UI Misrepresentation of Critical Information), enables manipulation of rendered content to deceive users about page origin, security indicators, or trusted UI chrome. EPSS is very low at 0.17% (7th percentile), SSVC confirms no current exploitation, and the vulnerability is absent from CISA KEV, making this a medium-priority patch-and-monitor item rather than an emergency despite the CVSS 6.5 rating.
UI spoofing in Google Chrome Mobile on Android prior to version 150.0.7871.47 enables remote unauthenticated attackers to misrepresent security-critical information in the browser interface by serving a crafted HTML page. Rooted in CWE-451 (User Interface Misrepresentation of Critical Information), the flaw allows manipulation of Chrome's mobile security UI - such as origin indicators or trust signals - without requiring any privileges from the attacker. No active exploitation is confirmed (absent from CISA KEV), EPSS sits at the 7th percentile, and SSVC flags exploitation status as none, placing this firmly in the monitor-and-patch tier rather than emergency response.
UI spoofing in Google Chrome's Media UI component on ChromeOS allows a remote attacker to manipulate what a user sees by delivering a crafted HTML page and social-engineering the victim into performing specific in-browser UI gestures. Affected versions are all Chrome on ChromeOS prior to 150.0.7871.47. While classified Medium severity (CVSS 4.2), the practical risk is constrained by the requirement for active user interaction and the ChromeOS-only scope; no public exploit code or CISA KEV listing has been identified at time of analysis.
UI spoofing via MediaCapture in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to misrepresent browser UI through a crafted HTML page, potentially deceiving users into granting permissions or trusting malicious content. This is a chained exploitation technique - it requires a prior renderer compromise as a prerequisite - making it a post-exploitation integrity threat rather than an initial access vector. EPSS is 0.21% (11th percentile), no public exploit or CISA KEV listing exists at time of analysis, and Google has patched this in the stable channel update.
UI spoofing in Google Chrome's TabStrip component, fixed in version 150.0.7871.47, enables remote attackers to misrepresent browser security indicators through specially crafted HTML pages. The incorrect security UI rendering in the tab strip allows an attacker to deceive users about the true origin or security state of a webpage, creating phishing-enablement risk. No public exploit code and an EPSS of 0.17% (7th percentile) indicate low exploitation likelihood at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to display falsified URL content to a victim user via a crafted HTML page. Exploitation requires convincing the target to perform specific UI gestures while visiting the malicious page, making this a phishing-enabler rather than a direct code-execution primitive. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; Google has released a fix in the 150.0.7871.47 stable channel update.
UI spoofing in Google Chrome's Passwords component (versions prior to 150.0.7871.47) allows an attacker who has already achieved renderer process compromise to manipulate security-critical password UI elements via a crafted HTML page. This is a chained exploitation scenario - not a standalone initial-access vector - as the attacker must first compromise the renderer through a separate vulnerability before leveraging this flaw. EPSS at 0.21% (11th percentile) and no CISA KEV listing confirm no observed exploitation at scale; Chromium's internal classification is Medium severity.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables a remote attacker to misrepresent page identity or security state through a specially crafted HTML page, exploiting an inappropriate implementation classified under CWE-451. The vulnerability affects only the iOS-specific Chrome codebase - not Chrome on other platforms - and requires user interaction (visiting an attacker-controlled page). No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; it is not listed in the CISA KEV catalog.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote unauthenticated attacker to misrepresent browser interface elements - such as the address bar or security indicators - through a specially crafted HTML page, potentially deceiving users about the origin or trustworthiness of web content. The CVSS vector (PR:N, UI:R) confirms no authentication is required but user interaction is necessary, and the SSVC framework rates exploitation as 'none' with partial technical impact. EPSS at 0.21% (11th percentile) and the absence of any KEV listing or public exploit code indicate no public exploitation activity at time of analysis.
UI spoofing in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to misrepresent browser interface elements by luring a user to a crafted HTML page. The flaw stems from an inappropriate implementation in the Paint subsystem (CWE-451), enabling visual manipulation of browser UI state to deceive users into false trust decisions. No public exploit has been identified, SSVC rates exploitation as none, and EPSS sits at the 11th percentile - making this a low-urgency patch despite Chrome's near-ubiquitous deployment footprint.
UI spoofing in Google Chrome's PageInfo component (prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users about a page's security context or origin by serving a crafted HTML page. The flaw stems from insufficient policy enforcement in PageInfo - the browser panel users rely on to assess site trustworthiness - and maps to CWE-451 (UI Misrepresentation of Critical Information). No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Universal Cross-Site Scripting (UXSS) in Google Chrome's HTMLParser prior to 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML into a victim's browser context by serving a crafted HTML page. The flaw is classified Medium severity by Google's Chromium security team and carries a CVSS 5.4 score, with EPSS at 0.17% (7th percentile) and no CISA KEV listing, indicating low current exploitation activity. A vendor-released patch exists in Chrome 150.0.7871.47; Chrome's auto-update mechanism substantially narrows the exposure window for most consumer endpoints.
Sandbox escape in Google Chrome prior to 150.0.7871.47 exploits a heap-based buffer overflow (CWE-122) in the Storage component, enabling an attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is a chained, second-stage vulnerability - renderer compromise through a separate flaw is a hard prerequisite, making standalone exploitation infeasible. EPSS sits at 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; a vendor patch is confirmed available as Chrome 150.0.7871.47.
Out-of-bounds read in ANGLE, Chrome's cross-platform graphics abstraction engine, enables sensitive process memory disclosure on macOS for attackers who have already compromised the renderer process. Affected versions are Google Chrome prior to 150.0.7871.47 on Mac; Windows and Linux are not listed as affected. This flaw is a second-stage technique in a multi-vulnerability chain - not a standalone entry point - and no public exploit code or CISA KEV listing has been identified, placing real-world exploitation risk substantially below what the C:H confidentiality impact alone might imply.
UI spoofing in Google Chrome prior to 150.0.7871.47 allows a remote attacker to visually deceive users by misrepresenting browser UI elements through a crafted HTML page that requires the victim to perform specific interaction gestures. The flaw originates in an inappropriate implementation within Chrome's UI layer (CWE-451), enabling misrepresentation of critical information that could mislead users into unintended actions or false security assumptions. No public exploit code has been identified and the vulnerability is absent from CISA KEV; Google has released a fix in Chrome 150.0.7871.47.
UI spoofing in Google Chrome's Paint component prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent critical interface elements by delivering a crafted HTML page to a victim. The root cause is an inappropriate implementation in the Paint rendering subsystem (CWE-451), enabling visual deception that could facilitate phishing or credential theft. No public exploit code has been identified and CISA SSVC rates exploitation as none, placing real-world risk well below what the network-reachable attack vector might imply.
