Monthly
Cross-origin data leakage in Google Chrome's PerformanceAPI implementation (versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to infer sensitive data from other browser origins by luring a victim to visit a crafted HTML page. The flaw exploits timing measurements exposed by the Performance API to create a side-channel that bypasses the Same-Origin Policy for limited data reads. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS probability stands at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' assessment.
Uninitialized GPU memory use in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to read sensitive data from GPU process memory by delivering a crafted HTML page. This is a second-stage information disclosure primitive - exploitation is contingent on a prior renderer compromise, making it a component of a multi-vulnerability attack chain rather than a standalone critical issue. No public exploit code or CISA KEV listing has been identified at time of analysis; Google has released a patched stable channel build (150.0.7871.47).
Insufficient policy enforcement in the Payments component of Google Chrome on Android prior to 150.0.7871.47 exposes potentially sensitive data from process memory to remote attackers. Exploitation requires a victim to visit a specially crafted HTML page, making this a user-interaction-dependent, network-delivered information disclosure. No active exploitation is confirmed (SSVC: Exploitation: none; not listed in CISA KEV), and no public exploit code has been identified at time of analysis, though the CVSS confidentiality impact is rated High due to the potential for process memory leakage.
UI spoofing via crafted extension in Google Chrome prior to 150.0.7871.47 allows a network-positioned attacker who successfully social-engineers a user into installing a malicious extension to misrepresent browser interface elements through insufficient policy enforcement in the Extensions subsystem. The vulnerability is rated CVSS 3.1 (Low) with high attack complexity due to the required social engineering, and carries no integrity impact beyond UI deception. No active exploitation is confirmed - EPSS is 0.13% (3rd percentile) and SSVC categorizes exploitation status as none, placing this squarely in a low-urgency remediation tier.
Uninitialized memory read in Google Chrome's XR (Extended Reality/WebXR) subsystem exposes process memory to a remote attacker who has already achieved renderer process compromise. Affected versions are all Chrome releases prior to 150.0.7871.47. This is a second-stage, chained vulnerability - an attacker leverages a crafted HTML page to trigger the uninitialized read and extract sensitive data from process memory, but only after separately exploiting a renderer process escape. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data leakage in Google Chrome on iOS (prior to 150.0.7871.47) stems from an inappropriate implementation in the ScriptInjections subsystem, exploitable by a remote attacker who can lure a victim to a crafted HTML page. The flaw allows the attacker's origin to read data belonging to a different, protected origin - a fundamental violation of the Same-Origin Policy on Apple's iOS platform. No public exploit code has been identified at time of analysis, EPSS places exploitation probability at 0.22% (13th percentile), and SSVC signals no observed active exploitation, making this a medium-priority patch item despite its cross-origin impact.
UI spoofing in Google Chrome on Linux (prior to 150.0.7871.47) allows a threat actor who socially engineers a victim into installing a crafted Chrome Extension to misrepresent browser UI elements, such as address bar content or security indicators, deceiving users about the legitimacy of web content. Exploitation requires both a Linux platform and successful social engineering to install the malicious extension, making mass automated attacks infeasible. No public exploit code exists, EPSS is 0.13% (3rd percentile), and CISA SSVC confirms exploitation status as none - consistent with the CVSS 3.1 Low score.
Cross-origin data leakage in Google Chrome's DataTransfer implementation on macOS exposes sensitive content from one origin to an attacker-controlled page by exploiting improper boundary enforcement during user-driven UI gestures such as drag-and-drop. Versions prior to 150.0.7871.47 on Mac are affected; the flaw is platform-specific to macOS, limiting scope. No public exploit has been identified and SSVC assessment confirms no current exploitation, though successful abuse would silently exfiltrate cross-origin data without triggering typical security warnings.
Uninitialized memory use in Chrome's CSS engine on Android exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Unauthenticated remote attackers can trigger this information leak against any Android Chrome user who visits attacker-controlled content (CVSS PR:N, UI:R), with high confidentiality impact per the CVSS vector. Notably, Chromium's internal severity rating is Medium despite the C:H CVSS impact, suggesting reliable extraction of useful sensitive data may be inconsistent in practice; no public exploit code or CISA KEV listing exists at time of analysis.
UI spoofing in Google Chrome's Video Capture component on ChromeOS allows a local attacker to deceive users by rendering misleading interface elements through a specially crafted HTML page. Versions prior to 150.0.7871.47 on ChromeOS are affected. No public exploit code exists and no active exploitation is confirmed - EPSS is 0.13% (3rd percentile) and SSVC rates exploitation as none - making this a low operational priority despite the low-complexity attack conditions.
UI spoofing in Google Chrome for Android's SiteSettings component (versions prior to 150.0.7871.47) enables remote attackers to deceive users about site origin or permission context via a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could cause victims to grant permissions to unintended origins or trust fraudulent site identity indicators. No public exploit or active exploitation has been identified; CISA SSVC and EPSS both confirm minimal real-world exploitation pressure at this time.
Uninitialized memory exposure in Google Chrome's Cast component prior to 150.0.7871.47 allows an unauthenticated attacker on the same local network segment to leak sensitive contents from the browser's process memory via malicious Cast protocol traffic. The root cause is CWE-457 (Use of Uninitialized Variable): memory allocated for Cast operations is not zeroed before use, allowing residual in-memory data - potentially including credentials, session tokens, or cached page content - to be disclosed in responses to crafted network input. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Google has released a patched build.
UI spoofing in Google Chrome's WebShare implementation on Android allows a remote attacker who has already compromised the renderer process to deceive users via a malicious HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. The exploitation path is severely constrained by the requirement for a pre-existing renderer compromise, yielding a CVSS base score of only 3.1 (Low); no public exploit code exists and SSVC assessment confirms no active exploitation at time of analysis.
Cross-origin credential data leakage in Google Chrome's Passwords component (prior to 150.0.7871.47) enables a renderer-level attacker to exfiltrate saved passwords across origins via a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-284) in Chrome's built-in password manager, exploitable only when the attacker has already achieved renderer process compromise - making this a second-stage component in an exploit chain rather than a standalone threat. No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) alongside SSVC exploitation status of 'none' confirms limited real-world exploitation activity.
Memory disclosure in Google Chrome's Passwords component on Android prior to 150.0.7871.47 allows a remote attacker to extract potentially sensitive information from process memory. Exploitation requires luring a target user to visit a specially crafted HTML page, placing this squarely in the social-engineering-assisted drive-by category. No public exploit code has been identified at time of analysis, but the high confidentiality impact (C:H in CVSS) indicates meaningful credential exposure risk given Chrome's role as a primary password manager on Android devices.
Side-channel information leakage via the ComputePressure API in Google Chrome prior to 150.0.7871.47 enables remote attackers to read cross-origin data by inducing a victim to visit a crafted HTML page. The vulnerability exploits physical or logical resource-pressure side channels exposed through the ComputePressure browser API, violating the same-origin policy's confidentiality guarantees. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) corroborates the low near-term exploitation probability despite the high confidentiality impact rating.
Insufficient policy enforcement in Chrome's built-in Passwords subsystem (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to read potentially sensitive credential data from process memory via a crafted HTML page. This is a second-stage, chained information-disclosure flaw - not a standalone exploit - that bypasses Chrome's inter-process access boundaries to reach password manager data. No public exploit code has been identified at time of analysis, and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Cross-origin data exfiltration in Google Chrome's Sharing feature on Android exposes sensitive page content to remote attackers who have already compromised the renderer process, exploitable via a crafted HTML page. All Chrome for Android builds prior to 150.0.7871.47 are affected; the fixed release is confirmed by Google's stable channel advisory. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate negligible observed exploitation pressure at time of analysis, though the high confidentiality impact and ubiquitous deployment of Chrome on Android make patching a clear priority.
UI spoofing in Google Chrome on Windows (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to manipulate the browser interface via a specially crafted HTML page, potentially deceiving users into interacting with falsified content or controls. The vulnerability stems from an inappropriate implementation in the Media component and is classified as medium severity (CVSS 6.5). No public exploit code or active exploitation has been identified - EPSS sits at the 11th percentile (0.21%) and no CISA KEV listing exists - and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome prior to version 150.0.7871.47 enables remote attackers to circumvent browser policy enforcement via a crafted HTML page targeting the 'Actor' component. The flaw is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), where controls that should be authoritative are applied within the browser and can be subverted by an adversary-controlled page. EPSS at 0.22% (13th percentile) indicates low current exploitation probability, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV; no public exploit identified at time of analysis.
Navigation restriction bypass in Google Chrome's DevTools component on Android (all versions prior to 150.0.7871.47) allows a local attacker to circumvent policy-enforced browsing controls by delivering a crafted malicious file. The vulnerability is confined to Android - desktop Chrome is not in scope - and requires user interaction with the malicious file, substantially narrowing the realistic attack surface. No public exploit code exists and no active exploitation has been confirmed; an EPSS score of 0.14% (3rd percentile) corroborates low real-world exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to circumvent Chrome's network navigation controls via a crafted HTML page. The vulnerability stems from CWE-20 (Improper Input Validation) in Chrome's Network component, producing a high-integrity impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) places exploitation likelihood well below the median, though the pre-compromised renderer prerequisite makes this a chained attack vector relevant primarily within multi-stage browser exploitation chains.
Same-origin policy bypass in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to perform cross-origin integrity violations by serving a crafted HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. This is explicitly a chained attack requiring a pre-existing renderer compromise, making it a second-stage exploit rather than a standalone entry point. No public exploit code exists and no public exploitation has been confirmed at time of analysis.
