Monthly
Cross-origin data leakage in Google Chrome's MHTML implementation prior to version 149.0.7827.53 exposes sensitive user data to remote attackers via crafted HTML pages. The flaw stems from improper origin validation (CWE-346) in MHTML handling, allowing an attacker-controlled page to read data across origin boundaries - a significant breach of the browser's same-origin policy. Exploitation requires convincing a victim to perform specific UI gestures, and no public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.03% (11th percentile).
Cross-origin data leakage in Google Chrome's Network implementation prior to version 149.0.7827.53 allows a remote unauthenticated attacker to read sensitive cross-origin data by luring a victim to a crafted HTML page. Rooted in CWE-346 (Origin Validation Error), the flaw permits the Network component to expose data across origin boundaries that same-origin policy should protect. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS of 0.03% (11th percentile) places real-world exploitation probability as very low at time of analysis.
Insufficient policy enforcement in Google Chrome's Password Manager component (versions prior to 149.0.7827.53) allows a remote, unauthenticated attacker to bypass discretionary access control by delivering a crafted HTML page to a victim. Per the CVSS vector (C:N/I:N/A:H), the confirmed impact is high availability disruption - notably not credential exfiltration - suggesting the bypass degrades or denies Password Manager functionality rather than exposing stored credentials. No public exploit exists and EPSS sits at 0.02% (4th percentile), indicating no widespread exploitation pressure at time of analysis.
UI spoofing in Google Chrome's Password Manager component (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to manipulate the Password Manager's visual interface via crafted malicious network traffic, potentially deceiving users about credential prompts or password state. Exploitation requires user interaction (CVSS UI:R), limiting opportunistic mass exploitation. No public exploit code exists and no active exploitation is confirmed - EPSS sits at just 0.05% (15th percentile), consistent with a low-priority medium-severity browser component flaw. A vendor-released patch is available in Chrome 149.0.7827.53.
Discretionary access control bypass in Google Chrome's Extensions subsystem affects all versions prior to 149.0.7827.53, enabling integrity compromise without exposing confidential data. Exploitation requires convincing a target user to install a crafted malicious Chrome Extension, placing social engineering at the center of any attack path. No public exploit code exists and no active exploitation has been confirmed; EPSS sits at 0.01% (1st percentile), indicating very low observed exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome DevTools (all versions prior to 149.0.7827.53) enables circumvention of browser navigation controls through a crafted malicious Chrome Extension. Exploitation requires convincing a target user to install the malicious extension, placing this firmly in social-engineering territory rather than opportunistic mass exploitation. EPSS is extremely low at 0.02% (4th percentile), no public exploit code has been identified, and there is no CISA KEV listing, making this a moderate-priority integrity-only issue despite the CVSS 6.5 score.
Navigation restriction bypass in Google Chrome's Glic component (versions prior to 149.0.7827.53) enables remote attackers to circumvent browser navigation controls by delivering a crafted HTML page that the victim must open. The vulnerability is rooted in an inappropriate implementation (CWE-284, Improper Access Control) within the Glic subsystem and yields limited but multi-dimensional impact across confidentiality, integrity, and availability (C:L/I:L/A:L). No public exploit identified at time of analysis and this CVE does not appear in CISA KEV; Google has assigned a 'Medium' severity rating consistent with the CVSS 6.3 score.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 149.0.7827.53 allows remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page, requiring only user interaction. The Scope:Changed CVSS component (S:C) confirms this bypasses Chrome's Same-Origin Policy, enabling access to content from other origins in the victim's browser session. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, UXSS classes in major browsers are historically targeted by threat actors for session hijacking and credential theft.
Navigation restriction bypass in Google Chrome prior to 149.0.7827.53 allows a remote, unauthenticated attacker to circumvent policy enforcement in the browser's Actor component by delivering a crafted HTML page to a target user. The flaw (CWE-602) enables unauthorized navigation actions that could expose users to cross-origin manipulation or redirects with low but non-trivial confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and EPSS of 0.02% combined with SSVC exploitation status of none indicates limited active threat, though the broad attack surface of any Chrome desktop user visiting a malicious page warrants timely patching.
Out-of-bounds read in Chrome's GWP-ASan memory safety subsystem (versions prior to 149.0.7827.53) enables a local attacker to disclose potentially sensitive contents from process memory by delivering a malicious file to the target. The vulnerability carries a CVSS 6.5 Medium score with high confidentiality impact but no integrity or availability impact, consistent with a pure information-disclosure class. No public exploit code has been identified at time of analysis, EPSS exploitation probability is extremely low at 0.01% (1st percentile), and SSVC assessment confirms no known active exploitation, collectively indicating a low near-term threat priority despite the notable confidentiality impact rating.
Cross-origin data leakage in Google Chrome's SVG implementation affects all desktop versions prior to 149.0.7827.53, enabling remote attackers to exfiltrate sensitive data from other origins via a crafted HTML page. The flaw exploits Chrome's SVG rendering pipeline to violate the Same-Origin Policy, exposing confidential data such as authenticated session content or cross-site resources. No public exploit identified at time of analysis, and EPSS probability is very low (0.03%, 11th percentile), though the zero-privilege-required, low-complexity attack path warrants prompt patching for any internet-facing user population.
Same-origin policy bypass in Google Chrome's Media Session component (prior to 149.0.7827.53) enables remote attackers to violate cross-origin isolation via a crafted HTML page. The vulnerability stems from an inappropriate implementation (CWE-346: Origin Validation Error) in the Media Session API, which fails to properly enforce origin boundaries. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; EPSS sits at 0.02% (4th percentile), consistent with low observed exploitation activity.
Cross-origin data leakage via Google Chrome's SVG implementation (all versions prior to 149.0.7827.53) enables remote unauthenticated attackers to exfiltrate sensitive information from foreign origins by luring a victim to a crafted HTML page. The flaw reflects an inappropriate SVG rendering implementation that fails to enforce cross-origin isolation boundaries, producing a high confidentiality impact with no integrity or availability consequences. EPSS is very low at 0.03% (11th percentile), no public exploit code has been identified, and no CISA KEV listing exists at time of analysis, suggesting limited observed exploitation despite the medium-severity CVSS score.
Cross-origin data leakage in Google Chrome's WebView component on Android allows an unauthenticated remote attacker to read data from origins outside the attacker's own domain by enticing a user to visit a crafted HTML page. Affected are all Android Chrome versions prior to 149.0.7827.53. No public exploit exists and SSVC classifies exploitation as none, but the network-accessible, low-complexity attack vector warrants patching for Android-heavy enterprise environments handling sensitive cross-origin content.
Cross-origin data leakage in Google Chrome's Media subsystem (all versions prior to 149.0.7827.53) enables a remote attacker to read sensitive data from other web origins by inducing a user to visit a specially crafted HTML page. The flaw stems from an inappropriate implementation in Media that fails to correctly enforce origin boundaries (CWE-346), resulting in high confidentiality impact per CVSS (C:H) with no integrity or availability consequence. No active exploitation is confirmed - CISA KEV is absent and EPSS sits at 0.03% (11th percentile) - but the confidentiality vector is significant for users accessing sensitive cross-origin content concurrently.
Site Isolation bypass in Google Chrome prior to 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to escape cross-origin protections via a crafted HTML page, exposing high-confidentiality data from other origins loaded in the browser. This is a chained, second-stage exploit component: it does not function standalone but amplifies the impact of a separate renderer compromise by breaking Chrome's primary cross-site data isolation boundary. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects low current exploitation probability despite the high confidentiality impact rating.