Uninitialized memory read in Skia, Chrome's 2D graphics library, exposes process memory contents to an attacker who has already compromised the renderer process by delivering a crafted HTML page. Affected are all Chrome desktop installations prior to 150.0.7871.47; the confidentiality impact is scoped to renderer process memory, which may contain session tokens, DOM content, or cached credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS Medium score of 5.3 reflects the high attack complexity imposed by the renderer pre-compromise prerequisite.
Uninitialized memory exposure in Google Chrome's Media component allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. Affected versions are all Chrome releases prior to 150.0.7871.47, across desktop platforms. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation requires a chained renderer compromise, significantly constraining real-world risk despite the high confidentiality impact rating.
Uninitialized memory exposure in the UI layer of Google Chrome on Android (prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. The vulnerability is CWE-457 (use of uninitialized variable) and is scoped to the Android platform only. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch has been released.
UI spoofing via inappropriate History implementation in Google Chrome prior to 150.0.7871.47 allows a remote attacker to present falsified browsing context to a victim through a crafted HTML page. The flaw (CWE-451) permits manipulation of how history entries are represented in the browser's UI, potentially misleading users about their navigation state or visited URLs. No public exploits are known, EPSS probability sits at 0.21% (11th percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the monitor-and-patch category rather than emergency response.
Navigation restriction bypass in Google Chrome's WebView component on Android (all versions prior to 150.0.7871.47) allows remote unauthenticated attackers to circumvent enforcement of navigation policies via a specially crafted HTML page, producing high integrity impact with no confidentiality or availability consequence. The CVSS vector (PR:N, UI:R) confirms unauthenticated network exploitation gated on victim interaction, consistent with a social-engineering or malicious-redirect delivery. No public exploit exists and CISA has not added this to KEV; EPSS of 0.22% (13th percentile) and SSVC Exploitation:none collectively indicate low active exploitation probability at time of analysis.
Cross-origin data leakage in Google Chrome's DevTools component (versions prior to 150.0.7871.47) permits a remote attacker to exfiltrate data across origin boundaries by tricking a user into performing specific UI gestures on a crafted HTML page. The CVSS base score of 3.1 (Low) reflects high attack complexity and mandatory user interaction, consistent with the EPSS score of 0.21% (11th percentile) indicating negligible in-the-wild exploitation activity. No public exploit code is identified and no CISA KEV listing exists; a vendor patch is available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already achieved renderer process compromise to escape PDF-layer sandboxing controls via a crafted HTML page, circumventing browser navigation security boundaries. This is a chained-attack-only scenario: the flaw is not independently exploitable and requires a prior renderer compromise as a prerequisite. No public exploit has been identified, EPSS is 0.22% (13th percentile), and SSVC rates exploitation as none - making this a theoretical second-stage risk rather than an immediate standalone threat. Vendor-released patch is confirmed at version 150.0.7871.47.
Process memory disclosure in Google Chrome DevTools on Windows (versions prior to 150.0.7871.47) allows a remote attacker to read potentially sensitive data from browser process memory by serving a crafted HTML page and convincing a user to perform specific UI gestures. The flaw stems from insufficient input validation (CWE-20) within the DevTools subsystem and is limited to the Windows platform. No public exploit code or CISA KEV listing has been identified at time of analysis, but the confidentiality impact is rated High by NVD.
UI spoofing in Google Chrome's Passwords component (all versions prior to 150.0.7871.47) enables remote, unauthenticated attackers to misrepresent critical interface elements to users via a specially crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in Chrome's password management UI, meaning a malicious page can render deceptive credential-related prompts or overlays that appear to originate from the browser's trusted Passwords subsystem. No public exploit code has been identified and CISA SSVC rates active exploitation as none, making this a moderate-priority patching item rather than an emergency response.
Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) enables remote attackers to violate cross-origin isolation by delivering a crafted HTML page to a victim user. The flaw originates in Blink's insufficient validation of untrusted input (CWE-20), resulting in a limited integrity impact when a user browses to attacker-controlled content. No active exploitation is confirmed - SSVC classifies exploitation as none, EPSS sits at 0.22% (13th percentile), and the vulnerability is absent from CISA KEV - and a vendor patch has been released in Chrome 150.0.7871.47.
Uninitialized memory use in the codec subsystem of Google Chrome on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. All Chrome for Windows releases prior to 150.0.7871.47 are affected; the flaw is platform-specific and does not affect Chrome on Linux, macOS, or mobile. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, though the CVSS C:H rating reflects meaningful confidentiality risk, and the uninitialized read could serve as a precursor step toward ASLR bypass in a chained attack.
Incorrect security UI in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 enables Universal Cross-Site Scripting (UXSS), allowing script or HTML injection across web origins via a crafted HTML page. Exploitation requires that the victim user be socially engineered into installing a malicious extension, after which a crafted page triggers the CWE-79 flaw in the Extensions UI. No public exploit exists at time of analysis, EPSS sits at the 4th percentile, and CISA has not listed this in KEV, consistent with the SSVC exploitation:none assessment.
UI spoofing in Google Chrome's PageInfo component (all versions prior to 150.0.7871.47) enables remote attackers to misrepresent the browser's security indicators through a crafted HTML page that induces specific user UI gestures. The flaw (CWE-451) causes the PageInfo panel - the panel users consult to evaluate site trustworthiness - to render incorrect security UI, potentially deceiving victims into trusting malicious or unverified origins. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires high attack complexity and deliberate user interaction, keeping real-world risk moderate despite the ubiquitous deployment footprint of Chrome.
UI spoofing in Google Chrome's CustomTabs component on Android enables a local attacker to manipulate what a victim sees within an in-app browser session by supplying a malicious file, affecting all Chrome for Android versions prior to 150.0.7871.47. The CVSS score of 3.3 (Low) and EPSS of 0.13% (3rd percentile) reflect constrained real-world impact: exploitation is local, requires user interaction, and produces only integrity-level spoofing. No active exploitation has been confirmed - this vulnerability is not listed in CISA KEV, and SSVC assessment indicates exploitation status of none.
Insufficient XML policy enforcement in Google Chrome on Android (prior to 150.0.7871.47) exposes process memory contents to remote attackers who can deliver a crafted HTML page. The flaw is classified under CWE-284 (Improper Access Control), allowing the browser's XML handling to bypass intended isolation boundaries and leak potentially sensitive in-process data - such as cookies, credentials, or other runtime state - to an attacker-controlled origin. No active exploitation is confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 6.5 (Medium) reflects meaningful real-world risk given the zero-authentication, high-confidentiality-impact profile.
Navigation restriction bypass in Google Chrome's SplitView feature (prior to 150.0.7871.47) enables a remote attacker who has already achieved renderer process compromise to escape navigation controls via a crafted HTML page. The CWE-284 (Improper Access Control) root cause means Chrome's SplitView fails to enforce navigation policy in a post-renderer-compromise context, making this a chained exploit component rather than a standalone initial-access vector. EPSS is very low (0.22%, 13th percentile), no public exploit code has been identified, and SSVC rates exploitation as none with partial technical impact at time of analysis.