Uninitialized GPU memory use in Google Chrome on Android prior to 150.0.7871.47 allows a remote attacker to read potentially sensitive data from process memory by luring a user to a crafted HTML page. The flaw (CWE-457) is confined to the Android GPU code path and requires only user interaction to trigger, with CVSS confirming unauthenticated network delivery and High confidentiality impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Google has released a fix in stable channel version 150.0.7871.47.
Side-channel cross-origin data leakage in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows remote attackers to infer sensitive content belonging to other origins by enticing a victim to visit a crafted HTML page. The vulnerability exploits a weakness in the Paint subsystem's rendering pipeline (CWE-1300: Improper Protection of Physical Side Channels), enabling an attacker page to observe rendering state or timing variations and reconstruct protected cross-origin data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS probability is low at 0.21% (11th percentile). Vendor-released patch is available in Chrome 150.0.7871.47.
Same-origin policy bypass in Google Chrome's DeviceBoundSessionCredentials component allows remote attackers to violate cross-origin isolation guarantees via a crafted HTML page. Affected are all Chrome desktop releases prior to 150.0.7871.47 on all supported platforms. Exploitation requires user interaction (visiting an attacker-controlled page) and yields high integrity impact - enabling cross-origin state manipulation - with no confidentiality or availability consequence. No active exploitation is confirmed (not in CISA KEV), EPSS is low at 0.22% (13th percentile), and SSVC rates exploitation as none with partial technical impact; a vendor patch is available.
Site isolation bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to circumvent extension policy enforcement and escape site isolation boundaries via a crafted HTML page. The root cause (CWE-602) is client-side enforcement of security policies in the Extensions subsystem that can be subverted once the renderer is under attacker control. No active exploitation has been confirmed - EPSS is 0.22% (13th percentile), SSVC rates exploitation as none and the attack as non-automatable - and a vendor-released patch is available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) allows a remote attacker to subvert browser-enforced navigation controls by luring a user into performing specific UI gestures on a crafted HTML page. Classified as CWE-20 (Improper Input Validation), the flaw undermines integrity by permitting unauthorized navigation that the browser is intended to block. No public exploit code exists and EPSS sits at 0.22% (13th percentile), indicating low observed exploitation probability; the vulnerability is not listed in CISA KEV.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser interface elements - such as the address bar or origin indicators - by serving a crafted HTML page, potentially deceiving users into trusting malicious content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms network-reachable exploitation with no privilege requirement but mandatory user interaction, limiting impact to partial integrity loss with no confidentiality or availability effect. No public exploit or active exploitation has been identified; an EPSS score of 0.21% at the 11th percentile indicates very low current exploitation probability, and this vulnerability does not appear in the CISA KEV catalog.
Chrome's built-in Passwords subsystem on macOS leaks sensitive process memory contents when a malicious file is processed, potentially exposing stored credentials or authentication tokens to a local attacker. All Google Chrome releases for Mac prior to 150.0.7871.47 are affected. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the confidentiality impact is rated High given the nature of the data at risk within the Passwords feature.
Cross-origin data leakage in Google Chrome's Autofill subsystem on iOS (versions prior to 150.0.7871.47) enables remote attackers to read sensitive data across origin boundaries by luring victims into performing specific UI gestures on a crafted page. Rooted in CWE-346 (Origin Validation Error), the Autofill policy enforcement layer fails to maintain proper origin isolation under targeted interaction conditions. With an EPSS of 0.21% (11th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the CVSS-rated High confidentiality impact warrants prompt patching given Chrome's broad iOS deployment footprint.
UI spoofing in Google Chrome's Safe Browsing component on iOS enables remote attackers to mislead users through a crafted HTML page, potentially causing them to dismiss or misinterpret security warnings. Only Chrome for iOS versions prior to 150.0.7871.47 are affected; the desktop channel is not impacted by this specific flaw. No public exploit code exists and exploitation probability is very low (EPSS 0.21%, 11th percentile), though the network-accessible, zero-authentication attack surface keeps it relevant where phishing-style delivery is feasible.
Insufficient policy enforcement in the Spellcheck component of Google Chrome prior to 150.0.7871.47 exposes process memory to attackers who have already achieved renderer process compromise. The vulnerability enables a second-stage information disclosure step in a chained attack: after compromising the renderer, the attacker serves a crafted HTML page that exploits the Spellcheck policy gap to read potentially sensitive data from memory. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Google has released a fix in the stable channel update.
Cross-origin data leakage in the WebXR implementation of Google Chrome on Android (versions prior to 150.0.7871.47) allows remote unauthenticated attackers to exfiltrate sensitive cross-origin information by enticing a victim to visit a crafted HTML page. The flaw is rooted in CWE-693 (Protection Mechanism Failure), where WebXR fails to enforce cross-origin isolation policies on Android specifically. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; the vulnerability is not listed in the CISA KEV catalog.
Navigation restriction bypass in Google Chrome's Omnibox on iOS (prior to 150.0.7871.47) enables a remote attacker to circumvent address bar security controls through insufficient input validation, contingent on user interaction with specific UI gestures during exposure to malicious network traffic. The integrity impact is rated High (I:H) with no confidentiality or availability impact, consistent with a content/navigation spoofing class of vulnerability. No public exploit code or CISA KEV listing has been identified; EPSS score of 0.20% (10th percentile) indicates low observed exploitation probability at time of analysis.
UI spoofing in Google Chrome's iOSWeb component on iOS allows remote attackers to misrepresent interface elements to users running versions prior to 150.0.7871.47. The vulnerability, rooted in an inappropriate implementation (CWE-451), is triggered when a user performs specific UI gestures on a crafted HTML page, enabling spoofing of security-critical browser interface elements such as the address bar or permission dialogs. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity and mandatory user interaction meaningfully constrain real-world risk.
Out-of-bounds read in Google Chrome's Codecs component (prior to 150.0.7871.47) enables remote attackers to leak sensitive data from renderer process memory by delivering a crafted HTML page. The CVSS C:H rating reflects meaningful exposure of in-process data such as session tokens or credentials, though Chromium's own team assessed this as Medium severity, and the sandbox boundary (S:U) limits blast radius to the renderer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition exploitation in Google Chrome for iOS (prior to 150.0.7871.47) exposes potentially sensitive data from process memory to a local attacker with physical device access. The flaw is rooted in improper synchronization (CWE-362) and requires high attack complexity to successfully win the timing window. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor has released a patching fix in the 150.0.7871.47 stable channel update.
Navigation restriction bypass in Google Chrome's Safe Browsing implementation on iOS allows a remote, unauthenticated attacker to circumvent phishing and malicious-site protections via a specially crafted HTML page, affecting all Chrome for iOS versions prior to 150.0.7871.47. The flaw is classified as CWE-693 (Protection Mechanism Failure), meaning the Safe Browsing guard can be rendered ineffective rather than defeated through cryptographic or authentication means. No public exploit or CISA KEV listing has been identified, and the EPSS score of 0.23% (14th percentile) signals low current exploitation probability - but the zero-prerequisite network delivery and high integrity impact make this a meaningful risk for iOS users who have not updated.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to misrepresent browser interface elements - such as address bars or security indicators - by delivering a crafted HTML page to a victim on an iOS device. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw exploits an inappropriate implementation specific to Chrome's iOS code path, which differs from desktop Chrome due to WKWebView constraints imposed by Apple. No public exploit code exists, CISA SSVC rates exploitation as none, and EPSS sits at the 12th percentile, indicating minimal real-world threat at time of analysis.
Navigation restriction bypass in Google Chrome's Chromecast implementation (versions prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to circumvent navigation restrictions via a specially crafted HTML page. This is a post-compromise escalation primitive rather than a standalone entry point - the renderer must already be under attacker control, making this a link in an exploit chain rather than an initial access vector. No public exploit has been identified at time of analysis; EPSS at 0.23% (14th percentile) reflects very low observed exploitation probability, consistent with the chained-exploit requirement.
Navigation restriction bypass in Google Chrome's Glic feature (versions prior to 150.0.7871.47) enables remote attackers to circumvent policy enforcement controls by delivering a crafted HTML page that triggers insufficient validation logic. The flaw maps to CWE-602, meaning security enforcement intended to be authoritative is implemented client-side in a bypassable manner, resulting in high integrity impact with no confidentiality or availability consequence. No public exploit or active exploitation has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability.
UI spoofing via Chrome's Autofill component affects all desktop installations prior to version 150.0.7871.47, enabling a remote attacker to misrepresent interface elements through a crafted HTML page. Exploitation requires both navigating to an attacker-controlled page and performing specific UI gestures, reflected in CVSS AC:H and UI:R - passive browsing is insufficient. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.2 Medium score reflects limited integrity and availability impact with no confidentiality loss.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a network-positioned attacker to circumvent browser-enforced navigation policies via a crafted HTML page. The attacker must occupy a privileged network position (e.g., man-in-the-middle) and requires user interaction with the malicious page, per the CVSS UI:R and the description's explicit network-position prerequisite. With an EPSS of 0.15% at the 5th percentile, no public exploit code, and no CISA KEV listing, exploitation probability is low - this is a medium-severity issue with a meaningful but situational attack barrier.
Cross-origin data exfiltration in Google Chrome's WebUI component (versions prior to 150.0.7871.47) enables remote attackers to leak sensitive data across origin boundaries by delivering crafted malicious network traffic to an unpatched browser. The flaw arises from insufficient input validation (CWE-20) within the WebUI layer, undermining same-origin policy protections and exposing data from isolated origins to attacker-controlled contexts. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, EPSS sits at 0.20% (10th percentile), and no public POC has been identified; a vendor-released patch is available in Chrome 150.0.7871.47.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 exposes sensitive information from other origins when a remote attacker convinces a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from an inappropriate implementation in the iOS-specific Chrome browser layer, classified under CWE-451 (UI Misrepresentation), and enables confidentiality compromise without requiring attacker privileges. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (12th percentile) signals low near-term automated exploitation risk.