Information disclosure in Google Chrome's Extensions subsystem prior to version 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page. This is a second-stage vulnerability requiring a pre-existing renderer compromise as a hard prerequisite, making it a chained attack component rather than a standalone exploit. No public exploit code exists and CISA has not added this to the KEV catalog; the EPSS score of 0.03% and SSVC exploitation-status of 'none' are mutually consistent with no observed active exploitation.
Universal Cross-Site Scripting (UXSS) in Google Chrome's SVG implementation prior to version 149.0.7827.53 allows remote unauthenticated attackers to bypass same-origin policy by injecting arbitrary scripts or HTML across origins via a crafted HTML page. Exploitation requires user interaction and high attack complexity (CVSS AC:H/UI:R), and EPSS at 0.06% (18th percentile) reflects limited real-world exploitation activity. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's CSS implementation exposes sensitive information from other origins when a user visits a crafted HTML page. Affected are all Chrome versions prior to 149.0.7827.53 on desktop platforms. An unauthenticated remote attacker can exploit this to read data from cross-origin contexts, violating the browser's Same-Origin Policy via a CSS-based side channel or direct information disclosure path. No public exploit identified at time of analysis, and EPSS at 0.03% (11th percentile) signals low current exploitation activity.
Cross-origin data leakage in Google Chrome's DataTransfer API allows unauthenticated remote attackers to read data across origins by directing a victim to a crafted HTML page, affecting all Chrome desktop versions prior to 149.0.7827.53. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:L) confirms network accessibility without attacker authentication, but requires user interaction and yields only limited confidentiality impact with no integrity or availability consequences. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.03% (11th percentile) consistently signals low current exploitation probability.
Out-of-bounds read in the Input component of Google Chrome on Linux (all versions prior to 149.0.7827.53) exposes potentially sensitive process memory to remote attackers. Exploitation requires delivering a crafted HTML page and inducing a Linux user to visit it (CVSS UI:R), after which the browser's Input handler reads beyond allocated buffer bounds, leaking in-memory data. No public exploit has been identified at time of analysis, EPSS sits at 0.03% (11th percentile) indicating low current exploitation probability, and there is no CISA KEV listing - though the High confidentiality impact (C:H) warrants timely patching given Chrome's broad deployment on Linux.
Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 149.0.7827.53, exploitable via a crafted HTML page requiring only a single user visit. The root cause (CWE-457: use of uninitialized memory) in Chrome's Skia rendering backend allows residual memory contents to be exposed across origin boundaries, violating the browser's same-origin policy. No public exploit identified at time of analysis; EPSS at 0.03% (11th percentile) and absence from CISA KEV indicate low real-world exploitation probability at this time.
Script injection via Chrome's Accessibility component allows a remote attacker who convinces a victim to install a malicious extension to perform Universal Cross-Site Scripting (UXSS), injecting arbitrary scripts or HTML into web page contexts the user visits. Affected are all Chrome desktop versions prior to 149.0.7827.53. EPSS is 0.01% (2nd percentile) and this vulnerability is not in CISA KEV, indicating very low real-world exploitation probability at time of analysis; however, the social-engineering prerequisite (malicious extension installation) remains a credible threat vector in targeted campaigns.
Cross-origin data leakage in Google Chrome prior to 149.0.7827.53 allows a remote unauthenticated attacker to read sensitive cross-origin data by luring a user to a crafted HTML page that exploits an inappropriate CSS implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-exploitable, no-privilege-required exploitation with a single user interaction as the only barrier. No public exploit has been identified and EPSS sits at 0.03% (11th percentile), indicating low current exploitation interest despite the low attack complexity.
Cross-origin data leakage in Google Chrome prior to 149.0.7827.53 allows remote unauthenticated attackers to read sensitive cross-origin information by directing a victim to a crafted HTML page that exploits an inappropriate CSS implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no privilege requirement, limited only by the need for user interaction. EPSS is 0.03% (11th percentile) and no public exploit has been identified at time of analysis; however, Google has issued a confirmed patch in the stable channel release, and the CWE-352/CSRF tag alongside the data-leakage description suggests a novel or hybrid attack class that security teams should monitor for further clarification.
Universal Cross-Site Scripting (UXSS) in Google Chrome's XML processing component allows remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. All Chrome versions prior to 149.0.7827.53 are affected, with the Scope:Changed (S:C) CVSS vector confirming this vulnerability can bypass the Same-Origin Policy - the defining characteristic of UXSS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.06% (18th percentile) reflects low observed exploitation probability, though UXSS primitives are historically attractive to threat actors targeting session data and credential theft at scale.
Cross-origin data leakage via an inappropriate CSRF-class implementation in Google Chrome's Payments component on Android prior to 149.0.7827.53 allows network-delivered exploitation when a victim visits a crafted HTML page. The confidentiality impact is rated High by CVSS (C:H), as sensitive payment-related data from one origin can be exposed to an attacker-controlled page. No public exploit has been identified at time of analysis and the EPSS score of 0.01% (1st percentile) indicates a low probability of in-the-wild exploitation, making this a medium-priority patch rather than an emergency response item.
Cross-origin data leakage in Google Chrome for Android (versions prior to 149.0.7827.53) is enabled by a race condition in the Geolocation subsystem, exploitable by a remote unauthenticated attacker who tricks a victim into visiting a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no required privileges, though user interaction is mandatory. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.03% (10th percentile), indicating very low real-world exploitation probability despite the High confidentiality impact rating.
Out-of-bounds heap read in Google Chrome's Extensions component on Linux exposes sensitive process memory to a malicious extension author. Affected versions are Chrome on Linux prior to 149.0.7827.53; Windows and macOS are not listed as affected. Exploitation requires convincing a target user to install a crafted malicious extension, limiting exposure compared to the CVSS 6.5 score implies - no public exploit identified at time of analysis, and EPSS of 0.01% (1st percentile) reflects low current exploitation probability.
Same-origin policy bypass in Google Chrome's Paint component prior to version 149.0.7827.53 allows a remote, unauthenticated attacker to violate cross-origin integrity protections by inducing a user to visit a crafted HTML page. The flaw stems from insufficient policy enforcement in the Paint subsystem (CWE-639), enabling an attacker to write or manipulate content across origin boundaries, resulting in high integrity impact with no confidentiality or availability loss per the CVSS vector. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) indicates very low current exploitation probability.
Uninitialized memory use in Google Chrome's Audio subsystem (versions prior to 149.0.7827.53) enables an attacker who has already compromised the renderer process to read potentially sensitive data from process memory via a crafted HTML page. This is a chained-exploit component - it does not grant initial access but can assist post-renderer-compromise data leakage or ASLR bypass. No KEV listing and an EPSS of 0.03% (11th percentile) indicate no observed widespread exploitation; no public exploit has been identified at time of analysis.
Out-of-bounds read in the Chromecast component of Google Chrome prior to version 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to leak potentially sensitive data from process memory by delivering a crafted HTML page. This is a chained vulnerability: exploitation is conditional on a prior renderer compromise, making it a second-stage information-disclosure step rather than a standalone attack. No public exploit code has been identified and EPSS probability stands at 0.05% (15th percentile), consistent with a medium-severity, constrained attack path. Google has released a fix in stable channel 149.0.7827.53.
Cross-origin data leakage in Google Chrome's Paint component (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read sensitive cross-origin data by tricking a user into visiting a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's rendering Paint subsystem that fails to properly enforce cross-origin isolation boundaries. EPSS is low at 0.03% and no active exploitation is confirmed in CISA KEV, but the high confidentiality impact (C:H) combined with low attack complexity and no required privileges makes this a meaningful data-exfiltration risk for browser users visiting untrusted web content.
Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 149.0.7827.53) allows an unauthenticated remote attacker to read sensitive data belonging to other web origins by enticing a user to visit a specially crafted HTML page. The root cause is an uninitialized variable use (CWE-457) within ANGLE - Chrome's OpenGL ES translation layer - which can expose heap or stack memory contents across origin boundaries. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.03% (11th percentile) indicates low observed exploitation probability at time of analysis.
Uninitialized memory exposure in Google Chrome's ANGLE graphics library prior to version 149.0.7827.53 enables remote unauthenticated attackers to read potentially sensitive data from browser process memory by luring a victim to a crafted HTML page. The CVSS vector (PR:N/UI:R/C:H) confirms no attacker privileges are required but victim interaction is mandatory - the attack is entirely browser-side and exploits how ANGLE handles graphics state without zeroing memory first. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating low observed exploitation interest despite the High confidentiality impact rating.
Insufficient policy enforcement in Google Chrome's Autofill subsystem (versions prior to 149.0.7827.53) enables remote unauthenticated attackers to bypass discretionary access control, resulting in high-integrity impact when a victim visits a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/I:H) confirms the attack is network-delivered, low-complexity, and requires no privileges, though user interaction is a prerequisite. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects low observed exploitation pressure.
Cross-origin data leakage in Google Chrome's Media component (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive data from cross-origin resources by luring victims to a crafted HTML page. The flaw is rooted in an inappropriate implementation in Chrome's Media subsystem, tagged with CSRF characteristics, allowing an attacker-controlled page to read content from origins the victim is authenticated to. EPSS is low at 0.03% and no public exploit or CISA KEV listing has been identified at time of analysis.
Insufficient same-origin policy enforcement in Google Chrome's Paint rendering component (prior to 149.0.7827.53) allows unauthenticated remote attackers to bypass SOP boundaries via a crafted HTML page, resulting in high integrity impact against the victim's browser context. The attack requires user interaction (visiting a malicious page) but no authentication or elevated privileges. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; EPSS is extremely low at 0.02% (4th percentile), indicating limited observed exploitation activity in the wild.
Same-origin policy bypass in Google Chrome's Paint component (all versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin integrity protections by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/I:H) confirms network-based, low-complexity exploitation with no privilege requirement, though victim interaction - visiting the attacker's page - is mandatory. No public exploit has been identified at time of analysis, and an EPSS score of 0.02% (4th percentile) indicates minimal observed exploitation activity; this is not listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Extensions subsystem (versions prior to 149.0.7827.53) enables a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. The flaw is classified under CWE-352 (Cross-Site Request Forgery), indicating the Extensions implementation incorrectly handles cross-origin request validation in a way that bypasses same-origin isolation boundaries. No public exploit has been identified at time of analysis, and an EPSS score of 0.03% (11th percentile) signals low current exploitation probability despite the High confidentiality impact rating.
Cross-origin data leakage in Google Chrome's Web Share API prior to version 149.0.7827.53 allows a remote attacker to extract sensitive cross-origin information by convincing a user to perform specific UI gestures on a crafted HTML page, violating browser same-origin policy guarantees. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) reflects high confidentiality impact with no authentication required on the attacker's side, though mandatory user interaction reduces realistic exploitation probability significantly. No public exploit has been identified at time of analysis, and an EPSS score of 0.04% (13th percentile) corroborates low current exploitation activity.
Domain spoofing via crafted WebAPK in Google Chrome on Android prior to 149.0.7827.53 enables remote unauthenticated attackers to deceive users about the web origin of installed Progressive Web Apps, with high integrity impact as confirmed by the CVSS I:H rating. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-accessible and requires no privileges, though user interaction is a necessary precondition. No public exploits have been identified and EPSS sits at 0.03% (10th percentile), indicating minimal observed exploitation pressure; however, the trust-abuse potential for phishing campaigns makes timely patching advisable.
Cross-origin data leakage in Google Chrome DevTools affects all versions prior to 149.0.7827.53, exploitable through a crafted malicious Chrome Extension. The inappropriate DevTools implementation allows an attacker who successfully social-engineers a victim into installing the extension to read data from cross-origin contexts - violating the browser's same-origin isolation guarantees at the DevTools layer. No public exploit code exists and no CISA KEV listing is present; EPSS at 0.02% (4th percentile) confirms low exploitation probability in the wild, making this a routine patch-cycle priority rather than an emergency response item.
Uninitialized memory read in Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows remote attackers to obtain sensitive process memory contents through a crafted HTML page, with no authentication required but mandatory user interaction. The vulnerability carries a CVSS Confidentiality impact of High (C:H), indicating potentially significant data exposure despite the Medium overall score of 6.5. EPSS is low at 0.03% (11th percentile) and no CISA KEV listing exists, meaning no public exploit or confirmed widespread exploitation has been identified at time of analysis.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Keyboard implementation prior to version 149.0.7827.53 enables remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. The Scope:Changed CVSS vector reflects the fundamental nature of this class: successful exploitation bypasses the Same-Origin Policy, potentially granting script access to sessions, cookies, and DOM content across all origins open in the browser. No public exploit has been identified at time of analysis, and the EPSS score of 0.06% (18th percentile) indicates low current exploitation probability, though UXSS primitives are historically high-value for targeted attacks.
Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 149.0.7827.53, exploitable by a remote attacker who has already compromised the renderer process. Via a crafted HTML page, the attacker can abuse insufficient input validation in Skia to extract sensitive cross-origin data, bypassing browser isolation boundaries. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (15th percentile) reflects low observed exploitation activity.
Cross-origin data leakage in Google Chrome's ANGLE graphics subsystem (prior to 149.0.7827.53) allows a remote unauthenticated attacker to read sensitive data from other web origins by enticing a user to visit a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) within ANGLE, Chrome's graphics translation layer, which may expose stale memory contents - potentially including data from other browser contexts or origins. No public exploit code or CISA KEV listing has been identified; EPSS probability of 0.03% (11th percentile) indicates low real-world exploitation pressure at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics library affects all versions prior to 149.0.7827.53, allowing unauthenticated remote attackers to read sensitive cross-origin browser data by enticing a user to visit a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within ANGLE, Chrome's graphics abstraction layer, where residual memory contents from other origins can be exposed through the GPU pipeline. No public exploit identified at time of analysis, and the EPSS score of 0.03% (11th percentile) indicates low current exploitation probability; however, Chrome's broad install base makes any confirmed cross-origin data disclosure notable from a privacy and session-data standpoint.
UI spoofing in Google Chrome's Downloads component prior to version 149.0.7827.53 enables remote attackers to misrepresent download-related interface elements by serving a crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in the Downloads subsystem, allowing an attacker to manipulate what the user sees during a download interaction - potentially masking file names, types, or origin - without any authentication. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating no public exploit identified at time of analysis; however, the no-authentication, low-complexity delivery path warrants prompt patching.
Cross-origin data leakage in Google Chrome's Media component (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive information from cross-origin pages by luring a victim to a crafted HTML page. The CVSS vector confirms unauthenticated network access with high confidentiality impact (C:H), though user interaction is required (UI:R). No public exploit identified at time of analysis, and EPSS at 0.03% (11th percentile) indicates low near-term mass exploitation probability, aligning with the Chromium team's 'Medium' severity rating.
Cross-origin data leakage in Google Chrome's WebUI component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to extract sensitive cross-origin information via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the WebUI layer, which fails to properly sanitize input arriving from a compromised renderer, breaking Chrome's intended process isolation boundary. No active exploitation has been confirmed (not in CISA KEV), and an EPSS score of 0.04% (13th percentile) reflects low widespread exploitation probability, consistent with this being a second-stage technique requiring a chained renderer compromise.
Uninitialized memory exposure in the ANGLE graphics layer of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page. The vulnerability is limited to confidentiality impact - no code execution or integrity compromise is possible through this vector alone. With an EPSS score of 0.03% (11th percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is currently low despite the High confidentiality CVSS sub-score.