Integer overflow in the WebNN component of Google Chrome prior to 150.0.7871.47 allows an unauthenticated remote attacker to read potentially sensitive data from Chrome's process memory. Exploitation requires convincing a victim to visit a crafted HTML page, placing this in the class of user-interaction-dependent browser memory disclosure vulnerabilities. No public exploit code exists and CISA has not listed this in KEV; SSVC rates exploitation as 'none' and Chromium's own triage assigns 'Low' severity, suggesting the disclosed memory is constrained in practice.
Universal Cross-Site Scripting (UXSS) in Chrome's Omnibox on iOS enables remote attackers to inject arbitrary scripts or HTML across security origins by luring users into performing specific UI gestures on a crafted page. Affected versions are Chrome for iOS prior to 150.0.7871.47; the desktop channel is not affected. No public exploit code or active exploitation has been identified at time of analysis, and EPSS sits at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating despite the scope-changed CVSS vector.
Navigation restriction bypass in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to circumvent browser-enforced navigation controls by delivering a crafted HTML page. The flaw is confined to the iOS platform - Chrome on Android, Windows, macOS, and Linux is unaffected - and requires the victim to actively visit the attacker-controlled page (UI:R). With a CVSS score of 4.3 (Medium), an EPSS of 0.19% (9th percentile), no CISA KEV listing, and a Chromium-internal severity rating of Low, this vulnerability carries minimal real-world exploitation risk but warrants patching given its zero-privilege attack vector.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables attackers who have already achieved renderer process compromise to escape certain navigation-level security controls via a crafted HTML page. The flaw resides in the PageInfo component, which handles page metadata, security indicators, and related navigation policy enforcement, and fails to adequately validate attacker-controlled input passed from a compromised renderer. With an EPSS of 0.22% (13th percentile), no CISA KEV listing, and a Chromium-internal severity of Low, real-world exploitation risk is currently low despite the CVSS 6.5 medium rating.
Out-of-bounds read in Chrome's Chromecast component allows a local attacker to leak sensitive contents from the browser's process memory by delivering malicious network traffic to the affected subsystem. Affected versions are all Chrome releases prior to 150.0.7871.47 on desktop platforms. No public exploit code or CISA KEV listing is identified at time of analysis, and Google's own severity rating is Low, though the CVSS confidentiality impact is scored High due to potential direct process memory exposure.
Process memory disclosure in Google Chrome's Views UI framework on ChromeOS allows a crafted extension, once installed by a user, to read potentially sensitive data from Chrome's process memory. All ChromeOS Chrome versions prior to 150.0.7871.47 are affected; desktop Chrome on Windows, macOS, and Linux is not confirmed in scope. No public exploit has been identified at time of analysis, and Chromium's own internal severity rating is Low - tempering the NVD CVSS 5.9 score - indicating Google's security team assessed limited practical exploitability.
Process memory disclosure in Google Chrome's Dawn WebGPU component (versions prior to 150.0.7871.47) enables remote attackers to read potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The flaw is categorized under CWE-284 (Improper Access Control) within the Dawn graphics abstraction layer, which underpins Chrome's WebGPU implementation. No public exploit code or CISA KEV listing has been identified at time of analysis, and Google's own Chromium security team rates the severity as Low despite the NVD CVSS score of 6.5.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 stems from insufficient policy enforcement in the Related-Website-Sets feature, enabling a remote attacker to read sensitive cross-origin data by delivering a crafted HTML page to a victim. The CVSS 6.5 score with High confidentiality impact reflects meaningful exposure potential, though Google internally rated this as Low severity and EPSS sits at 0.17% (7th percentile), suggesting limited real-world exploitation risk. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; a vendor patch is available.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 stems from insufficient policy enforcement in the browser's Parser component, allowing a remote unauthenticated attacker to circumvent CSP protections via a crafted HTML page. The attacker achieves limited integrity impact (I:L) - able to load or execute content that a properly enforced CSP would block - but gains no confidentiality or availability impact. EPSS is low at 0.22% (13th percentile), no active exploitation has been confirmed (not in CISA KEV), and Chromium internally rated this Low severity, making it a real but low-priority finding.
Same-origin policy bypass in Google Chrome's FedCM (Federated Credential Management) implementation allows remote attackers to perform limited cross-origin integrity manipulation by luring a victim to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. With an EPSS of 0.18% (8th percentile), no CISA KEV listing, and no public exploit identified, this represents a low-probability exploitation scenario despite being trivially deliverable via a web page.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 allows a remote attacker to circumvent network-layer policy enforcement by inducing a user to visit a specially crafted HTML page. Rooted in CWE-602 (client-side enforcement of server-side security), the flaw means Chrome's network policy checks governing navigation can be subverted client-side, yielding a low-integrity impact with no confidentiality or availability consequence. No public exploit has been identified and the EPSS exploitation probability stands at 0.18% (8th percentile), consistent with Chromium's own 'Low' severity rating - this is a low-urgency but genuine policy-enforcement gap.
Cross-origin data leakage in Google Chrome's Extensions subsystem (versions prior to 150.0.7871.47) enables a remote attacker - who has first achieved renderer process compromise - to bypass same-origin policy enforcement and read cross-origin data via a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error) and rated Low severity by the Chromium security team. EPSS is extremely low at 0.17% (7th percentile), no CISA KEV listing exists, and no public exploit code has been identified, consistent with the significant chained exploitation barrier imposed by the renderer-compromise prerequisite.
FileSystem policy enforcement bypass in Google Chrome prior to version 150.0.7871.47 allows a remote attacker to circumvent discretionary access control via a crafted HTML page, resulting in limited unauthorized write operations within the browser's sandboxed filesystem scope. The vulnerability requires user interaction - the victim must navigate to a malicious page - and produces only an integrity impact (I:L) with no confidentiality or availability consequence. With an EPSS of 0.18% (8th percentile) and no CISA KEV listing, real-world exploitation probability is very low; no public exploit has been identified at time of analysis.
Uninitialized memory exposure in Google Chrome's GamepadAPI allows an attacker who has already achieved renderer process compromise to read potentially sensitive contents from process memory by serving a crafted HTML page that triggers the flaw. Affected versions are all Chrome releases prior to 150.0.7871.47. While the CVSS base score is 6.5 with high confidentiality impact, Chromium's own severity rating is Low, reflecting the significant prerequisite of prior renderer compromise that dramatically constrains real-world exploitability. No public exploit code or CISA KEV listing has been identified at time of analysis, and a vendor patch is available.