Out-of-bounds read in the Chromecast component of Google Chrome prior to 150.0.7871.47 enables a remote attacker, who has already achieved renderer process compromise, to exfiltrate potentially sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - it cannot be exploited in isolation and requires a prior renderer compromise as a prerequisite. Google has released a patch in Chrome 150.0.7871.47; no public exploit code or CISA KEV listing has been identified at time of analysis.
Side-channel information leakage in WebAuthentication within Google Chrome on iOS (versions prior to 150.0.7871.47) enables a remote attacker to infer cross-origin data by directing a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms network-exploitable impact with high confidentiality loss, constrained by mandatory user interaction and scoped exclusively to the iOS platform. No public exploit identified at time of analysis; EPSS at 0.25% (16th percentile) signals low near-term exploitation probability, and no CISA KEV listing is present.
Cross-origin data leakage in Google Chrome's NFC implementation on Android exposes sensitive information to attackers who have already compromised the renderer process. Chrome versions prior to 150.0.7871.47 on Android fail to properly validate origins when handling NFC interactions, allowing a renderer-level attacker to read data across origin boundaries via a crafted HTML page. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at the 11th percentile, indicating low observed exploitation probability despite the theoretical confidentiality impact.
Content Security Policy bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote attackers to circumvent enforcement mechanisms via a specially crafted HTML page, resulting in high-integrity impact with no confidentiality or availability consequence. Affected versions are all Chrome releases prior to 150.0.7871.47. User interaction is required - the victim must visit the attacker-controlled page - and no public exploit or CISA KEV listing has been identified at time of analysis. The low EPSS score of 0.22% (13th percentile) reinforces that active exploitation is not currently observed.
Same-origin policy bypass in Google Chrome's WebAppInstalls component allows remote attackers to compromise cross-origin integrity via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-346, Origin Validation Error) in the PWA installation subsystem, enabling an attacker to perform unauthorized cross-origin writes or manipulations when a user visits attacker-controlled content. No public exploit identified at time of analysis, and the EPSS score of 0.23% (14th percentile) indicates low near-term exploitation probability, though the ubiquitous deployment of Chrome elevates aggregate exposure.
Use-after-free in Google Chrome's Bluetooth subsystem (all versions prior to 150.0.7871.47) enables an unauthenticated attacker within Bluetooth radio range to leak sensitive data from Chrome's process memory by operating a malicious Bluetooth peripheral. The CVSS vector (AV:A/PR:N/UI:N/C:H) confirms no attacker-side authentication is required and impact is confidentiality-only, with no integrity or availability loss. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV; the Chromium security team rated this Medium severity, consistent with the bounded adjacency-only attack vector.
Process memory disclosure in Google Chrome's ANGLE graphics abstraction layer (versions prior to 150.0.7871.47) enables a renderer-compromised attacker to read potentially sensitive data from process memory via a crafted HTML page. This is a post-exploitation, second-stage vulnerability: it cannot be triggered without a prior renderer process compromise, functioning as a chaining component rather than a standalone entry point. No public exploit code or CISA KEV listing has been identified at time of analysis; Chromium's own team rates it Medium severity, consistent with the prerequisite attack complexity.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 is achievable by an attacker holding a privileged network position who can manipulate traffic between the victim's browser and a server. The flaw originates in Chrome's Network component (CWE-693: Protection Mechanism Failure), where an inappropriate implementation allows CSP enforcement to be circumvented via crafted network traffic, yielding a High Integrity impact. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries an EPSS score of 0.15% (4th percentile) - but the attack vector is unauthenticated and the integrity impact is significant for high-value targets on adversarial networks.
Memory disclosure in Google Chrome's GPU component on Windows enables a remote attacker - who has already established renderer process compromise - to extract sensitive data from process memory via a crafted HTML page. Affected versions are all Chrome for Windows releases prior to 150.0.7871.47. This is a second-stage exploit component: it does not independently achieve remote code execution but can be chained with a renderer exploit to leak process memory contents, potentially exposing credentials, tokens, or other in-memory sensitive data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition in the DataTransfer API in Google Chrome prior to 150.0.7871.47 allows a remote attacker to read potentially sensitive data from renderer process memory by luring a user to a specially crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the impact is limited to confidentiality - no integrity or availability loss - and that reliable exploitation requires winning a timing race (AC:H) combined with user interaction. No public exploit identified at time of analysis; Google has shipped a patch in the stable channel update dated June 2026.
Out-of-bounds read in Chrome's Layout engine prior to 150.0.7871.47 allows remote attackers to leak potentially sensitive data from the renderer process memory by serving a crafted HTML page. User interaction is required - the victim must visit the malicious page - limiting automated mass exploitation. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, placing real-world urgency below what the CVSS 6.5 score alone might suggest.
GuestView policy enforcement in Google Chrome prior to 150.0.7871.47 can be subverted by an attacker who has already achieved renderer process compromise, allowing site isolation to be bypassed via a crafted HTML page. The flaw (CWE-602: Client-Side Enforcement of Server-Side Security) enables manipulation of cross-origin content or policy in embedded browsing contexts that Chrome's site isolation architecture is designed to protect. No public exploit code has been identified and EPSS places exploitation probability at 0.22% (13th percentile), consistent with the elevated prerequisite of a prior renderer compromise required to trigger this vulnerability.
Site isolation bypass in Google Chrome on Android prior to 150.0.7871.47 enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to break cross-origin security boundaries using a crafted HTML page. The root cause is CWE-346 (Origin Validation Error) in Chrome's Android-specific network implementation, meaning the network layer fails to enforce origin checks when requests originate from a compromised renderer context. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.22% at the 13th percentile reflects the high chaining complexity required.
UI spoofing via Chrome's Geolocation implementation (versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to deceive users about the origin or context of geolocation permission requests through a crafted HTML page. Exploitation requires user interaction with the malicious page, limiting automated attack potential. With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified, real-world exploitation risk is low despite the broad deployment footprint of Chrome.
Site isolation bypass in Google Chrome for Android (prior to 150.0.7871.47) allows a remote attacker who has already achieved renderer process compromise to cross origin boundaries using a crafted HTML page, enabling high-integrity impact against other open sites. The root cause is CWE-20 (Improper Input Validation) within Chrome's Input subsystem on Android - an input handling implementation flaw that fails to enforce cross-origin separation once the renderer is under adversary control. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), placing this firmly in the category of a meaningful escalation primitive rather than a standalone mass-exploitation risk.
UI spoofing in Google Chrome Enterprise prior to version 150.0.7871.47 allows unauthenticated remote attackers to deceive users into believing they are interacting with legitimate browser UI by serving a crafted HTML page. The root cause is insufficient validation of untrusted HTML input within Chrome's Enterprise component (CWE-20), enabling an attacker to manipulate visual elements such as address bars, dialog prompts, or permission requests. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low current exploitation probability despite a network-accessible attack vector.
Insufficient Web Authentication (WebAuthn/Passkeys) policy enforcement in Google Chrome on iOS prior to 150.0.7871.47 enables cross-origin data leakage to an attacker controlling a privileged network position. The flaw stems from CWE-693 (Protection Mechanism Failure) in the browser's WebAuthn subsystem, which fails to enforce origin isolation correctly when processing crafted HTML pages. No public exploit code exists and CISA has not listed this in KEV, but the high confidentiality impact (C:H) and the specificity of Chrome-on-iOS as the attack surface make this a targeted patching priority for organizations with a managed iOS fleet.
UI spoofing in Google Chrome's Autofill component on Windows (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users into interacting with forged security UI elements by convincing them to perform specific on-page gestures against a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an adversary to obscure or fabricate Autofill security indicators, potentially tricking users into submitting saved credentials or personal data to attacker-controlled destinations. No public exploit or CISA KEV listing has been confirmed; Google has released a fix in stable channel version 150.0.7871.47.
Out-of-bounds read in Chrome's bundled FFmpeg video decoding component (all versions prior to 150.0.7871.47) allows a remote attacker to leak renderer process memory contents via a crafted video file. The CVSS vector confirms network reachability with no required privileges (PR:N) but mandates user interaction (UI:R), meaning the victim must process the malicious video. SSVC assessment rates exploitation as none and the attack non-automatable, and no public exploit has been identified at time of analysis; Google has released a patched build at 150.0.7871.47.
UI spoofing via crafted HTML in Google Chrome's Geometry component (versions prior to 150.0.7871.47) enables remote attackers to misrepresent security-critical interface elements to users who are socially engineered into performing specific UI gestures. The flaw stems from an inappropriate implementation in Chrome's Geometry subsystem (CWE-451), affecting the integrity and availability of the browser interface at low impact levels. No public exploit or active exploitation has been identified; Google has released a confirmed patch in version 150.0.7871.47.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to exfiltrate sensitive information from other origins by luring victims to a crafted HTML page that exploits insufficient input validation. The vulnerability carries a CVSS 6.5 with high confidentiality impact (AV:N/PR:N/C:H) but requires user interaction and is iOS-platform-specific, constraining the realistic attack surface. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.22% at the 12th percentile and SSVC rates exploitation as none.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote unauthenticated attackers to display a falsified URL in the browser address bar by delivering a crafted HTML page to an iOS user. The flaw is classified CWE-451 (UI misrepresentation of critical information) and is iOS-platform-specific, with no impact on Chrome for Android, Windows, macOS, or Linux. No active exploitation is confirmed - the vulnerability is not listed in CISA KEV and EPSS sits at 0.22% (12th percentile) - but the spoofing primitive is a classic enabler of targeted phishing campaigns against mobile users.