Uninitialized memory use in the Dawn WebGPU engine of Google Chrome on Windows (all versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to leak cross-origin data from a victim's browser session. Exploitation requires the victim to visit a crafted HTML page, breaking same-origin isolation by surfacing residual memory contents from other browsing contexts. No public exploit has been identified and EPSS sits at 0.03% (11th percentile), indicating low current exploitation probability; however, the High confidentiality CVSS impact warrants prompt patching in environments handling sensitive cross-origin data.
Cross-origin data leakage in Google Chrome's GPU component (prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin information by delivering a specially crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns a score of 6.5 Medium, reflecting high confidentiality impact tempered by required user interaction and the critical prerequisite of a pre-compromised renderer. No public exploit has been identified at time of analysis, and EPSS registers at 0.05% (15th percentile), consistent with a multi-stage exploitation barrier.
Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive cross-origin data by directing victims to a specially crafted HTML page. The flaw resides in an inappropriate implementation within WebView (CWE-474), effectively undermining same-origin policy protections that normally isolate web content across origins - an attacker can read data they should not have access to. No public exploit has been identified at time of analysis, and an EPSS score of 0.03% (10th percentile) signals very low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the WebRTC component of Google Chrome prior to 149.0.7827.53 exposes potentially sensitive process memory contents to remote attackers. Exploitation requires no authentication (CVSS PR:N) but does require user interaction - a victim must visit a specially crafted HTML page (CVSS UI:R). The confidentiality impact is rated High (C:H) with no integrity or availability consequence, meaning a successful attack leaks memory contents rather than enabling code execution. No public exploit identified at time of analysis, and EPSS at 0.03% (10th percentile) reflects low observed exploitation probability.
Cross-origin data leakage in Google Chrome's Printing subsystem (all versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data by serving a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects high confidentiality impact with no integrity or availability loss, though the real-world attack requires a pre-compromised renderer - making this a second-stage chaining vulnerability rather than a standalone initial-access vector. No public exploit code or CISA KEV listing has been identified, and EPSS at 0.05% (15th percentile) confirms low current exploitation probability.
Cross-origin data leakage in Google Chrome's ANGLE graphics library (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read memory across origin boundaries by luring a victim to a crafted HTML page. The root cause is an uninitialized variable (CWE-457) within ANGLE - Chromium's graphics translation layer - which may retain residual data from prior allocations, exposing sensitive cross-origin content. No public exploit code exists and no active exploitation is confirmed (CISA KEV absent); EPSS is 0.03% (11th percentile), indicating low current real-world exploitation pressure.
Uninitialized memory read in Google Chrome's Media component exposes sensitive process memory contents to attackers who have already compromised the renderer process. Specifically, Chrome versions prior to 149.0.7827.53 fail to initialize memory in the Media subsystem, enabling a secondary attacker-controlled read of arbitrary process memory via a crafted HTML page. EPSS stands at 0.03% (11th percentile), no public exploit has been identified, and this vulnerability is not listed in the CISA KEV catalog; the vendor-released patch is available in Chrome 149.0.7827.53.
Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to read sensitive data from other origins via a crafted HTML page. The root cause is CWE-457 (Use of Uninitialized Variable) in ANGLE - residual memory contents in the graphics pipeline can be read before proper initialization, exposing data across origin boundaries. EPSS is very low at 0.03% (11th percentile) and no public exploit or CISA KEV listing has been identified, but the cross-origin data access impact makes this relevant in chained exploit scenarios.
Cross-origin data leakage in Google Chrome's Password Manager component (prior to 149.0.7827.53) exposes sensitive credential or form data to remote attackers through a crafted HTML page. The flaw stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning the Password Manager fails to properly enforce same-origin boundaries when handling data. No privileges are required and exploitation is conditional only on user interaction with a malicious page; CVSS confidentiality impact is rated High, though no public exploit code exists and EPSS is at 0.03%, indicating low observed exploitation pressure at time of analysis.
Cross-origin data leakage via Chrome's Password Manager component affects Google Chrome versions prior to 149.0.7827.53, exploitable when a user visits an attacker-crafted HTML page. The flaw stems from an inappropriate implementation that fails to enforce proper origin boundaries within the Password Manager, allowing a remote, unauthenticated attacker to read sensitive cross-origin data - potentially including credential-related information surfaced by the Password Manager. No public exploit code has been identified and no active exploitation is confirmed (not in CISA KEV), with EPSS at 0.03% (11th percentile), though the high confidentiality impact (C:H) warrants prompt patching given Chrome's massive deployment surface.
Same-Origin Policy bypass in Google Chrome's Canvas implementation affects all versions prior to 149.0.7827.53, allowing a remote unauthenticated attacker to violate cross-origin integrity guarantees through a crafted HTML page. The vulnerability carries a High integrity impact (I:H) with no confidentiality or availability consequence, meaning an attacker can write or manipulate cross-origin data rather than read it. No public exploit code has been identified at time of analysis, and EPSS at 0.02% (4th percentile) suggests minimal observed exploitation pressure currently.
Same-origin policy bypass in Google Chrome's FileSystem API implementation affects all desktop versions prior to 149.0.7827.53, exploitable by a remote attacker who has already achieved renderer process compromise. Delivering a crafted HTML page to a victim who interacts with it triggers the flaw, resulting in high-integrity cross-origin impact with no confidentiality or availability consequence. No public exploit code exists and EPSS sits at 0.02% (6th percentile), but the integrity impact and its role as a renderer-escape pivot make it relevant to multi-stage exploitation chains.
Out-of-bounds read in Chrome's V8 JavaScript engine (versions prior to 149.0.7827.53) exposes sensitive process memory to remote attackers who can lure a victim to a crafted HTML page. The CVSS vector (PR:N/UI:R/C:H) confirms unauthenticated remote triggering with high confidentiality impact, though exploitation requires one click of user interaction. No public exploit identified at time of analysis, and EPSS sits at the 11th percentile (0.03%), suggesting low observed exploitation pressure despite the medium-severity classification.
Use-after-free in Google Chrome's WebGL component (prior to 149.0.7827.53) exposes process memory to remote attackers who can lure a user to a crafted HTML page. The vulnerability is limited to confidentiality - CVSS C:H/I:N/A:N - meaning an attacker can read potentially sensitive data from Chrome's process memory but cannot write or crash the process per the scored vector. No public exploit has been identified at time of analysis, and EPSS sits at 0.03% (10th percentile), indicating low observed exploitation pressure. Google has shipped a fix in the stable channel release 149.0.7827.53.
Same-origin policy bypass in the Cast component of Google Chrome (prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin integrity protections via a crafted HTML page, requiring only that the target user visit the attacker-controlled page. The CVSS vector confirms high integrity impact with no confidentiality or availability consequence, indicating the attack allows unauthorized cross-origin writes or data manipulation rather than information disclosure. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (6th percentile) signals low observed exploitation interest despite the medium-severity Chromium classification.
Uninitialized memory read in Chrome's Dawn (WebGPU) component exposes process memory contents to remote unauthenticated attackers who can entice a user to visit a crafted HTML page. All Chrome desktop versions prior to 149.0.7827.53 are affected, with confidentiality impact rated High (C:H) due to potential exposure of sensitive in-process data such as credentials or session tokens. No public exploit code or active exploitation has been identified at time of analysis; EPSS at 0.03% (11th percentile) reflects low current exploitation pressure.
Cross-origin data leakage in Google Chrome for Android (prior to 149.0.7827.53) is enabled by a race condition in the GPU component, exploitable only after the attacker has already achieved renderer process compromise. Using a crafted HTML page, the attacker can then trigger the GPU race to read cross-origin data, constituting a second-stage information disclosure step in a broader attack chain. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.03% (11th percentile), consistent with limited real-world exploitation activity.