Cross-origin data leakage in Google Chrome's Passwords component prior to version 150.0.7871.47 enables remote attackers to exfiltrate credential-related or other sensitive cross-origin data by directing victims to a crafted HTML page. The root cause (CWE-693, Protection Mechanism Failure) represents a breakdown in the policy enforcement layer governing cross-origin access in the Passwords subsystem - a bypass of the isolation guarantees Chrome's same-origin model is meant to provide. No public exploit has been identified at time of analysis; EPSS of 0.17% (7th percentile) and the absence of a CISA KEV listing place real-world exploitation probability very low, and Chromium's own team rated the severity as Low despite the NVD CVSS 6.5 Medium score.
Memory disclosure in Google Chrome's GPU component (prior to 150.0.7871.47) allows an attacker who has already achieved renderer process compromise to extract potentially sensitive information from process memory via a crafted HTML page. The attack requires both user interaction and a pre-existing renderer compromise, making this a second-stage vulnerability most useful for ASLR bypass or credential harvesting within an exploit chain. No public exploit code or active exploitation (CISA KEV) has been identified; Google rates this as Low severity internally despite the NVD CVSS 5.3 Medium score.
Use-after-free in Chrome's Chromecast component exposes process memory to attackers on the same local network segment via a malicious peripheral, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H), meaning successful exploitation leaks potentially sensitive data from the Chrome process heap. No public exploit or CISA KEV listing is identified at time of analysis, and Google has released a patch in the stable channel.
Content Security Policy bypass in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 allows an attacker who socially engineers a victim into installing a crafted malicious extension to circumvent CSP protections, yielding limited integrity impact. CVSS UI:R and EPSS at 0.12% (2nd percentile) confirm this is a low-probability, user-interaction-dependent attack with no confidentiality or availability consequence. No KEV listing, no known POC, and Google's own 'Low' severity rating collectively position this as a low operational priority despite broad product prevalence.
Same-origin policy bypass in Google Chrome's CustomTabs component on Android (versions prior to 150.0.7871.47) permits remote attackers to perform limited cross-origin integrity violations by directing a victim to a crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's CustomTabs implementation incorrectly validates or enforces origin boundaries when rendering attacker-controlled content. No active exploitation has been confirmed (not in CISA KEV) and the EPSS score of 0.18% (8th percentile) reflects very low observed exploitation probability, consistent with the Low severity rating assigned by the Chromium security team.
Cross-origin data leakage in Google Chrome's Network component (versions prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data via a specially crafted HTML page. This is a chained vulnerability - renderer-process compromise is a hard prerequisite, meaning real-world risk is substantially lower than the network-accessible CVSS vector implies. No public exploit code has been identified and EPSS sits at the 7th percentile (0.17%), consistent with limited exploitation interest. Google has released a fix in the stable channel update to 150.0.7871.47.
UI spoofing in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote unauthenticated attackers to misrepresent security-relevant interface elements to victims via a specially crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The vulnerability is rooted in CWE-451 (UI Misrepresentation of Critical Information) and is limited to low-integrity impact with no confidentiality or availability consequence. No public exploit identified at time of analysis; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' both indicate negligible real-world exploitation likelihood.
Same-origin policy bypass in Google Chrome's GetUserMedia implementation prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to achieve limited cross-origin integrity impact by delivering a crafted HTML page to a victim. Chromium's own severity classification is Low, consistent with the CVSS 4.3 score and an EPSS exploitation probability of just 0.18% (8th percentile). No public exploit code and no active exploitation have been identified at time of analysis; Google has issued a remediated build in Chrome 150.0.7871.47.
Insufficient Bluetooth policy enforcement in Google Chrome prior to 150.0.7871.47 allows remote attackers to read potentially sensitive data from browser process memory by luring a victim to a crafted HTML page. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5 Medium at NVD, though Chromium's own severity rating is 'Low,' suggesting Chrome's sandbox architecture limits practical memory exposure. No public exploit code or active exploitation has been identified at time of analysis.
WebXR implementation flaw in Google Chrome on Android prior to 150.0.7871.47 permits remote attackers to bypass navigation restrictions by delivering a crafted HTML page to a victim. The vulnerability is Android-specific and requires user interaction to trigger, constraining its reach. With no CISA KEV listing, no public exploit identified at time of analysis, and an EPSS of 0.18% (8th percentile), this represents a low-priority integrity issue that Google itself rates as Low severity.
Site isolation bypass in Google Chrome's Media component on Windows allows remote attackers to circumvent cross-origin security boundaries by delivering a specially crafted HTML page to a victim. All Chrome for Windows releases prior to 150.0.7871.47 are affected. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC exploitation status of 'none' consistently indicate low current real-world risk despite the potential severity of an isolation bypass.
UI spoofing in Google Chrome's File Input component (versions prior to 150.0.7871.47) enables remote unauthenticated attackers to misrepresent the file selection interface through a crafted HTML page, potentially deceiving users into interacting with fraudulent UI elements. The flaw is classified as CWE-451 (UI Misrepresentation of Critical Information) and requires active user interaction with the malicious page, consistent with the CVSS UI:R metric. No public exploit code exists, CISA SSVC confirms exploitation status as none, and EPSS sits at a low 0.17% (7th percentile), collectively indicating negligible real-world exploitation pressure.
Omnibox (URL bar) spoofing in Google Chrome on Linux prior to 150.0.7871.47 is possible through an inappropriate SplitView implementation, allowing remote attackers to display false URLs to victims who are tricked into performing specific UI gestures on a crafted HTML page. This CWE-451 class flaw undermines browser trust indicators and enables phishing scenarios, though exploitation is constrained by high attack complexity and mandatory user interaction. No public exploit code or active exploitation has been identified; a vendor patch is available in the stable channel release.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to misrepresent security indicators to users who are socially engineered into performing specific UI gestures on a crafted HTML page. The root cause is incorrect rendering of security UI elements (CWE-451), classified by the Chromium team as Low severity. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog, aligning with the modest CVSS 4.2 score and the high-complexity attack requirements.
UI spoofing via incorrect security rendering in Chrome's SplitView component allows a remote attacker to misrepresent security-critical UI elements to a victim running any Chrome version prior to 150.0.7871.47. The attacker must serve a crafted HTML page and successfully induce the victim into performing specific UI gestures, after which SplitView renders misleading security indicators - enabling phishing-class deception within a trusted browser context. No public exploit code exists and no active exploitation has been confirmed; the Chromium team itself rated this Low severity, consistent with the CVSS 4.2 score and high attack complexity.