Cross-origin data leakage in Google Chrome's Canvas component prior to version 150.0.7871.47 exposes sensitive cross-origin content to remote attackers via a crafted HTML page. The flaw bypasses Same-Origin Policy protections enforced at the Canvas API layer, enabling pixel-level or structured data extraction from cross-origin resources rendered in a canvas context. With CVSS 6.5, EPSS at 0.21% (11th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world exploitation is low-probability but credible given the zero-privilege, network-accessible attack path requiring only a single user visit.
Same-origin policy bypass in Google Chrome's CSS engine allows a remote, unauthenticated attacker to undermine web isolation guarantees by serving a crafted HTML page to an unsuspecting user. All Chrome releases prior to 150.0.7871.47 are affected. No public exploit code or active exploitation has been confirmed; SSVC rates exploitation as 'none' and EPSS sits at the 13th percentile, placing real-world urgency below what the I:H CVSS score alone might suggest.
Same-origin policy bypass in Google Chrome's CSS implementation allows a remote, unauthenticated attacker to violate cross-origin integrity protections by luring a user to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. Google has released a patch; no active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.22% at the 13th percentile indicates low current exploitation probability.
UI spoofing in Google Chrome before 150.0.7871.47 allows remote unauthenticated attackers to visually deceive users by serving a crafted HTML page that exploits a flaw in Chrome's CSS implementation. The flaw (CWE-451: UI Misrepresentation of Critical Information) enables attacker-controlled content to obscure or mimic trusted browser UI elements such as the address bar or security indicators, creating a credible phishing surface. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) indicates minimal observed exploitation activity; however, Google's internal Chromium severity rating of 'High' reflects the significant phishing and credential-theft potential inherent in convincing browser UI spoofing.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. The flaw exploits an inappropriate handling of CSS that causes Chrome's renderer to break the same-origin policy, enabling script execution in the context of other origins. No public exploit or CISA KEV listing has been identified; EPSS probability is very low (0.21%, 12th percentile), suggesting limited active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics library on macOS allows a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. Affected are all Chrome versions on Mac prior to 150.0.7871.47. The flaw stems from uninitialized memory use within ANGLE, Chrome's graphics abstraction layer, enabling residual memory contents from other security origins to be read and potentially returned to an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis; EPSS is low at 0.23% (13th percentile), consistent with a high-CVSS flaw constrained by both user-interaction and platform requirements.
Memory disclosure in Google Chrome's Enterprise policy implementation exposes sensitive process memory contents to remote attackers who can direct victims to a crafted HTML page. All Chrome desktop releases prior to 150.0.7871.47 are affected. No public exploit code exists and CISA SSVC classifies exploitation status as none, but the high confidentiality impact and zero-privilege-required attack path make prompt patching advisable for enterprise-managed Chrome deployments.
Cross-origin data leakage via Chrome's Autofill implementation on Android allows a remote attacker with prior renderer process compromise to extract sensitive data across origin boundaries using a crafted HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) reflects low observed exploitation activity; however, the cross-origin data exposure (CWE-346) combined with Autofill access creates meaningful privacy risk for users on vulnerable Android builds. Google has released a patch in the stable channel update.
Same-origin policy bypass in Google Chrome's Extensions implementation on Android prior to 150.0.7871.47 enables integrity violations across web origins. An attacker who successfully social-engineers a victim into installing a crafted malicious Chrome extension can exploit an inappropriate implementation in the Extensions subsystem to circumvent SOP controls, potentially modifying cross-origin content or injecting unauthorized actions. No public exploit exists and CISA SSVC assessment confirms no active exploitation; however, the I:H integrity impact and network-accessible delivery path keep this a meaningful patch priority for Android Chrome deployments.
Cross-origin data disclosure in Google Chrome's Skia graphics library on macOS allows a remote attacker who has already achieved renderer process compromise to trigger an out-of-bounds read and leak memory contents from other web origins via a crafted HTML page. All Chrome versions on Mac prior to 150.0.7871.47 are affected. No public exploit code has been identified and this vulnerability is absent from CISA KEV; an EPSS of 0.21% at the 11th percentile confirms very low near-term exploitation probability, and SSVC classifies exploitation status as none - indicating this is a chaining primitive in multi-stage attack chains, not a standalone threat.
Navigation restriction bypass in Google Chrome's Passwords subsystem allows a remote attacker to circumvent intended access controls by delivering a crafted HTML page to a user. All Chrome desktop versions prior to 150.0.7871.47 are affected, with integrity rated High by CVSS due to the ability to manipulate navigation behavior. No public exploit exists at time of analysis and EPSS sits at 0.22% (13th percentile), indicating low near-term exploitation probability despite Chrome's enormous global footprint and Chromium's internal 'High' severity classification.
Cross-origin data leakage in Google Chrome for Android prior to 150.0.7871.47 enables remote attackers to read data from other origins via a crafted HTML page exploiting insufficient validation in the File Input component. The flaw is Android-platform-specific, requiring only that a victim user navigate to an attacker-controlled page. No active exploitation has been confirmed (CISA KEV negative, SSVC exploitation: none), and EPSS at 0.21% (11th percentile) reflects low current exploitation interest, though the unauthenticated, low-complexity attack vector keeps it a relevant patching priority for Android Chrome deployments.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to inject arbitrary scripts or HTML across origins by exploiting insufficient input validation triggered through specific user UI gestures on a crafted page. The scope change (S:C in CVSS) is the critical dimension here - successful exploitation bypasses the same-origin policy, potentially granting the attacker script execution in the context of arbitrary origins within the browser session. No public exploit code has been identified and EPSS sits at just 0.20% (11th percentile), indicating low observed exploitation activity despite the high-impact class of vulnerability.
Memory disclosure in Google Chrome for Linux (prior to 150.0.7871.47) allows a remote attacker to read sensitive contents from the browser's process memory by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's input handling subsystem, and is platform-specific - only Linux builds are affected. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-reachable, zero-authentication attack path and high confidentiality impact make patching a near-term priority for Linux desktop environments.
Cross-origin data leakage via side-channel in Google Chrome's Safe Browsing component on iOS affects all Chrome versions prior to 150.0.7871.47, exploitable only by an attacker who has already compromised the renderer process. The vulnerability (CWE-1300) allows confidentiality impact through a crafted HTML page that abuses Safe Browsing timing or state signals to exfiltrate data across origin boundaries. No public exploit code exists at time of analysis, SSVC records exploitation as none, and EPSS probability sits at 0.21% (11th percentile), reflecting the significant prerequisite of prior renderer compromise.
Sensitive process memory exposure in Google Chrome for iOS prior to 150.0.7871.47 enables a physically present attacker to read potentially sensitive data from the browser's memory without authentication. The root cause is insufficient data validation (CWE-20) within the iOS-specific Chrome implementation. No public exploit code or CISA KEV listing has been identified at time of analysis, and the physical access requirement (CVSS AV:P) significantly constrains real-world attacker opportunity.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) permits a remote, unauthenticated attacker to circumvent client-side policy controls by delivering a crafted HTML page to a victim user. The flaw originates from insufficient policy enforcement (CWE-602), where navigation security logic enforced within the browser client can be subverted through malicious web content. No active exploitation has been identified - CISA KEV is not listed, SSVC confirms Exploitation: none, and the EPSS score of 0.22% (13th percentile) reflects minimal real-world exploitation activity at time of analysis.
Cross-origin data leakage in Google Chrome's SVG rendering subsystem (versions prior to 150.0.7871.47) allows remote attackers to exfiltrate sensitive information from other origins by directing victims to a crafted HTML page. The root cause is insufficient policy enforcement in SVG handling, classified as CWE-346 (Origin Validation Error), effectively bypassing Same-Origin Policy protections. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite a CVSS confidentiality impact rated High.
Side-channel information leakage via Chrome's Scroll implementation exposes cross-origin data to remote attackers who can lure a victim to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected; exploitation requires user interaction (visiting the attacker-controlled page) but no authentication. No public exploit identified at time of analysis and EPSS sits at the 11th percentile, though the confidentiality impact is rated High by NVD given the potential to read data from foreign origins.
### Impact Shovel and Federation plugins perform URI obfuscation in their worker (link) state. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Cross-site request forgery in Plugin for Google Analytics by IO Technologies (WordPress) versions up to and including 1.1 allows unauthenticated remote attackers to overwrite the site's Google Analytics tracking ID by tricking a logged-in administrator into clicking a crafted link. The flaw stems from absent nonce validation on the ga.php settings handler, meaning forged POST requests bypass WordPress's standard CSRF protections entirely. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 4.3 reflects the required administrator interaction and limited integrity-only impact.
Google OAuth login in Documenso through version 2.11.0 fails to enforce two-factor authentication during the OAuth callback flow, allowing a remote attacker to authenticate as any Google-linked user without completing MFA verification. The flaw resides in handle-oauth-callback-url.ts, where the oauth2fa state is not properly routed through the dedicated OAuth 2FA verification path - as confirmed by the PR diff showing the signin form was not checking the oauth2fa=true callback parameter. Publicly available exploit code exists (GitHub issue #2758), though no active exploitation has been confirmed and the CVSS 4.0 AC:H rating indicates the attack requires precise manipulation of the OAuth callback flow.