Script and HTML injection into privileged Chrome pages is possible in Google Chrome prior to 149.0.7827.53 through insufficient policy enforcement in the Extensions subsystem. An attacker who convinces a user to install a crafted malicious extension can leverage this to inject content into otherwise-restricted privileged pages, compromising page integrity. EPSS is 0.01% (1st percentile), no KEV listing exists, and no public exploit has been identified at time of analysis - indicating low observed exploitation pressure despite the network-accessible attack vector.
Uninitialized memory use in Skia, Chrome's 2D graphics library, exposes process memory contents to a remote attacker who has already compromised the renderer process. Affected versions are all Chrome releases prior to 149.0.7827.53 on desktop platforms. An attacker leveraging this flaw can read potentially sensitive data from process memory - such as credentials, tokens, or page content - by delivering a crafted HTML page that triggers Skia's uninitialized memory path. No public exploit identified at time of analysis and EPSS stands at 0.03% (11th percentile), indicating low current exploitation pressure; however, the confidentiality impact is rated High by NVD.
Out-of-bounds read in ANGLE (Google's graphics abstraction layer) within Chrome on Linux exposes sensitive process memory to remote attackers via a crafted HTML page. All Chrome for Linux versions prior to 149.0.7827.53 are affected; Windows and macOS are not in scope. The CVSS vector confirms unauthenticated remote exploitability at low complexity, though user interaction is required, and no public exploit has been identified at time of analysis - EPSS at 0.03% (11th percentile) signals minimal current exploitation pressure.
Same-origin policy bypass in Google Chrome's Extensions subsystem (versions prior to 149.0.7827.53) allows an attacker who socially engineers a user into installing a crafted malicious extension to violate cross-origin boundaries, enabling unauthorized integrity impact against content from other origins. The CVSS vector (I:H, C:N) confirms the impact is write/modify-only - sensitive data exfiltration is not a direct consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS is negligible at 0.01% (1st percentile), consistent with the social-engineering prerequisite limiting mass exploitation.
Memory disclosure in Google Chrome's GPU component (versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to read sensitive data from process memory by delivering a crafted HTML page. The vulnerability stems from insufficient validation of untrusted input passed to the GPU subsystem, classified as CWE-20 (Improper Input Validation), and is rated Medium severity by the Chromium security team despite a CVSS Confidentiality impact of High - reflecting that successful exploitation requires a prior renderer compromise as a prerequisite. No public exploit code has been identified and EPSS probability stands at just 0.05% (15th percentile), indicating low current exploitation likelihood.
Integer overflow in ANGLE (Google's graphics abstraction layer) within Chrome on macOS prior to 149.0.7827.53 enables remote information disclosure from process memory via crafted HTML pages. An unauthenticated remote attacker who induces user interaction can trigger out-of-bounds memory reads through a malicious webpage, potentially exposing credentials, session tokens, or other sensitive in-memory data. No active exploitation is confirmed (not listed in CISA KEV) and EPSS of 0.03% (11th percentile) reflects low real-world exploitation probability at time of analysis.
Cross-origin data leakage in Google Chrome's Skia graphics library (prior to 149.0.7827.53) enables a remote attacker to read sensitive data from other origins by enticing a user to visit a crafted HTML page. The flaw stems from uninitialized memory use (CWE-457) in Skia, Chrome's 2D rendering engine, where residual memory contents can be exposed across security boundaries. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.03% (11th percentile), indicating low real-world exploitation probability at time of analysis, though the confidentiality impact is rated High by CVSS.
Subresource Integrity (SRI) policy enforcement failure in Google Chrome prior to 149.0.7827.53 enables remote attackers to bypass Content Security Policy protections via malicious network traffic. Affected users who visit attacker-influenced pages may have tampered scripts or resources loaded without the expected cryptographic hash validation that SRI is designed to enforce, undermining integrity guarantees that web applications depend on as a security boundary. No active exploitation is confirmed (not in CISA KEV), EPSS is very low at 0.02% (6th percentile), and a vendor patch is available at 149.0.7827.53.
Same-origin policy bypass in Google Chrome prior to 149.0.7827.53 enables remote unauthenticated attackers to violate cross-origin isolation boundaries through a crafted HTML page, producing high integrity impact with no confidentiality or availability loss. Rooted in an inappropriate DOM implementation (CWE-346: Origin Validation Error), the flaw allows a malicious page to cross origin boundaries and manipulate content or state belonging to a different origin. No public exploit code and no CISA KEV listing exist at time of analysis; the EPSS score of 0.02% (4th percentile) reinforces limited real-world exploitation pressure despite the medium CVSS 6.5 rating.
Universal Cross-Site Scripting (UXSS) in Google Chrome for Android's Tab Group Sync feature allows remote unauthenticated attackers to inject arbitrary scripts or HTML via malicious network traffic against Chrome versions prior to 149.0.7827.53. The CVSS Changed Scope (S:C) confirms that injected content escapes the vulnerable component's origin boundary, affecting other origins - the defining characteristic of UXSS, which is more severe than conventional XSS because it bypasses the browser-level same-origin policy rather than just application-level controls. No public exploit has been identified at time of analysis, and EPSS at 0.07% (22nd percentile) reflects low current exploitation probability; the vulnerability is not listed in CISA KEV.
Uninitialized memory read in Chrome's WebML component on macOS exposes potentially sensitive process memory contents to remote attackers. Affected are all Chrome versions prior to 149.0.7827.53 on Mac; exploitation requires convincing a user to visit a specially crafted HTML page. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.03% (10th percentile) reflects low real-world exploitation likelihood at time of analysis.
Cross-origin data leakage in Google Chrome's Password Manager component (versions prior to 149.0.7827.53) enables unauthenticated remote attackers to access sensitive data across security origin boundaries when a victim visits a specially crafted HTML page. The flaw involves an inappropriate implementation of origin validation (CWE-346) within the Password Manager subsystem, potentially exposing saved credentials or autofill data to a malicious origin. No active exploitation has been confirmed - SSVC classifies exploitation as none and EPSS places this in the 11th percentile - though the High confidentiality impact in the CVSS vector reflects meaningful data exposure if triggered.
UI spoofing in Google Chrome's Password Manager component (versions prior to 149.0.7827.53) allows remote unauthenticated attackers to manipulate browser interface elements via crafted malicious network traffic. The flaw stems from insufficient input validation (CWE-20) in the Password Manager subsystem, enabling an attacker to deceive victims about the legitimacy of password prompts or credential states. No public exploit code or active exploitation has been identified; EPSS at 0.05% (15th percentile) reflects low community-assessed exploitation probability, and the mandatory user interaction requirement prevents automated mass exploitation.
Cross-origin data leakage in the Glic component of Google Chrome (prior to 149.0.7827.53) can be triggered by a remote attacker who has already compromised the renderer process, using a crafted HTML page to exfiltrate sensitive cross-origin content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects high confidentiality impact but masks the realistic complexity: renderer compromise is an explicit prerequisite, making this a chained exploit rather than a standalone attack. No active exploitation has been confirmed (CISA KEV absent, SSVC exploitation=none, EPSS 0.05% at 15th percentile), and a vendor-released patch is available.
Navigation restriction bypass in Google Chrome's Extensions subsystem (all versions prior to 149.0.7827.53) enables circumvention of browser-enforced navigation controls when a user installs a crafted malicious extension. Rooted in CWE-284 (Improper Access Control), the flaw allows the extension to override navigation guards - potentially enabling unauthorized redirects or bypass of URL-based security policies - with a high integrity impact per CVSS (I:H). No public exploit has been identified at time of analysis, EPSS is 0.01% (1st percentile), and the vulnerability is not listed in CISA's KEV catalog, indicating low current exploitation momentum despite a medium CVSS score of 6.5.