Same-origin policy bypass in Google Chrome's SanitizerAPI before version 150.0.7871.47 allows a remote attacker to violate cross-origin integrity boundaries through a crafted HTML page that exploits insufficient input validation. The flaw targets a security-critical browser API whose purpose is precisely to prevent unsafe HTML injection, making the bypass particularly notable. EPSS at 0.22% (13th percentile) indicates low near-term exploitation probability, and no active exploitation or public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's Network component (versions prior to 150.0.7871.47) enables a remote attacker who has already achieved renderer process compromise to bypass same-origin policy protections and exfiltrate sensitive cross-origin data via a crafted HTML page. This vulnerability functions as a second-stage exploit primitive within a chain - it does not enable initial access but extends the impact of an existing renderer compromise. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS of 0.21% (11th percentile) reflects low observed exploitation activity.
Cross-origin data leakage in Google Chrome's StorageAccessAPI (prior to 150.0.7871.47) enables a remote attacker who has already compromised the renderer process to read storage or cookie data belonging to other origins by delivering a crafted HTML page. This is a chained attack - the StorageAccessAPI policy bypass is the second stage of a multi-step compromise, not a standalone entry point. EPSS is very low (0.17%, 7th percentile), no active exploitation is confirmed in CISA KEV, and no public exploit code has been identified at time of analysis.
UI spoofing in Google Chrome's WebXR subsystem (versions prior to 150.0.7871.47) is achievable by an attacker who has already compromised the renderer process, allowing manipulation of browser UI elements via a crafted HTML page. The vulnerability is a second-stage attack component, not a standalone entry point - exploitation chains through a separate renderer compromise before WebXR's insufficient input validation can be abused. EPSS at 0.17% (7th percentile) and no CISA KEV listing indicate minimal observed exploitation activity; patch is available as of Chrome 150.0.7871.47.
Cross-origin credential data leakage in Google Chrome's built-in Passwords feature (all versions prior to 150.0.7871.47) can be triggered remotely via a crafted HTML page requiring only user interaction. The flaw is rooted in an inappropriate implementation in Chrome's password management subsystem (CWE-522 - Insufficiently Protected Credentials), allowing a remote attacker to read data across origin boundaries that should be strictly isolated. No public exploit code is identified and EPSS stands at 0.17% (7th percentile), indicating limited exploitation pressure at time of analysis; however, Chrome's ubiquitous deployment makes the aggregate exposure significant.
Cross-origin data leakage in Google Chrome's SVG implementation prior to version 150.0.7871.47 allows a remote attacker to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw exploits improper SVG handling that bypasses same-origin policy protections, exposing potentially sensitive session data or authenticated content from third-party origins. No active exploitation has been confirmed (not listed in CISA KEV), and EPSS stands at 0.17% (7th percentile), indicating low observed exploitation probability at time of analysis.
Cross-origin data exfiltration in Google Chrome's WebRTC subsystem on Windows allows remote attackers to leak sensitive data from other origins by directing victims to a specially crafted HTML page. All Chrome on Windows versions prior to 150.0.7871.47 are affected. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) signals low near-term exploitation probability despite the CVSS High confidentiality impact - consistent with Chromium's own 'Medium' severity designation and the inherent timing-sensitivity of race condition attacks.
UI spoofing in Google Chrome's Paint rendering component (versions prior to 150.0.7871.47) enables remote attackers to misrepresent browser interface elements through a specially crafted HTML page, with the victim's visit being the sole prerequisite. The CVSS vector confirms high integrity impact (I:H) with no confidentiality or availability exposure, consistent with CWE-451 misrepresentation of critical UI information rather than code execution. No public exploit has been identified and EPSS sits at the 7th percentile (0.17%), indicating very low near-term exploitation probability; a vendor patch is confirmed available in the Chrome stable channel.
UI spoofing in Google Chrome prior to version 150.0.7871.47 is caused by an inappropriate SVG rendering implementation, enabling remote attackers to visually misrepresent browser UI elements through a crafted HTML page. Exploitation requires user interaction - the victim must visit a malicious page - and the direct impact is limited to integrity via visual deception, with no confidentiality or availability consequence. No public exploit has been identified and the EPSS score of 0.17% (7th percentile) confirms minimal exploitation activity at time of analysis.
CSS side-channel information leakage in Google Chrome prior to 150.0.7871.47 enables a remote attacker to read potentially sensitive data from the browser's process memory by inducing a victim to visit a specially crafted HTML page. The vulnerability is classified under CWE-1300 (Improper Protection of Physical Side Channels), indicating that observable rendering or timing behavior in Chrome's CSS engine can be exploited to infer in-memory state. No public exploit identified at time of analysis; however, the CVSS-assessed confidentiality impact is rated High, and Google has released a fix in Chrome stable channel version 150.0.7871.47.
Uninitialized memory use in Chrome's codec subsystem on Windows leaks process memory contents to remote attackers who can direct a user to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 on Windows are affected; exploitation requires no authentication but does require the victim to visit attacker-controlled content, placing this in the drive-by browsing threat category. No public exploit code has been identified at time of analysis, and Google has released a confirmed fix in stable channel 150.0.7871.47.
Uninitialized memory read in Google Chrome's WebXR subsystem on Android (versions prior to 150.0.7871.47) enables remote attackers to leak sensitive contents from process memory by inducing a victim to visit a crafted HTML page. The root cause is CWE-457 (use of an uninitialized variable) within the WebXR implementation, meaning memory buffers are consumed before being properly zeroed or assigned, exposing whatever residual data the process held. No public exploit or CISA KEV listing is identified at time of analysis, but the CVSS C:H rating reflects the potential for meaningful data exposure including in-memory credentials, tokens, or browsing context.
Insufficient PermissionsPolicy enforcement in Google Chrome prior to 150.0.7871.47 enables remote attackers to bypass navigation restrictions by luring a user to a crafted HTML page. The integrity impact is rated High (CVSS I:H) because an attacker can circumvent declarative browser navigation controls, potentially redirecting victims to unintended origins or overriding policy-enforced browsing constraints. No public exploit code exists and SSVC signals exploitation as none, placing this in a lower-priority patch tier despite the medium-high CVSS score.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 is exploitable by a remote, unauthenticated attacker who tricks a user into visiting a crafted HTML page that abuses an inappropriate CSS implementation to bypass same-origin policy protections. The confidentiality impact is rated high (C:H) because sensitive data from cross-origin resources - such as page content or authentication artifacts readable via CSS side-channels - can be exposed to the attacker-controlled page. No public exploit or active exploitation has been identified; EPSS stands at 0.21% (11th percentile) and SSVC corroborates with exploitation: none and automatable: no.
Cross-origin data leakage in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 allows crafted malicious extensions to bypass same-origin policy enforcement and exfiltrate data from web origins beyond their declared permissions. Exploitation requires convincing a target user to install the malicious extension, making this a social-engineering-dependent attack path rather than a direct network exploit. No active exploitation has been confirmed (absent from CISA KEV), no public proof-of-concept code has been identified, and EPSS at 0.11% (2nd percentile) corroborates negligible observed exploitation activity at time of analysis.