Cross-origin data leakage in Google Chrome's PerformanceAPI implementation (versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to infer sensitive data from other browser origins by luring a victim to visit a crafted HTML page. The flaw exploits timing measurements exposed by the Performance API to create a side-channel that bypasses the Same-Origin Policy for limited data reads. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS probability stands at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' assessment.
Uninitialized GPU memory use in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to read sensitive data from GPU process memory by delivering a crafted HTML page. This is a second-stage information disclosure primitive - exploitation is contingent on a prior renderer compromise, making it a component of a multi-vulnerability attack chain rather than a standalone critical issue. No public exploit code or CISA KEV listing has been identified at time of analysis; Google has released a patched stable channel build (150.0.7871.47).
Insufficient policy enforcement in the Payments component of Google Chrome on Android prior to 150.0.7871.47 exposes potentially sensitive data from process memory to remote attackers. Exploitation requires a victim to visit a specially crafted HTML page, making this a user-interaction-dependent, network-delivered information disclosure. No active exploitation is confirmed (SSVC: Exploitation: none; not listed in CISA KEV), and no public exploit code has been identified at time of analysis, though the CVSS confidentiality impact is rated High due to the potential for process memory leakage.
UI spoofing via crafted extension in Google Chrome prior to 150.0.7871.47 allows a network-positioned attacker who successfully social-engineers a user into installing a malicious extension to misrepresent browser interface elements through insufficient policy enforcement in the Extensions subsystem. The vulnerability is rated CVSS 3.1 (Low) with high attack complexity due to the required social engineering, and carries no integrity impact beyond UI deception. No active exploitation is confirmed - EPSS is 0.13% (3rd percentile) and SSVC categorizes exploitation status as none, placing this squarely in a low-urgency remediation tier.
Uninitialized memory read in Google Chrome's XR (Extended Reality/WebXR) subsystem exposes process memory to a remote attacker who has already achieved renderer process compromise. Affected versions are all Chrome releases prior to 150.0.7871.47. This is a second-stage, chained vulnerability - an attacker leverages a crafted HTML page to trigger the uninitialized read and extract sensitive data from process memory, but only after separately exploiting a renderer process escape. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data leakage in Google Chrome on iOS (prior to 150.0.7871.47) stems from an inappropriate implementation in the ScriptInjections subsystem, exploitable by a remote attacker who can lure a victim to a crafted HTML page. The flaw allows the attacker's origin to read data belonging to a different, protected origin - a fundamental violation of the Same-Origin Policy on Apple's iOS platform. No public exploit code has been identified at time of analysis, EPSS places exploitation probability at 0.22% (13th percentile), and SSVC signals no observed active exploitation, making this a medium-priority patch item despite its cross-origin impact.
UI spoofing in Google Chrome on Linux (prior to 150.0.7871.47) allows a threat actor who socially engineers a victim into installing a crafted Chrome Extension to misrepresent browser UI elements, such as address bar content or security indicators, deceiving users about the legitimacy of web content. Exploitation requires both a Linux platform and successful social engineering to install the malicious extension, making mass automated attacks infeasible. No public exploit code exists, EPSS is 0.13% (3rd percentile), and CISA SSVC confirms exploitation status as none - consistent with the CVSS 3.1 Low score.
Cross-origin data leakage in Google Chrome's DataTransfer implementation on macOS exposes sensitive content from one origin to an attacker-controlled page by exploiting improper boundary enforcement during user-driven UI gestures such as drag-and-drop. Versions prior to 150.0.7871.47 on Mac are affected; the flaw is platform-specific to macOS, limiting scope. No public exploit has been identified and SSVC assessment confirms no current exploitation, though successful abuse would silently exfiltrate cross-origin data without triggering typical security warnings.
Uninitialized memory use in Chrome's CSS engine on Android exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Unauthenticated remote attackers can trigger this information leak against any Android Chrome user who visits attacker-controlled content (CVSS PR:N, UI:R), with high confidentiality impact per the CVSS vector. Notably, Chromium's internal severity rating is Medium despite the C:H CVSS impact, suggesting reliable extraction of useful sensitive data may be inconsistent in practice; no public exploit code or CISA KEV listing exists at time of analysis.
UI spoofing in Google Chrome's Video Capture component on ChromeOS allows a local attacker to deceive users by rendering misleading interface elements through a specially crafted HTML page. Versions prior to 150.0.7871.47 on ChromeOS are affected. No public exploit code exists and no active exploitation is confirmed - EPSS is 0.13% (3rd percentile) and SSVC rates exploitation as none - making this a low operational priority despite the low-complexity attack conditions.
UI spoofing in Google Chrome for Android's SiteSettings component (versions prior to 150.0.7871.47) enables remote attackers to deceive users about site origin or permission context via a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could cause victims to grant permissions to unintended origins or trust fraudulent site identity indicators. No public exploit or active exploitation has been identified; CISA SSVC and EPSS both confirm minimal real-world exploitation pressure at this time.
Uninitialized memory exposure in Google Chrome's Cast component prior to 150.0.7871.47 allows an unauthenticated attacker on the same local network segment to leak sensitive contents from the browser's process memory via malicious Cast protocol traffic. The root cause is CWE-457 (Use of Uninitialized Variable): memory allocated for Cast operations is not zeroed before use, allowing residual in-memory data - potentially including credentials, session tokens, or cached page content - to be disclosed in responses to crafted network input. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Google has released a patched build.
UI spoofing in Google Chrome's WebShare implementation on Android allows a remote attacker who has already compromised the renderer process to deceive users via a malicious HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. The exploitation path is severely constrained by the requirement for a pre-existing renderer compromise, yielding a CVSS base score of only 3.1 (Low); no public exploit code exists and SSVC assessment confirms no active exploitation at time of analysis.
Cross-origin credential data leakage in Google Chrome's Passwords component (prior to 150.0.7871.47) enables a renderer-level attacker to exfiltrate saved passwords across origins via a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-284) in Chrome's built-in password manager, exploitable only when the attacker has already achieved renderer process compromise - making this a second-stage component in an exploit chain rather than a standalone threat. No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) alongside SSVC exploitation status of 'none' confirms limited real-world exploitation activity.
Memory disclosure in Google Chrome's Passwords component on Android prior to 150.0.7871.47 allows a remote attacker to extract potentially sensitive information from process memory. Exploitation requires luring a target user to visit a specially crafted HTML page, placing this squarely in the social-engineering-assisted drive-by category. No public exploit code has been identified at time of analysis, but the high confidentiality impact (C:H in CVSS) indicates meaningful credential exposure risk given Chrome's role as a primary password manager on Android devices.
Side-channel information leakage via the ComputePressure API in Google Chrome prior to 150.0.7871.47 enables remote attackers to read cross-origin data by inducing a victim to visit a crafted HTML page. The vulnerability exploits physical or logical resource-pressure side channels exposed through the ComputePressure browser API, violating the same-origin policy's confidentiality guarantees. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) corroborates the low near-term exploitation probability despite the high confidentiality impact rating.
Insufficient policy enforcement in Chrome's built-in Passwords subsystem (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to read potentially sensitive credential data from process memory via a crafted HTML page. This is a second-stage, chained information-disclosure flaw - not a standalone exploit - that bypasses Chrome's inter-process access boundaries to reach password manager data. No public exploit code has been identified at time of analysis, and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Cross-origin data exfiltration in Google Chrome's Sharing feature on Android exposes sensitive page content to remote attackers who have already compromised the renderer process, exploitable via a crafted HTML page. All Chrome for Android builds prior to 150.0.7871.47 are affected; the fixed release is confirmed by Google's stable channel advisory. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate negligible observed exploitation pressure at time of analysis, though the high confidentiality impact and ubiquitous deployment of Chrome on Android make patching a clear priority.
UI spoofing in Google Chrome on Windows (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to manipulate the browser interface via a specially crafted HTML page, potentially deceiving users into interacting with falsified content or controls. The vulnerability stems from an inappropriate implementation in the Media component and is classified as medium severity (CVSS 6.5). No public exploit code or active exploitation has been identified - EPSS sits at the 11th percentile (0.21%) and no CISA KEV listing exists - and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome prior to version 150.0.7871.47 enables remote attackers to circumvent browser policy enforcement via a crafted HTML page targeting the 'Actor' component. The flaw is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), where controls that should be authoritative are applied within the browser and can be subverted by an adversary-controlled page. EPSS at 0.22% (13th percentile) indicates low current exploitation probability, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV; no public exploit identified at time of analysis.
Navigation restriction bypass in Google Chrome's DevTools component on Android (all versions prior to 150.0.7871.47) allows a local attacker to circumvent policy-enforced browsing controls by delivering a crafted malicious file. The vulnerability is confined to Android - desktop Chrome is not in scope - and requires user interaction with the malicious file, substantially narrowing the realistic attack surface. No public exploit code exists and no active exploitation has been confirmed; an EPSS score of 0.14% (3rd percentile) corroborates low real-world exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to circumvent Chrome's network navigation controls via a crafted HTML page. The vulnerability stems from CWE-20 (Improper Input Validation) in Chrome's Network component, producing a high-integrity impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) places exploitation likelihood well below the median, though the pre-compromised renderer prerequisite makes this a chained attack vector relevant primarily within multi-stage browser exploitation chains.
Same-origin policy bypass in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to perform cross-origin integrity violations by serving a crafted HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. This is explicitly a chained attack requiring a pre-existing renderer compromise, making it a second-stage exploit rather than a standalone entry point. No public exploit code exists and no public exploitation has been confirmed at time of analysis.