Content Security Policy bypass in Google Chrome for Android prior to 149.0.7827.53 allows a remote attacker to circumvent CSP restrictions by delivering a crafted HTML page to a victim user. The flaw resides in Chrome's Navigation subsystem, where policy enforcement is insufficient, enabling injection or execution of content that CSP headers would otherwise block. No public exploit has been identified at time of analysis, and EPSS sits at the 4th percentile, but the zero-privilege-required, network-accessible attack surface warrants prompt patching on Android deployments.
Same-origin policy bypass in Google Chrome's WebAppInstalls component allows a remote attacker who has already compromised the renderer process to circumvent cross-origin protections via a crafted HTML page, yielding high integrity impact with no confidentiality or availability loss. All Chrome versions prior to 149.0.7827.53 are affected. No public exploit code has been identified and EPSS places this at the 6th percentile (0.02%), indicating very low observed exploitation probability; this is not listed in CISA KEV.
Same-origin policy bypass in Google Chrome DevTools (versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) within the DevTools component, yielding a High integrity impact while leaving confidentiality and availability unaffected. No public exploit code exists at time of analysis, and EPSS sits at 0.02% (6th percentile), indicating low observed exploitation pressure; this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Cross-origin data disclosure in Google Chrome's Extensions component (versions prior to 149.0.7827.53) enables a remote attacker to read sensitive data belonging to other origins by delivering a crafted XML file to a victim. The CVSS vector confirms network-reachable, unauthenticated access (AV:N/PR:N) with High confidentiality impact, though user interaction is required (UI:R). No public exploit has been identified at time of analysis and EPSS probability sits at a low 0.03% (11th percentile), indicating limited exploitation likelihood despite the meaningful confidentiality impact.
Domain spoofing in the Google Chrome Payments component on Android (versions prior to 149.0.7827.53) enables integrity manipulation of payment flows when an attacker has already compromised the renderer process. By serving a crafted HTML page, the attacker can make the Chrome Payments UI display a spoofed domain, potentially deceiving users into authorizing payments to attacker-controlled origins. EPSS stands at 0.03% (11th percentile), no public exploit code has been identified, and this CVE does not appear in the CISA KEV catalog.
Navigation restriction bypass in Google Chrome prior to version 149.0.7827.53 enables a remote, unauthenticated attacker to circumvent browser navigation policies by delivering a crafted HTML page to a victim. The flaw resides in the 'Actor' component of the Chromium engine, where policy enforcement is insufficient, leading to a high-integrity-impact breach (CVSS I:H) without any compromise of confidentiality or availability. No public exploit code and no active exploitation have been identified at time of analysis; EPSS stands at 0.02% (4th percentile), reinforcing a currently low real-world exploitation probability.
Cross-origin data leakage in Google Chrome's MHTML implementation prior to version 149.0.7827.53 exposes sensitive user data to remote attackers via crafted HTML pages. The flaw stems from improper origin validation (CWE-346) in MHTML handling, allowing an attacker-controlled page to read data across origin boundaries - a significant breach of the browser's same-origin policy. Exploitation requires convincing a victim to perform specific UI gestures, and no public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.03% (11th percentile).
Cross-origin data leakage in Google Chrome's Network implementation prior to version 149.0.7827.53 allows a remote unauthenticated attacker to read sensitive cross-origin data by luring a victim to a crafted HTML page. Rooted in CWE-346 (Origin Validation Error), the flaw permits the Network component to expose data across origin boundaries that same-origin policy should protect. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS of 0.03% (11th percentile) places real-world exploitation probability as very low at time of analysis.
Insufficient policy enforcement in Google Chrome's Password Manager component (versions prior to 149.0.7827.53) allows a remote, unauthenticated attacker to bypass discretionary access control by delivering a crafted HTML page to a victim. Per the CVSS vector (C:N/I:N/A:H), the confirmed impact is high availability disruption - notably not credential exfiltration - suggesting the bypass degrades or denies Password Manager functionality rather than exposing stored credentials. No public exploit exists and EPSS sits at 0.02% (4th percentile), indicating no widespread exploitation pressure at time of analysis.
UI spoofing in Google Chrome's Password Manager component (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to manipulate the Password Manager's visual interface via crafted malicious network traffic, potentially deceiving users about credential prompts or password state. Exploitation requires user interaction (CVSS UI:R), limiting opportunistic mass exploitation. No public exploit code exists and no active exploitation is confirmed - EPSS sits at just 0.05% (15th percentile), consistent with a low-priority medium-severity browser component flaw. A vendor-released patch is available in Chrome 149.0.7827.53.
Discretionary access control bypass in Google Chrome's Extensions subsystem affects all versions prior to 149.0.7827.53, enabling integrity compromise without exposing confidential data. Exploitation requires convincing a target user to install a crafted malicious Chrome Extension, placing social engineering at the center of any attack path. No public exploit code exists and no active exploitation has been confirmed; EPSS sits at 0.01% (1st percentile), indicating very low observed exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome DevTools (all versions prior to 149.0.7827.53) enables circumvention of browser navigation controls through a crafted malicious Chrome Extension. Exploitation requires convincing a target user to install the malicious extension, placing this firmly in social-engineering territory rather than opportunistic mass exploitation. EPSS is extremely low at 0.02% (4th percentile), no public exploit code has been identified, and there is no CISA KEV listing, making this a moderate-priority integrity-only issue despite the CVSS 6.5 score.
Navigation restriction bypass in Google Chrome's Glic component (versions prior to 149.0.7827.53) enables remote attackers to circumvent browser navigation controls by delivering a crafted HTML page that the victim must open. The vulnerability is rooted in an inappropriate implementation (CWE-284, Improper Access Control) within the Glic subsystem and yields limited but multi-dimensional impact across confidentiality, integrity, and availability (C:L/I:L/A:L). No public exploit identified at time of analysis and this CVE does not appear in CISA KEV; Google has assigned a 'Medium' severity rating consistent with the CVSS 6.3 score.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 149.0.7827.53 allows remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page, requiring only user interaction. The Scope:Changed CVSS component (S:C) confirms this bypasses Chrome's Same-Origin Policy, enabling access to content from other origins in the victim's browser session. No public exploit code has been identified at time of analysis, and this is not listed in CISA KEV; however, UXSS classes in major browsers are historically targeted by threat actors for session hijacking and credential theft.
Navigation restriction bypass in Google Chrome prior to 149.0.7827.53 allows a remote, unauthenticated attacker to circumvent policy enforcement in the browser's Actor component by delivering a crafted HTML page to a target user. The flaw (CWE-602) enables unauthorized navigation actions that could expose users to cross-origin manipulation or redirects with low but non-trivial confidentiality, integrity, and availability impact. No public exploit has been identified at time of analysis, and EPSS of 0.02% combined with SSVC exploitation status of none indicates limited active threat, though the broad attack surface of any Chrome desktop user visiting a malicious page warrants timely patching.
Out-of-bounds read in Chrome's GWP-ASan memory safety subsystem (versions prior to 149.0.7827.53) enables a local attacker to disclose potentially sensitive contents from process memory by delivering a malicious file to the target. The vulnerability carries a CVSS 6.5 Medium score with high confidentiality impact but no integrity or availability impact, consistent with a pure information-disclosure class. No public exploit code has been identified at time of analysis, EPSS exploitation probability is extremely low at 0.01% (1st percentile), and SSVC assessment confirms no known active exploitation, collectively indicating a low near-term threat priority despite the notable confidentiality impact rating.