UI spoofing in Google Chrome's Geolocation implementation allows an attacker who has already compromised the renderer process to present misleading geolocation-related interface elements to the user via a crafted HTML page. Affected versions are all Chrome releases prior to 150.0.7871.47. The integrity impact is rated High (CVSS I:H) because the spoofed UI can deceive users into granting or believing geolocation permissions under false pretenses; no public exploit or CISA KEV listing exists, and the 0.17% EPSS score (7th percentile) reflects low observed exploitation probability.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Network component prior to 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML across security origins by tricking a user into visiting a crafted HTML page. Unlike application-level XSS, this browser-level flaw can bypass the Same-Origin Policy, potentially allowing injected scripts to interact with content from origins other than the attacker's page. No public exploit code has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at a low 0.17% (7th percentile); a vendor-released patch is available.
Universal Cross-Site Scripting (UXSS) in Google Chrome's XML implementation permits remote attackers to inject arbitrary scripts or HTML into cross-origin browsing contexts by enticing a victim to visit a crafted HTML page. All Chrome desktop versions prior to 150.0.7871.47 are affected, with the flaw rooted in improper XML handling that bypasses the browser's same-origin policy enforcement. Despite the inherently high practical impact of UXSS, EPSS sits at 0.17% (7th percentile) and SSVC records exploitation status as none with no KEV listing, indicating no public exploit identified at time of analysis.
UI spoofing in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 enables an attacker to manipulate browser interface elements through a specifically crafted malicious extension. The root cause is insufficient input validation (CWE-20) in Chrome's extension processing pipeline, allowing crafted extension code to forge UI elements and deceive users about browser state, visited origins, or security indicators. EPSS of 0.13% (3rd percentile) and SSVC exploitation status of 'none' confirm no active or automated exploitation at time of analysis; no public exploit code has been identified.
UI spoofing via the File Input security indicator in Google Chrome on macOS allows a remote attacker to misrepresent security-critical interface elements when a user visits a crafted HTML page and performs specific UI gestures. Affected are all Chrome for Mac builds prior to 150.0.7871.47. No public exploit identified at time of analysis and the vulnerability is not listed in CISA KEV; combined with the high attack complexity and required user interaction, real-world exploitation at scale is unlikely without a targeted social engineering component.
UI spoofing in the Extensions component of Google Chrome on Android (prior to 150.0.7871.47) allows a remote attacker to misrepresent security UI elements by luring a victim into performing specific UI gestures on a crafted HTML page. The root cause (CWE-451) is incorrect rendering of security-critical extension UI, potentially misleading users about which extensions are active or what permissions they hold. No public exploit identified at time of analysis; the vendor has released a patch in the stable channel update.
UI spoofing in Google Chrome's Permissions subsystem prior to version 150.0.7871.47 allows a remote attacker to misrepresent permission dialogs or security indicators to users via a crafted HTML page, potentially inducing unintended browser permission grants (camera, microphone, geolocation, notifications). The flaw is classified as medium severity, with no active exploitation confirmed - CISA KEV listing is absent, no public POC is known, and EPSS places exploitation probability at 0.17% (7th percentile). Vendor-released patch is available in Chrome 150.0.7871.47.
UI spoofing in Google Chrome's Autofill component on Android (prior to 150.0.7871.47) allows a remote attacker to render deceptive interface elements via a crafted HTML page, exploiting insufficient input validation (CWE-20) in the Autofill subsystem. The integrity-only impact (I:L, no confidentiality or availability loss) and mandatory user interaction limit the real-world severity, consistent with Google's Chromium Medium classification. No active exploitation has been identified (SSVC: exploitation none; EPSS: 0.21%, 11th percentile), and Google has released a patch in Chrome 150.0.7871.47.
UI spoofing via crafted HTML page in Google Chrome's Credential Management implementation on Android (all versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to misrepresent credential-related interface elements, potentially tricking users into submitting credentials to unintended destinations. The vulnerability is platform-scoped to Android and requires user interaction with the malicious page. No active exploitation has been confirmed - the CVE is absent from CISA KEV, EPSS stands at 0.17% (7th percentile), and SSVC lists exploitation status as none.
Domain spoofing in Google Chrome's WebAppInstalls component (versions prior to 150.0.7871.47) allows remote attackers to misrepresent the security origin displayed to a user, enabling phishing or social engineering attacks. Exploitation requires convincing the victim to perform specific UI gestures while visiting a crafted HTML page, placing this in a moderate-complexity social engineering category. No public exploit code has been identified at time of analysis, and the vendor has released a patch in Chrome 150.0.7871.47.
UI spoofing in Google Chrome on macOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser UI elements by convincing a user to perform specific UI gestures on a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw can cause security-sensitive browser chrome - such as origin indicators or permission prompts - to display falsified content, potentially deceiving users into unsafe actions. No public exploit code exists and this vulnerability is not listed in CISA KEV; the vendor has released a patch in the Chrome 150 stable channel.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to manipulate browser interface elements through a specially crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site. The flaw arises from insufficient validation of untrusted input (CWE-20) in the iOS-specific Chrome layer and requires user interaction - a victim must navigate to a malicious page. No public exploit exists, CISA has not listed this in KEV, and an EPSS score of 0.17% (7th percentile) confirms very low real-world exploitation probability at the time of analysis.
UI spoofing in Google Chrome for Windows (prior to 150.0.7871.47) is enabled by insufficient input validation in the DataTransfer subsystem when the renderer process has already been compromised. A remote attacker who controls a compromised renderer can deliver a crafted HTML page that manipulates visual UI elements, potentially deceiving users into approving malicious permissions, revealing credentials, or performing unintended actions. No active exploitation has been confirmed (not in CISA KEV), and EPSS of 0.17% at the 7th percentile reflects minimal observed exploitation probability; however, exploitation as a second-stage payload in a renderer RCE chain remains a realistic concern for high-value targets.
UI spoofing in Google Chrome's PageInfo component affects all desktop versions prior to 150.0.7871.47, enabling an attacker who has already compromised the renderer process to present deceptive browser security indicators to the user via a crafted HTML page. The vulnerability stems from an inappropriate implementation in the PageInfo subsystem (CWE-451), which controls the trusted security panel users consult to assess site authenticity. No active exploitation is confirmed - EPSS is 0.17% (7th percentile), SSVC rates exploitation as none, and this CVE is absent from the CISA KEV catalog - but the integrity impact is high where the attack chain is achievable.
UI spoofing in Google Chrome's Paint rendering component (all desktop versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to misrepresent critical browser interface information by directing a victim to a crafted HTML page. The flaw, rooted in CWE-451 (UI Misrepresentation of Critical Information), enables manipulation of rendered content to deceive users about page origin, security indicators, or trusted UI chrome. EPSS is very low at 0.17% (7th percentile), SSVC confirms no current exploitation, and the vulnerability is absent from CISA KEV, making this a medium-priority patch-and-monitor item rather than an emergency despite the CVSS 6.5 rating.