Uninitialized GPU memory use in Google Chrome on Android prior to 150.0.7871.47 allows a remote attacker to read potentially sensitive data from process memory by luring a user to a crafted HTML page. The flaw (CWE-457) is confined to the Android GPU code path and requires only user interaction to trigger, with CVSS confirming unauthenticated network delivery and High confidentiality impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Google has released a fix in stable channel version 150.0.7871.47.
Side-channel cross-origin data leakage in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows remote attackers to infer sensitive content belonging to other origins by enticing a victim to visit a crafted HTML page. The vulnerability exploits a weakness in the Paint subsystem's rendering pipeline (CWE-1300: Improper Protection of Physical Side Channels), enabling an attacker page to observe rendering state or timing variations and reconstruct protected cross-origin data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS probability is low at 0.21% (11th percentile). Vendor-released patch is available in Chrome 150.0.7871.47.
Same-origin policy bypass in Google Chrome's DeviceBoundSessionCredentials component allows remote attackers to violate cross-origin isolation guarantees via a crafted HTML page. Affected are all Chrome desktop releases prior to 150.0.7871.47 on all supported platforms. Exploitation requires user interaction (visiting an attacker-controlled page) and yields high integrity impact - enabling cross-origin state manipulation - with no confidentiality or availability consequence. No active exploitation is confirmed (not in CISA KEV), EPSS is low at 0.22% (13th percentile), and SSVC rates exploitation as none with partial technical impact; a vendor patch is available.
Site isolation bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to circumvent extension policy enforcement and escape site isolation boundaries via a crafted HTML page. The root cause (CWE-602) is client-side enforcement of security policies in the Extensions subsystem that can be subverted once the renderer is under attacker control. No active exploitation has been confirmed - EPSS is 0.22% (13th percentile), SSVC rates exploitation as none and the attack as non-automatable - and a vendor-released patch is available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) allows a remote attacker to subvert browser-enforced navigation controls by luring a user into performing specific UI gestures on a crafted HTML page. Classified as CWE-20 (Improper Input Validation), the flaw undermines integrity by permitting unauthorized navigation that the browser is intended to block. No public exploit code exists and EPSS sits at 0.22% (13th percentile), indicating low observed exploitation probability; the vulnerability is not listed in CISA KEV.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser interface elements - such as the address bar or origin indicators - by serving a crafted HTML page, potentially deceiving users into trusting malicious content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms network-reachable exploitation with no privilege requirement but mandatory user interaction, limiting impact to partial integrity loss with no confidentiality or availability effect. No public exploit or active exploitation has been identified; an EPSS score of 0.21% at the 11th percentile indicates very low current exploitation probability, and this vulnerability does not appear in the CISA KEV catalog.
Chrome's built-in Passwords subsystem on macOS leaks sensitive process memory contents when a malicious file is processed, potentially exposing stored credentials or authentication tokens to a local attacker. All Google Chrome releases for Mac prior to 150.0.7871.47 are affected. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the confidentiality impact is rated High given the nature of the data at risk within the Passwords feature.
Cross-origin data leakage in Google Chrome's Autofill subsystem on iOS (versions prior to 150.0.7871.47) enables remote attackers to read sensitive data across origin boundaries by luring victims into performing specific UI gestures on a crafted page. Rooted in CWE-346 (Origin Validation Error), the Autofill policy enforcement layer fails to maintain proper origin isolation under targeted interaction conditions. With an EPSS of 0.21% (11th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the CVSS-rated High confidentiality impact warrants prompt patching given Chrome's broad iOS deployment footprint.
UI spoofing in Google Chrome's Safe Browsing component on iOS enables remote attackers to mislead users through a crafted HTML page, potentially causing them to dismiss or misinterpret security warnings. Only Chrome for iOS versions prior to 150.0.7871.47 are affected; the desktop channel is not impacted by this specific flaw. No public exploit code exists and exploitation probability is very low (EPSS 0.21%, 11th percentile), though the network-accessible, zero-authentication attack surface keeps it relevant where phishing-style delivery is feasible.
Insufficient policy enforcement in the Spellcheck component of Google Chrome prior to 150.0.7871.47 exposes process memory to attackers who have already achieved renderer process compromise. The vulnerability enables a second-stage information disclosure step in a chained attack: after compromising the renderer, the attacker serves a crafted HTML page that exploits the Spellcheck policy gap to read potentially sensitive data from memory. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Google has released a fix in the stable channel update.
Cross-origin data leakage in the WebXR implementation of Google Chrome on Android (versions prior to 150.0.7871.47) allows remote unauthenticated attackers to exfiltrate sensitive cross-origin information by enticing a victim to visit a crafted HTML page. The flaw is rooted in CWE-693 (Protection Mechanism Failure), where WebXR fails to enforce cross-origin isolation policies on Android specifically. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; the vulnerability is not listed in the CISA KEV catalog.
Navigation restriction bypass in Google Chrome's Omnibox on iOS (prior to 150.0.7871.47) enables a remote attacker to circumvent address bar security controls through insufficient input validation, contingent on user interaction with specific UI gestures during exposure to malicious network traffic. The integrity impact is rated High (I:H) with no confidentiality or availability impact, consistent with a content/navigation spoofing class of vulnerability. No public exploit code or CISA KEV listing has been identified; EPSS score of 0.20% (10th percentile) indicates low observed exploitation probability at time of analysis.
UI spoofing in Google Chrome's iOSWeb component on iOS allows remote attackers to misrepresent interface elements to users running versions prior to 150.0.7871.47. The vulnerability, rooted in an inappropriate implementation (CWE-451), is triggered when a user performs specific UI gestures on a crafted HTML page, enabling spoofing of security-critical browser interface elements such as the address bar or permission dialogs. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis; the high attack complexity and mandatory user interaction meaningfully constrain real-world risk.
Out-of-bounds read in Google Chrome's Codecs component (prior to 150.0.7871.47) enables remote attackers to leak sensitive data from renderer process memory by delivering a crafted HTML page. The CVSS C:H rating reflects meaningful exposure of in-process data such as session tokens or credentials, though Chromium's own team assessed this as Medium severity, and the sandbox boundary (S:U) limits blast radius to the renderer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition exploitation in Google Chrome for iOS (prior to 150.0.7871.47) exposes potentially sensitive data from process memory to a local attacker with physical device access. The flaw is rooted in improper synchronization (CWE-362) and requires high attack complexity to successfully win the timing window. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor has released a patching fix in the 150.0.7871.47 stable channel update.
Navigation restriction bypass in Google Chrome's Safe Browsing implementation on iOS allows a remote, unauthenticated attacker to circumvent phishing and malicious-site protections via a specially crafted HTML page, affecting all Chrome for iOS versions prior to 150.0.7871.47. The flaw is classified as CWE-693 (Protection Mechanism Failure), meaning the Safe Browsing guard can be rendered ineffective rather than defeated through cryptographic or authentication means. No public exploit or CISA KEV listing has been identified, and the EPSS score of 0.23% (14th percentile) signals low current exploitation probability - but the zero-prerequisite network delivery and high integrity impact make this a meaningful risk for iOS users who have not updated.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to misrepresent browser interface elements - such as address bars or security indicators - by delivering a crafted HTML page to a victim on an iOS device. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw exploits an inappropriate implementation specific to Chrome's iOS code path, which differs from desktop Chrome due to WKWebView constraints imposed by Apple. No public exploit code exists, CISA SSVC rates exploitation as none, and EPSS sits at the 12th percentile, indicating minimal real-world threat at time of analysis.
Navigation restriction bypass in Google Chrome's Chromecast implementation (versions prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to circumvent navigation restrictions via a specially crafted HTML page. This is a post-compromise escalation primitive rather than a standalone entry point - the renderer must already be under attacker control, making this a link in an exploit chain rather than an initial access vector. No public exploit has been identified at time of analysis; EPSS at 0.23% (14th percentile) reflects very low observed exploitation probability, consistent with the chained-exploit requirement.
Navigation restriction bypass in Google Chrome's Glic feature (versions prior to 150.0.7871.47) enables remote attackers to circumvent policy enforcement controls by delivering a crafted HTML page that triggers insufficient validation logic. The flaw maps to CWE-602, meaning security enforcement intended to be authoritative is implemented client-side in a bypassable manner, resulting in high integrity impact with no confidentiality or availability consequence. No public exploit or active exploitation has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability.
UI spoofing via Chrome's Autofill component affects all desktop installations prior to version 150.0.7871.47, enabling a remote attacker to misrepresent interface elements through a crafted HTML page. Exploitation requires both navigating to an attacker-controlled page and performing specific UI gestures, reflected in CVSS AC:H and UI:R - passive browsing is insufficient. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.2 Medium score reflects limited integrity and availability impact with no confidentiality loss.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a network-positioned attacker to circumvent browser-enforced navigation policies via a crafted HTML page. The attacker must occupy a privileged network position (e.g., man-in-the-middle) and requires user interaction with the malicious page, per the CVSS UI:R and the description's explicit network-position prerequisite. With an EPSS of 0.15% at the 5th percentile, no public exploit code, and no CISA KEV listing, exploitation probability is low - this is a medium-severity issue with a meaningful but situational attack barrier.
Cross-origin data exfiltration in Google Chrome's WebUI component (versions prior to 150.0.7871.47) enables remote attackers to leak sensitive data across origin boundaries by delivering crafted malicious network traffic to an unpatched browser. The flaw arises from insufficient input validation (CWE-20) within the WebUI layer, undermining same-origin policy protections and exposing data from isolated origins to attacker-controlled contexts. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, EPSS sits at 0.20% (10th percentile), and no public POC has been identified; a vendor-released patch is available in Chrome 150.0.7871.47.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 exposes sensitive information from other origins when a remote attacker convinces a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from an inappropriate implementation in the iOS-specific Chrome browser layer, classified under CWE-451 (UI Misrepresentation), and enables confidentiality compromise without requiring attacker privileges. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (12th percentile) signals low near-term automated exploitation risk.