Cross-origin data leakage in Google Chrome's SVG implementation affects all desktop versions prior to 149.0.7827.53, enabling remote attackers to exfiltrate sensitive data from other origins via a crafted HTML page. The flaw exploits Chrome's SVG rendering pipeline to violate the Same-Origin Policy, exposing confidential data such as authenticated session content or cross-site resources. No public exploit identified at time of analysis, and EPSS probability is very low (0.03%, 11th percentile), though the zero-privilege-required, low-complexity attack path warrants prompt patching for any internet-facing user population.
Same-origin policy bypass in Google Chrome's Media Session component (prior to 149.0.7827.53) enables remote attackers to violate cross-origin isolation via a crafted HTML page. The vulnerability stems from an inappropriate implementation (CWE-346: Origin Validation Error) in the Media Session API, which fails to properly enforce origin boundaries. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis; EPSS sits at 0.02% (4th percentile), consistent with low observed exploitation activity.
Cross-origin data leakage via Google Chrome's SVG implementation (all versions prior to 149.0.7827.53) enables remote unauthenticated attackers to exfiltrate sensitive information from foreign origins by luring a victim to a crafted HTML page. The flaw reflects an inappropriate SVG rendering implementation that fails to enforce cross-origin isolation boundaries, producing a high confidentiality impact with no integrity or availability consequences. EPSS is very low at 0.03% (11th percentile), no public exploit code has been identified, and no CISA KEV listing exists at time of analysis, suggesting limited observed exploitation despite the medium-severity CVSS score.
Cross-origin data leakage in Google Chrome's WebView component on Android allows an unauthenticated remote attacker to read data from origins outside the attacker's own domain by enticing a user to visit a crafted HTML page. Affected are all Android Chrome versions prior to 149.0.7827.53. No public exploit exists and SSVC classifies exploitation as none, but the network-accessible, low-complexity attack vector warrants patching for Android-heavy enterprise environments handling sensitive cross-origin content.
Cross-origin data leakage in Google Chrome's Media subsystem (all versions prior to 149.0.7827.53) enables a remote attacker to read sensitive data from other web origins by inducing a user to visit a specially crafted HTML page. The flaw stems from an inappropriate implementation in Media that fails to correctly enforce origin boundaries (CWE-346), resulting in high confidentiality impact per CVSS (C:H) with no integrity or availability consequence. No active exploitation is confirmed - CISA KEV is absent and EPSS sits at 0.03% (11th percentile) - but the confidentiality vector is significant for users accessing sensitive cross-origin content concurrently.
Site Isolation bypass in Google Chrome prior to 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to escape cross-origin protections via a crafted HTML page, exposing high-confidentiality data from other origins loaded in the browser. This is a chained, second-stage exploit component: it does not function standalone but amplifies the impact of a separate renderer compromise by breaking Chrome's primary cross-site data isolation boundary. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects low current exploitation probability despite the high confidentiality impact rating.
Information disclosure in Google Chrome's Extensions subsystem prior to version 149.0.7827.53 enables a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page. This is a second-stage vulnerability requiring a pre-existing renderer compromise as a hard prerequisite, making it a chained attack component rather than a standalone exploit. No public exploit code exists and CISA has not added this to the KEV catalog; the EPSS score of 0.03% and SSVC exploitation-status of 'none' are mutually consistent with no observed active exploitation.
Universal Cross-Site Scripting (UXSS) in Google Chrome's SVG implementation prior to version 149.0.7827.53 allows remote unauthenticated attackers to bypass same-origin policy by injecting arbitrary scripts or HTML across origins via a crafted HTML page. Exploitation requires user interaction and high attack complexity (CVSS AC:H/UI:R), and EPSS at 0.06% (18th percentile) reflects limited real-world exploitation activity. No active exploitation is confirmed by CISA KEV and no public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's CSS implementation exposes sensitive information from other origins when a user visits a crafted HTML page. Affected are all Chrome versions prior to 149.0.7827.53 on desktop platforms. An unauthenticated remote attacker can exploit this to read data from cross-origin contexts, violating the browser's Same-Origin Policy via a CSS-based side channel or direct information disclosure path. No public exploit identified at time of analysis, and EPSS at 0.03% (11th percentile) signals low current exploitation activity.
Cross-origin data leakage in Google Chrome's DataTransfer API allows unauthenticated remote attackers to read data across origins by directing a victim to a crafted HTML page, affecting all Chrome desktop versions prior to 149.0.7827.53. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:L) confirms network accessibility without attacker authentication, but requires user interaction and yields only limited confidentiality impact with no integrity or availability consequences. No active exploitation is confirmed (not in CISA KEV), and EPSS at 0.03% (11th percentile) consistently signals low current exploitation probability.
Out-of-bounds read in the Input component of Google Chrome on Linux (all versions prior to 149.0.7827.53) exposes potentially sensitive process memory to remote attackers. Exploitation requires delivering a crafted HTML page and inducing a Linux user to visit it (CVSS UI:R), after which the browser's Input handler reads beyond allocated buffer bounds, leaking in-memory data. No public exploit has been identified at time of analysis, EPSS sits at 0.03% (11th percentile) indicating low current exploitation probability, and there is no CISA KEV listing - though the High confidentiality impact (C:H) warrants timely patching given Chrome's broad deployment on Linux.
Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 149.0.7827.53, exploitable via a crafted HTML page requiring only a single user visit. The root cause (CWE-457: use of uninitialized memory) in Chrome's Skia rendering backend allows residual memory contents to be exposed across origin boundaries, violating the browser's same-origin policy. No public exploit identified at time of analysis; EPSS at 0.03% (11th percentile) and absence from CISA KEV indicate low real-world exploitation probability at this time.
Script injection via Chrome's Accessibility component allows a remote attacker who convinces a victim to install a malicious extension to perform Universal Cross-Site Scripting (UXSS), injecting arbitrary scripts or HTML into web page contexts the user visits. Affected are all Chrome desktop versions prior to 149.0.7827.53. EPSS is 0.01% (2nd percentile) and this vulnerability is not in CISA KEV, indicating very low real-world exploitation probability at time of analysis; however, the social-engineering prerequisite (malicious extension installation) remains a credible threat vector in targeted campaigns.
Cross-origin data leakage in Google Chrome prior to 149.0.7827.53 allows a remote unauthenticated attacker to read sensitive cross-origin data by luring a user to a crafted HTML page that exploits an inappropriate CSS implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-exploitable, no-privilege-required exploitation with a single user interaction as the only barrier. No public exploit has been identified and EPSS sits at 0.03% (11th percentile), indicating low current exploitation interest despite the low attack complexity.
Cross-origin data leakage in Google Chrome prior to 149.0.7827.53 allows remote unauthenticated attackers to read sensitive cross-origin information by directing a victim to a crafted HTML page that exploits an inappropriate CSS implementation. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no privilege requirement, limited only by the need for user interaction. EPSS is 0.03% (11th percentile) and no public exploit has been identified at time of analysis; however, Google has issued a confirmed patch in the stable channel release, and the CWE-352/CSRF tag alongside the data-leakage description suggests a novel or hybrid attack class that security teams should monitor for further clarification.
Universal Cross-Site Scripting (UXSS) in Google Chrome's XML processing component allows remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. All Chrome versions prior to 149.0.7827.53 are affected, with the Scope:Changed (S:C) CVSS vector confirming this vulnerability can bypass the Same-Origin Policy - the defining characteristic of UXSS. No public exploit code has been identified at time of analysis, and the EPSS score of 0.06% (18th percentile) reflects low observed exploitation probability, though UXSS primitives are historically attractive to threat actors targeting session data and credential theft at scale.