UI spoofing in Google Chrome Mobile on Android prior to version 150.0.7871.47 enables remote unauthenticated attackers to misrepresent security-critical information in the browser interface by serving a crafted HTML page. Rooted in CWE-451 (User Interface Misrepresentation of Critical Information), the flaw allows manipulation of Chrome's mobile security UI - such as origin indicators or trust signals - without requiring any privileges from the attacker. No active exploitation is confirmed (absent from CISA KEV), EPSS sits at the 7th percentile, and SSVC flags exploitation status as none, placing this firmly in the monitor-and-patch tier rather than emergency response.
UI spoofing in Google Chrome's Media UI component on ChromeOS allows a remote attacker to manipulate what a user sees by delivering a crafted HTML page and social-engineering the victim into performing specific in-browser UI gestures. Affected versions are all Chrome on ChromeOS prior to 150.0.7871.47. While classified Medium severity (CVSS 4.2), the practical risk is constrained by the requirement for active user interaction and the ChromeOS-only scope; no public exploit code or CISA KEV listing has been identified at time of analysis.
UI spoofing via MediaCapture in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to misrepresent browser UI through a crafted HTML page, potentially deceiving users into granting permissions or trusting malicious content. This is a chained exploitation technique - it requires a prior renderer compromise as a prerequisite - making it a post-exploitation integrity threat rather than an initial access vector. EPSS is 0.21% (11th percentile), no public exploit or CISA KEV listing exists at time of analysis, and Google has patched this in the stable channel update.
UI spoofing in Google Chrome's TabStrip component, fixed in version 150.0.7871.47, enables remote attackers to misrepresent browser security indicators through specially crafted HTML pages. The incorrect security UI rendering in the tab strip allows an attacker to deceive users about the true origin or security state of a webpage, creating phishing-enablement risk. No public exploit code and an EPSS of 0.17% (7th percentile) indicate low exploitation likelihood at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to display falsified URL content to a victim user via a crafted HTML page. Exploitation requires convincing the target to perform specific UI gestures while visiting the malicious page, making this a phishing-enabler rather than a direct code-execution primitive. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; Google has released a fix in the 150.0.7871.47 stable channel update.
UI spoofing in Google Chrome's Passwords component (versions prior to 150.0.7871.47) allows an attacker who has already achieved renderer process compromise to manipulate security-critical password UI elements via a crafted HTML page. This is a chained exploitation scenario - not a standalone initial-access vector - as the attacker must first compromise the renderer through a separate vulnerability before leveraging this flaw. EPSS at 0.21% (11th percentile) and no CISA KEV listing confirm no observed exploitation at scale; Chromium's internal classification is Medium severity.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables a remote attacker to misrepresent page identity or security state through a specially crafted HTML page, exploiting an inappropriate implementation classified under CWE-451. The vulnerability affects only the iOS-specific Chrome codebase - not Chrome on other platforms - and requires user interaction (visiting an attacker-controlled page). No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; it is not listed in the CISA KEV catalog.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote unauthenticated attacker to misrepresent browser interface elements - such as the address bar or security indicators - through a specially crafted HTML page, potentially deceiving users about the origin or trustworthiness of web content. The CVSS vector (PR:N, UI:R) confirms no authentication is required but user interaction is necessary, and the SSVC framework rates exploitation as 'none' with partial technical impact. EPSS at 0.21% (11th percentile) and the absence of any KEV listing or public exploit code indicate no public exploitation activity at time of analysis.
UI spoofing in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to misrepresent browser interface elements by luring a user to a crafted HTML page. The flaw stems from an inappropriate implementation in the Paint subsystem (CWE-451), enabling visual manipulation of browser UI state to deceive users into false trust decisions. No public exploit has been identified, SSVC rates exploitation as none, and EPSS sits at the 11th percentile - making this a low-urgency patch despite Chrome's near-ubiquitous deployment footprint.
UI spoofing in Google Chrome's PageInfo component (prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users about a page's security context or origin by serving a crafted HTML page. The flaw stems from insufficient policy enforcement in PageInfo - the browser panel users rely on to assess site trustworthiness - and maps to CWE-451 (UI Misrepresentation of Critical Information). No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Universal Cross-Site Scripting (UXSS) in Google Chrome's HTMLParser prior to 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML into a victim's browser context by serving a crafted HTML page. The flaw is classified Medium severity by Google's Chromium security team and carries a CVSS 5.4 score, with EPSS at 0.17% (7th percentile) and no CISA KEV listing, indicating low current exploitation activity. A vendor-released patch exists in Chrome 150.0.7871.47; Chrome's auto-update mechanism substantially narrows the exposure window for most consumer endpoints.
Sandbox escape in Google Chrome prior to 150.0.7871.47 exploits a heap-based buffer overflow (CWE-122) in the Storage component, enabling an attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is a chained, second-stage vulnerability - renderer compromise through a separate flaw is a hard prerequisite, making standalone exploitation infeasible. EPSS sits at 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; a vendor patch is confirmed available as Chrome 150.0.7871.47.
Out-of-bounds read in ANGLE, Chrome's cross-platform graphics abstraction engine, enables sensitive process memory disclosure on macOS for attackers who have already compromised the renderer process. Affected versions are Google Chrome prior to 150.0.7871.47 on Mac; Windows and Linux are not listed as affected. This flaw is a second-stage technique in a multi-vulnerability chain - not a standalone entry point - and no public exploit code or CISA KEV listing has been identified, placing real-world exploitation risk substantially below what the C:H confidentiality impact alone might imply.
UI spoofing in Google Chrome prior to 150.0.7871.47 allows a remote attacker to visually deceive users by misrepresenting browser UI elements through a crafted HTML page that requires the victim to perform specific interaction gestures. The flaw originates in an inappropriate implementation within Chrome's UI layer (CWE-451), enabling misrepresentation of critical information that could mislead users into unintended actions or false security assumptions. No public exploit code has been identified and the vulnerability is absent from CISA KEV; Google has released a fix in Chrome 150.0.7871.47.
UI spoofing in Google Chrome's Paint component prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent critical interface elements by delivering a crafted HTML page to a victim. The root cause is an inappropriate implementation in the Paint rendering subsystem (CWE-451), enabling visual deception that could facilitate phishing or credential theft. No public exploit code has been identified and CISA SSVC rates exploitation as none, placing real-world risk well below what the network-reachable attack vector might imply.
Uninitialized memory read in Skia, Chrome's 2D graphics library, exposes process memory contents to an attacker who has already compromised the renderer process by delivering a crafted HTML page. Affected are all Chrome desktop installations prior to 150.0.7871.47; the confidentiality impact is scoped to renderer process memory, which may contain session tokens, DOM content, or cached credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS Medium score of 5.3 reflects the high attack complexity imposed by the renderer pre-compromise prerequisite.