Out-of-bounds read in the Chromecast component of Google Chrome prior to 150.0.7871.47 enables a remote attacker, who has already achieved renderer process compromise, to exfiltrate potentially sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - it cannot be exploited in isolation and requires a prior renderer compromise as a prerequisite. Google has released a patch in Chrome 150.0.7871.47; no public exploit code or CISA KEV listing has been identified at time of analysis.
Side-channel information leakage in WebAuthentication within Google Chrome on iOS (versions prior to 150.0.7871.47) enables a remote attacker to infer cross-origin data by directing a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms network-exploitable impact with high confidentiality loss, constrained by mandatory user interaction and scoped exclusively to the iOS platform. No public exploit identified at time of analysis; EPSS at 0.25% (16th percentile) signals low near-term exploitation probability, and no CISA KEV listing is present.
Cross-origin data leakage in Google Chrome's NFC implementation on Android exposes sensitive information to attackers who have already compromised the renderer process. Chrome versions prior to 150.0.7871.47 on Android fail to properly validate origins when handling NFC interactions, allowing a renderer-level attacker to read data across origin boundaries via a crafted HTML page. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at the 11th percentile, indicating low observed exploitation probability despite the theoretical confidentiality impact.
Content Security Policy bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote attackers to circumvent enforcement mechanisms via a specially crafted HTML page, resulting in high-integrity impact with no confidentiality or availability consequence. Affected versions are all Chrome releases prior to 150.0.7871.47. User interaction is required - the victim must visit the attacker-controlled page - and no public exploit or CISA KEV listing has been identified at time of analysis. The low EPSS score of 0.22% (13th percentile) reinforces that active exploitation is not currently observed.
Same-origin policy bypass in Google Chrome's WebAppInstalls component allows remote attackers to compromise cross-origin integrity via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-346, Origin Validation Error) in the PWA installation subsystem, enabling an attacker to perform unauthorized cross-origin writes or manipulations when a user visits attacker-controlled content. No public exploit identified at time of analysis, and the EPSS score of 0.23% (14th percentile) indicates low near-term exploitation probability, though the ubiquitous deployment of Chrome elevates aggregate exposure.
Use-after-free in Google Chrome's Bluetooth subsystem (all versions prior to 150.0.7871.47) enables an unauthenticated attacker within Bluetooth radio range to leak sensitive data from Chrome's process memory by operating a malicious Bluetooth peripheral. The CVSS vector (AV:A/PR:N/UI:N/C:H) confirms no attacker-side authentication is required and impact is confidentiality-only, with no integrity or availability loss. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV; the Chromium security team rated this Medium severity, consistent with the bounded adjacency-only attack vector.
Process memory disclosure in Google Chrome's ANGLE graphics abstraction layer (versions prior to 150.0.7871.47) enables a renderer-compromised attacker to read potentially sensitive data from process memory via a crafted HTML page. This is a post-exploitation, second-stage vulnerability: it cannot be triggered without a prior renderer process compromise, functioning as a chaining component rather than a standalone entry point. No public exploit code or CISA KEV listing has been identified at time of analysis; Chromium's own team rates it Medium severity, consistent with the prerequisite attack complexity.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 is achievable by an attacker holding a privileged network position who can manipulate traffic between the victim's browser and a server. The flaw originates in Chrome's Network component (CWE-693: Protection Mechanism Failure), where an inappropriate implementation allows CSP enforcement to be circumvented via crafted network traffic, yielding a High Integrity impact. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries an EPSS score of 0.15% (4th percentile) - but the attack vector is unauthenticated and the integrity impact is significant for high-value targets on adversarial networks.
Memory disclosure in Google Chrome's GPU component on Windows enables a remote attacker - who has already established renderer process compromise - to extract sensitive data from process memory via a crafted HTML page. Affected versions are all Chrome for Windows releases prior to 150.0.7871.47. This is a second-stage exploit component: it does not independently achieve remote code execution but can be chained with a renderer exploit to leak process memory contents, potentially exposing credentials, tokens, or other in-memory sensitive data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition in the DataTransfer API in Google Chrome prior to 150.0.7871.47 allows a remote attacker to read potentially sensitive data from renderer process memory by luring a user to a specially crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the impact is limited to confidentiality - no integrity or availability loss - and that reliable exploitation requires winning a timing race (AC:H) combined with user interaction. No public exploit identified at time of analysis; Google has shipped a patch in the stable channel update dated June 2026.
Out-of-bounds read in Chrome's Layout engine prior to 150.0.7871.47 allows remote attackers to leak potentially sensitive data from the renderer process memory by serving a crafted HTML page. User interaction is required - the victim must visit the malicious page - limiting automated mass exploitation. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, placing real-world urgency below what the CVSS 6.5 score alone might suggest.
GuestView policy enforcement in Google Chrome prior to 150.0.7871.47 can be subverted by an attacker who has already achieved renderer process compromise, allowing site isolation to be bypassed via a crafted HTML page. The flaw (CWE-602: Client-Side Enforcement of Server-Side Security) enables manipulation of cross-origin content or policy in embedded browsing contexts that Chrome's site isolation architecture is designed to protect. No public exploit code has been identified and EPSS places exploitation probability at 0.22% (13th percentile), consistent with the elevated prerequisite of a prior renderer compromise required to trigger this vulnerability.
Site isolation bypass in Google Chrome on Android prior to 150.0.7871.47 enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to break cross-origin security boundaries using a crafted HTML page. The root cause is CWE-346 (Origin Validation Error) in Chrome's Android-specific network implementation, meaning the network layer fails to enforce origin checks when requests originate from a compromised renderer context. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.22% at the 13th percentile reflects the high chaining complexity required.
UI spoofing via Chrome's Geolocation implementation (versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to deceive users about the origin or context of geolocation permission requests through a crafted HTML page. Exploitation requires user interaction with the malicious page, limiting automated attack potential. With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified, real-world exploitation risk is low despite the broad deployment footprint of Chrome.
Site isolation bypass in Google Chrome for Android (prior to 150.0.7871.47) allows a remote attacker who has already achieved renderer process compromise to cross origin boundaries using a crafted HTML page, enabling high-integrity impact against other open sites. The root cause is CWE-20 (Improper Input Validation) within Chrome's Input subsystem on Android - an input handling implementation flaw that fails to enforce cross-origin separation once the renderer is under adversary control. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), placing this firmly in the category of a meaningful escalation primitive rather than a standalone mass-exploitation risk.
UI spoofing in Google Chrome Enterprise prior to version 150.0.7871.47 allows unauthenticated remote attackers to deceive users into believing they are interacting with legitimate browser UI by serving a crafted HTML page. The root cause is insufficient validation of untrusted HTML input within Chrome's Enterprise component (CWE-20), enabling an attacker to manipulate visual elements such as address bars, dialog prompts, or permission requests. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low current exploitation probability despite a network-accessible attack vector.
Insufficient Web Authentication (WebAuthn/Passkeys) policy enforcement in Google Chrome on iOS prior to 150.0.7871.47 enables cross-origin data leakage to an attacker controlling a privileged network position. The flaw stems from CWE-693 (Protection Mechanism Failure) in the browser's WebAuthn subsystem, which fails to enforce origin isolation correctly when processing crafted HTML pages. No public exploit code exists and CISA has not listed this in KEV, but the high confidentiality impact (C:H) and the specificity of Chrome-on-iOS as the attack surface make this a targeted patching priority for organizations with a managed iOS fleet.
UI spoofing in Google Chrome's Autofill component on Windows (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users into interacting with forged security UI elements by convincing them to perform specific on-page gestures against a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an adversary to obscure or fabricate Autofill security indicators, potentially tricking users into submitting saved credentials or personal data to attacker-controlled destinations. No public exploit or CISA KEV listing has been confirmed; Google has released a fix in stable channel version 150.0.7871.47.
Out-of-bounds read in Chrome's bundled FFmpeg video decoding component (all versions prior to 150.0.7871.47) allows a remote attacker to leak renderer process memory contents via a crafted video file. The CVSS vector confirms network reachability with no required privileges (PR:N) but mandates user interaction (UI:R), meaning the victim must process the malicious video. SSVC assessment rates exploitation as none and the attack non-automatable, and no public exploit has been identified at time of analysis; Google has released a patched build at 150.0.7871.47.
UI spoofing via crafted HTML in Google Chrome's Geometry component (versions prior to 150.0.7871.47) enables remote attackers to misrepresent security-critical interface elements to users who are socially engineered into performing specific UI gestures. The flaw stems from an inappropriate implementation in Chrome's Geometry subsystem (CWE-451), affecting the integrity and availability of the browser interface at low impact levels. No public exploit or active exploitation has been identified; Google has released a confirmed patch in version 150.0.7871.47.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to exfiltrate sensitive information from other origins by luring victims to a crafted HTML page that exploits insufficient input validation. The vulnerability carries a CVSS 6.5 with high confidentiality impact (AV:N/PR:N/C:H) but requires user interaction and is iOS-platform-specific, constraining the realistic attack surface. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.22% at the 12th percentile and SSVC rates exploitation as none.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote unauthenticated attackers to display a falsified URL in the browser address bar by delivering a crafted HTML page to an iOS user. The flaw is classified CWE-451 (UI misrepresentation of critical information) and is iOS-platform-specific, with no impact on Chrome for Android, Windows, macOS, or Linux. No active exploitation is confirmed - the vulnerability is not listed in CISA KEV and EPSS sits at 0.22% (12th percentile) - but the spoofing primitive is a classic enabler of targeted phishing campaigns against mobile users.
Cross-origin data leakage in Google Chrome's Canvas component prior to version 150.0.7871.47 exposes sensitive cross-origin content to remote attackers via a crafted HTML page. The flaw bypasses Same-Origin Policy protections enforced at the Canvas API layer, enabling pixel-level or structured data extraction from cross-origin resources rendered in a canvas context. With CVSS 6.5, EPSS at 0.21% (11th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world exploitation is low-probability but credible given the zero-privilege, network-accessible attack path requiring only a single user visit.
Same-origin policy bypass in Google Chrome's CSS engine allows a remote, unauthenticated attacker to undermine web isolation guarantees by serving a crafted HTML page to an unsuspecting user. All Chrome releases prior to 150.0.7871.47 are affected. No public exploit code or active exploitation has been confirmed; SSVC rates exploitation as 'none' and EPSS sits at the 13th percentile, placing real-world urgency below what the I:H CVSS score alone might suggest.
Same-origin policy bypass in Google Chrome's CSS implementation allows a remote, unauthenticated attacker to violate cross-origin integrity protections by luring a user to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. Google has released a patch; no active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.22% at the 13th percentile indicates low current exploitation probability.
UI spoofing in Google Chrome before 150.0.7871.47 allows remote unauthenticated attackers to visually deceive users by serving a crafted HTML page that exploits a flaw in Chrome's CSS implementation. The flaw (CWE-451: UI Misrepresentation of Critical Information) enables attacker-controlled content to obscure or mimic trusted browser UI elements such as the address bar or security indicators, creating a credible phishing surface. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) indicates minimal observed exploitation activity; however, Google's internal Chromium severity rating of 'High' reflects the significant phishing and credential-theft potential inherent in convincing browser UI spoofing.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. The flaw exploits an inappropriate handling of CSS that causes Chrome's renderer to break the same-origin policy, enabling script execution in the context of other origins. No public exploit or CISA KEV listing has been identified; EPSS probability is very low (0.21%, 12th percentile), suggesting limited active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics library on macOS allows a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. Affected are all Chrome versions on Mac prior to 150.0.7871.47. The flaw stems from uninitialized memory use within ANGLE, Chrome's graphics abstraction layer, enabling residual memory contents from other security origins to be read and potentially returned to an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis; EPSS is low at 0.23% (13th percentile), consistent with a high-CVSS flaw constrained by both user-interaction and platform requirements.
Memory disclosure in Google Chrome's Enterprise policy implementation exposes sensitive process memory contents to remote attackers who can direct victims to a crafted HTML page. All Chrome desktop releases prior to 150.0.7871.47 are affected. No public exploit code exists and CISA SSVC classifies exploitation status as none, but the high confidentiality impact and zero-privilege-required attack path make prompt patching advisable for enterprise-managed Chrome deployments.
Cross-origin data leakage via Chrome's Autofill implementation on Android allows a remote attacker with prior renderer process compromise to extract sensitive data across origin boundaries using a crafted HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) reflects low observed exploitation activity; however, the cross-origin data exposure (CWE-346) combined with Autofill access creates meaningful privacy risk for users on vulnerable Android builds. Google has released a patch in the stable channel update.
Same-origin policy bypass in Google Chrome's Extensions implementation on Android prior to 150.0.7871.47 enables integrity violations across web origins. An attacker who successfully social-engineers a victim into installing a crafted malicious Chrome extension can exploit an inappropriate implementation in the Extensions subsystem to circumvent SOP controls, potentially modifying cross-origin content or injecting unauthorized actions. No public exploit exists and CISA SSVC assessment confirms no active exploitation; however, the I:H integrity impact and network-accessible delivery path keep this a meaningful patch priority for Android Chrome deployments.
Cross-origin data disclosure in Google Chrome's Skia graphics library on macOS allows a remote attacker who has already achieved renderer process compromise to trigger an out-of-bounds read and leak memory contents from other web origins via a crafted HTML page. All Chrome versions on Mac prior to 150.0.7871.47 are affected. No public exploit code has been identified and this vulnerability is absent from CISA KEV; an EPSS of 0.21% at the 11th percentile confirms very low near-term exploitation probability, and SSVC classifies exploitation status as none - indicating this is a chaining primitive in multi-stage attack chains, not a standalone threat.
Navigation restriction bypass in Google Chrome's Passwords subsystem allows a remote attacker to circumvent intended access controls by delivering a crafted HTML page to a user. All Chrome desktop versions prior to 150.0.7871.47 are affected, with integrity rated High by CVSS due to the ability to manipulate navigation behavior. No public exploit exists at time of analysis and EPSS sits at 0.22% (13th percentile), indicating low near-term exploitation probability despite Chrome's enormous global footprint and Chromium's internal 'High' severity classification.
Cross-origin data leakage in Google Chrome for Android prior to 150.0.7871.47 enables remote attackers to read data from other origins via a crafted HTML page exploiting insufficient validation in the File Input component. The flaw is Android-platform-specific, requiring only that a victim user navigate to an attacker-controlled page. No active exploitation has been confirmed (CISA KEV negative, SSVC exploitation: none), and EPSS at 0.21% (11th percentile) reflects low current exploitation interest, though the unauthenticated, low-complexity attack vector keeps it a relevant patching priority for Android Chrome deployments.
Universal Cross-Site Scripting (UXSS) in Google Chrome for iOS prior to 150.0.7871.47 enables a remote attacker to inject arbitrary scripts or HTML across origins by exploiting insufficient input validation triggered through specific user UI gestures on a crafted page. The scope change (S:C in CVSS) is the critical dimension here - successful exploitation bypasses the same-origin policy, potentially granting the attacker script execution in the context of arbitrary origins within the browser session. No public exploit code has been identified and EPSS sits at just 0.20% (11th percentile), indicating low observed exploitation activity despite the high-impact class of vulnerability.
Memory disclosure in Google Chrome for Linux (prior to 150.0.7871.47) allows a remote attacker to read sensitive contents from the browser's process memory by directing a user to a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's input handling subsystem, and is platform-specific - only Linux builds are affected. No public exploit code or CISA KEV listing has been identified at the time of analysis, but the network-reachable, zero-authentication attack path and high confidentiality impact make patching a near-term priority for Linux desktop environments.
Cross-origin data leakage via side-channel in Google Chrome's Safe Browsing component on iOS affects all Chrome versions prior to 150.0.7871.47, exploitable only by an attacker who has already compromised the renderer process. The vulnerability (CWE-1300) allows confidentiality impact through a crafted HTML page that abuses Safe Browsing timing or state signals to exfiltrate data across origin boundaries. No public exploit code exists at time of analysis, SSVC records exploitation as none, and EPSS probability sits at 0.21% (11th percentile), reflecting the significant prerequisite of prior renderer compromise.
Sensitive process memory exposure in Google Chrome for iOS prior to 150.0.7871.47 enables a physically present attacker to read potentially sensitive data from the browser's memory without authentication. The root cause is insufficient data validation (CWE-20) within the iOS-specific Chrome implementation. No public exploit code or CISA KEV listing has been identified at time of analysis, and the physical access requirement (CVSS AV:P) significantly constrains real-world attacker opportunity.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) permits a remote, unauthenticated attacker to circumvent client-side policy controls by delivering a crafted HTML page to a victim user. The flaw originates from insufficient policy enforcement (CWE-602), where navigation security logic enforced within the browser client can be subverted through malicious web content. No active exploitation has been identified - CISA KEV is not listed, SSVC confirms Exploitation: none, and the EPSS score of 0.22% (13th percentile) reflects minimal real-world exploitation activity at time of analysis.
Cross-origin data leakage in Google Chrome's SVG rendering subsystem (versions prior to 150.0.7871.47) allows remote attackers to exfiltrate sensitive information from other origins by directing victims to a crafted HTML page. The root cause is insufficient policy enforcement in SVG handling, classified as CWE-346 (Origin Validation Error), effectively bypassing Same-Origin Policy protections. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite a CVSS confidentiality impact rated High.
Side-channel information leakage via Chrome's Scroll implementation exposes cross-origin data to remote attackers who can lure a victim to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected; exploitation requires user interaction (visiting the attacker-controlled page) but no authentication. No public exploit identified at time of analysis and EPSS sits at the 11th percentile, though the confidentiality impact is rated High by NVD given the potential to read data from foreign origins.
### Impact Shovel and Federation plugins perform URI obfuscation in their worker (link) state. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.
Cross-site request forgery in Plugin for Google Analytics by IO Technologies (WordPress) versions up to and including 1.1 allows unauthenticated remote attackers to overwrite the site's Google Analytics tracking ID by tricking a logged-in administrator into clicking a crafted link. The flaw stems from absent nonce validation on the ga.php settings handler, meaning forged POST requests bypass WordPress's standard CSRF protections entirely. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis, and the CVSS score of 4.3 reflects the required administrator interaction and limited integrity-only impact.
Google OAuth login in Documenso through version 2.11.0 fails to enforce two-factor authentication during the OAuth callback flow, allowing a remote attacker to authenticate as any Google-linked user without completing MFA verification. The flaw resides in handle-oauth-callback-url.ts, where the oauth2fa state is not properly routed through the dedicated OAuth 2FA verification path - as confirmed by the PR diff showing the signin form was not checking the oauth2fa=true callback parameter. Publicly available exploit code exists (GitHub issue #2758), though no active exploitation has been confirmed and the CVSS 4.0 AC:H rating indicates the attack requires precise manipulation of the OAuth callback flow.