Uninitialized memory exposure in Google Chrome's Media component allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. Affected versions are all Chrome releases prior to 150.0.7871.47, across desktop platforms. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation requires a chained renderer compromise, significantly constraining real-world risk despite the high confidentiality impact rating.
Uninitialized memory exposure in the UI layer of Google Chrome on Android (prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. The vulnerability is CWE-457 (use of uninitialized variable) and is scoped to the Android platform only. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch has been released.
UI spoofing via inappropriate History implementation in Google Chrome prior to 150.0.7871.47 allows a remote attacker to present falsified browsing context to a victim through a crafted HTML page. The flaw (CWE-451) permits manipulation of how history entries are represented in the browser's UI, potentially misleading users about their navigation state or visited URLs. No public exploits are known, EPSS probability sits at 0.21% (11th percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the monitor-and-patch category rather than emergency response.
Navigation restriction bypass in Google Chrome's WebView component on Android (all versions prior to 150.0.7871.47) allows remote unauthenticated attackers to circumvent enforcement of navigation policies via a specially crafted HTML page, producing high integrity impact with no confidentiality or availability consequence. The CVSS vector (PR:N, UI:R) confirms unauthenticated network exploitation gated on victim interaction, consistent with a social-engineering or malicious-redirect delivery. No public exploit exists and CISA has not added this to KEV; EPSS of 0.22% (13th percentile) and SSVC Exploitation:none collectively indicate low active exploitation probability at time of analysis.
Cross-origin data leakage in Google Chrome's DevTools component (versions prior to 150.0.7871.47) permits a remote attacker to exfiltrate data across origin boundaries by tricking a user into performing specific UI gestures on a crafted HTML page. The CVSS base score of 3.1 (Low) reflects high attack complexity and mandatory user interaction, consistent with the EPSS score of 0.21% (11th percentile) indicating negligible in-the-wild exploitation activity. No public exploit code is identified and no CISA KEV listing exists; a vendor patch is available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already achieved renderer process compromise to escape PDF-layer sandboxing controls via a crafted HTML page, circumventing browser navigation security boundaries. This is a chained-attack-only scenario: the flaw is not independently exploitable and requires a prior renderer compromise as a prerequisite. No public exploit has been identified, EPSS is 0.22% (13th percentile), and SSVC rates exploitation as none - making this a theoretical second-stage risk rather than an immediate standalone threat. Vendor-released patch is confirmed at version 150.0.7871.47.
Process memory disclosure in Google Chrome DevTools on Windows (versions prior to 150.0.7871.47) allows a remote attacker to read potentially sensitive data from browser process memory by serving a crafted HTML page and convincing a user to perform specific UI gestures. The flaw stems from insufficient input validation (CWE-20) within the DevTools subsystem and is limited to the Windows platform. No public exploit code or CISA KEV listing has been identified at time of analysis, but the confidentiality impact is rated High by NVD.
UI spoofing in Google Chrome's Passwords component (all versions prior to 150.0.7871.47) enables remote, unauthenticated attackers to misrepresent critical interface elements to users via a specially crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in Chrome's password management UI, meaning a malicious page can render deceptive credential-related prompts or overlays that appear to originate from the browser's trusted Passwords subsystem. No public exploit code has been identified and CISA SSVC rates active exploitation as none, making this a moderate-priority patching item rather than an emergency response.
Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) enables remote attackers to violate cross-origin isolation by delivering a crafted HTML page to a victim user. The flaw originates in Blink's insufficient validation of untrusted input (CWE-20), resulting in a limited integrity impact when a user browses to attacker-controlled content. No active exploitation is confirmed - SSVC classifies exploitation as none, EPSS sits at 0.22% (13th percentile), and the vulnerability is absent from CISA KEV - and a vendor patch has been released in Chrome 150.0.7871.47.
Uninitialized memory use in the codec subsystem of Google Chrome on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. All Chrome for Windows releases prior to 150.0.7871.47 are affected; the flaw is platform-specific and does not affect Chrome on Linux, macOS, or mobile. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, though the CVSS C:H rating reflects meaningful confidentiality risk, and the uninitialized read could serve as a precursor step toward ASLR bypass in a chained attack.
Incorrect security UI in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 enables Universal Cross-Site Scripting (UXSS), allowing script or HTML injection across web origins via a crafted HTML page. Exploitation requires that the victim user be socially engineered into installing a malicious extension, after which a crafted page triggers the CWE-79 flaw in the Extensions UI. No public exploit exists at time of analysis, EPSS sits at the 4th percentile, and CISA has not listed this in KEV, consistent with the SSVC exploitation:none assessment.
UI spoofing in Google Chrome's PageInfo component (all versions prior to 150.0.7871.47) enables remote attackers to misrepresent the browser's security indicators through a crafted HTML page that induces specific user UI gestures. The flaw (CWE-451) causes the PageInfo panel - the panel users consult to evaluate site trustworthiness - to render incorrect security UI, potentially deceiving victims into trusting malicious or unverified origins. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires high attack complexity and deliberate user interaction, keeping real-world risk moderate despite the ubiquitous deployment footprint of Chrome.
UI spoofing in Google Chrome's CustomTabs component on Android enables a local attacker to manipulate what a victim sees within an in-app browser session by supplying a malicious file, affecting all Chrome for Android versions prior to 150.0.7871.47. The CVSS score of 3.3 (Low) and EPSS of 0.13% (3rd percentile) reflect constrained real-world impact: exploitation is local, requires user interaction, and produces only integrity-level spoofing. No active exploitation has been confirmed - this vulnerability is not listed in CISA KEV, and SSVC assessment indicates exploitation status of none.
Insufficient XML policy enforcement in Google Chrome on Android (prior to 150.0.7871.47) exposes process memory contents to remote attackers who can deliver a crafted HTML page. The flaw is classified under CWE-284 (Improper Access Control), allowing the browser's XML handling to bypass intended isolation boundaries and leak potentially sensitive in-process data - such as cookies, credentials, or other runtime state - to an attacker-controlled origin. No active exploitation is confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 6.5 (Medium) reflects meaningful real-world risk given the zero-authentication, high-confidentiality-impact profile.
Navigation restriction bypass in Google Chrome's SplitView feature (prior to 150.0.7871.47) enables a remote attacker who has already achieved renderer process compromise to escape navigation controls via a crafted HTML page. The CWE-284 (Improper Access Control) root cause means Chrome's SplitView fails to enforce navigation policy in a post-renderer-compromise context, making this a chained exploit component rather than a standalone initial-access vector. EPSS is very low (0.22%, 13th percentile), no public exploit code has been identified, and SSVC rates exploitation as none with partial technical impact at time of analysis.