Cross-origin data leakage via an inappropriate CSRF-class implementation in Google Chrome's Payments component on Android prior to 149.0.7827.53 allows network-delivered exploitation when a victim visits a crafted HTML page. The confidentiality impact is rated High by CVSS (C:H), as sensitive payment-related data from one origin can be exposed to an attacker-controlled page. No public exploit has been identified at time of analysis and the EPSS score of 0.01% (1st percentile) indicates a low probability of in-the-wild exploitation, making this a medium-priority patch rather than an emergency response item.
Cross-origin data leakage in Google Chrome for Android (versions prior to 149.0.7827.53) is enabled by a race condition in the Geolocation subsystem, exploitable by a remote unauthenticated attacker who tricks a victim into visiting a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network reachability with no required privileges, though user interaction is mandatory. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.03% (10th percentile), indicating very low real-world exploitation probability despite the High confidentiality impact rating.
Out-of-bounds heap read in Google Chrome's Extensions component on Linux exposes sensitive process memory to a malicious extension author. Affected versions are Chrome on Linux prior to 149.0.7827.53; Windows and macOS are not listed as affected. Exploitation requires convincing a target user to install a crafted malicious extension, limiting exposure compared to the CVSS 6.5 score implies - no public exploit identified at time of analysis, and EPSS of 0.01% (1st percentile) reflects low current exploitation probability.
Same-origin policy bypass in Google Chrome's Paint component prior to version 149.0.7827.53 allows a remote, unauthenticated attacker to violate cross-origin integrity protections by inducing a user to visit a crafted HTML page. The flaw stems from insufficient policy enforcement in the Paint subsystem (CWE-639), enabling an attacker to write or manipulate content across origin boundaries, resulting in high integrity impact with no confidentiality or availability loss per the CVSS vector. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) indicates very low current exploitation probability.
Uninitialized memory use in Google Chrome's Audio subsystem (versions prior to 149.0.7827.53) enables an attacker who has already compromised the renderer process to read potentially sensitive data from process memory via a crafted HTML page. This is a chained-exploit component - it does not grant initial access but can assist post-renderer-compromise data leakage or ASLR bypass. No KEV listing and an EPSS of 0.03% (11th percentile) indicate no observed widespread exploitation; no public exploit has been identified at time of analysis.
Out-of-bounds read in the Chromecast component of Google Chrome prior to version 149.0.7827.53 enables a remote attacker - who has already compromised the renderer process - to leak potentially sensitive data from process memory by delivering a crafted HTML page. This is a chained vulnerability: exploitation is conditional on a prior renderer compromise, making it a second-stage information-disclosure step rather than a standalone attack. No public exploit code has been identified and EPSS probability stands at 0.05% (15th percentile), consistent with a medium-severity, constrained attack path. Google has released a fix in stable channel 149.0.7827.53.
Cross-origin data leakage in Google Chrome's Paint component (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read sensitive cross-origin data by tricking a user into visiting a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's rendering Paint subsystem that fails to properly enforce cross-origin isolation boundaries. EPSS is low at 0.03% and no active exploitation is confirmed in CISA KEV, but the high confidentiality impact (C:H) combined with low attack complexity and no required privileges makes this a meaningful data-exfiltration risk for browser users visiting untrusted web content.
Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 149.0.7827.53) allows an unauthenticated remote attacker to read sensitive data belonging to other web origins by enticing a user to visit a specially crafted HTML page. The root cause is an uninitialized variable use (CWE-457) within ANGLE - Chrome's OpenGL ES translation layer - which can expose heap or stack memory contents across origin boundaries. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.03% (11th percentile) indicates low observed exploitation probability at time of analysis.
Uninitialized memory exposure in Google Chrome's ANGLE graphics library prior to version 149.0.7827.53 enables remote unauthenticated attackers to read potentially sensitive data from browser process memory by luring a victim to a crafted HTML page. The CVSS vector (PR:N/UI:R/C:H) confirms no attacker privileges are required but victim interaction is mandatory - the attack is entirely browser-side and exploits how ANGLE handles graphics state without zeroing memory first. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating low observed exploitation interest despite the High confidentiality impact rating.
Insufficient policy enforcement in Google Chrome's Autofill subsystem (versions prior to 149.0.7827.53) enables remote unauthenticated attackers to bypass discretionary access control, resulting in high-integrity impact when a victim visits a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/I:H) confirms the attack is network-delivered, low-complexity, and requires no privileges, though user interaction is a prerequisite. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.02% (4th percentile) reflects low observed exploitation pressure.
Cross-origin data leakage in Google Chrome's Media component (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive data from cross-origin resources by luring victims to a crafted HTML page. The flaw is rooted in an inappropriate implementation in Chrome's Media subsystem, tagged with CSRF characteristics, allowing an attacker-controlled page to read content from origins the victim is authenticated to. EPSS is low at 0.03% and no public exploit or CISA KEV listing has been identified at time of analysis.
Insufficient same-origin policy enforcement in Google Chrome's Paint rendering component (prior to 149.0.7827.53) allows unauthenticated remote attackers to bypass SOP boundaries via a crafted HTML page, resulting in high integrity impact against the victim's browser context. The attack requires user interaction (visiting a malicious page) but no authentication or elevated privileges. No public exploit code has been identified and no CISA KEV listing exists at time of analysis; EPSS is extremely low at 0.02% (4th percentile), indicating limited observed exploitation activity in the wild.
Same-origin policy bypass in Google Chrome's Paint component (all versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin integrity protections by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/I:H) confirms network-based, low-complexity exploitation with no privilege requirement, though victim interaction - visiting the attacker's page - is mandatory. No public exploit has been identified at time of analysis, and an EPSS score of 0.02% (4th percentile) indicates minimal observed exploitation activity; this is not listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Extensions subsystem (versions prior to 149.0.7827.53) enables a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. The flaw is classified under CWE-352 (Cross-Site Request Forgery), indicating the Extensions implementation incorrectly handles cross-origin request validation in a way that bypasses same-origin isolation boundaries. No public exploit has been identified at time of analysis, and an EPSS score of 0.03% (11th percentile) signals low current exploitation probability despite the High confidentiality impact rating.
Cross-origin data leakage in Google Chrome's Web Share API prior to version 149.0.7827.53 allows a remote attacker to extract sensitive cross-origin information by convincing a user to perform specific UI gestures on a crafted HTML page, violating browser same-origin policy guarantees. The CVSS vector (AV:N/AC:L/PR:N/UI:R/C:H) reflects high confidentiality impact with no authentication required on the attacker's side, though mandatory user interaction reduces realistic exploitation probability significantly. No public exploit has been identified at time of analysis, and an EPSS score of 0.04% (13th percentile) corroborates low current exploitation activity.
Domain spoofing via crafted WebAPK in Google Chrome on Android prior to 149.0.7827.53 enables remote unauthenticated attackers to deceive users about the web origin of installed Progressive Web Apps, with high integrity impact as confirmed by the CVSS I:H rating. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-accessible and requires no privileges, though user interaction is a necessary precondition. No public exploits have been identified and EPSS sits at 0.03% (10th percentile), indicating minimal observed exploitation pressure; however, the trust-abuse potential for phishing campaigns makes timely patching advisable.
Cross-origin data leakage in Google Chrome DevTools affects all versions prior to 149.0.7827.53, exploitable through a crafted malicious Chrome Extension. The inappropriate DevTools implementation allows an attacker who successfully social-engineers a victim into installing the extension to read data from cross-origin contexts - violating the browser's same-origin isolation guarantees at the DevTools layer. No public exploit code exists and no CISA KEV listing is present; EPSS at 0.02% (4th percentile) confirms low exploitation probability in the wild, making this a routine patch-cycle priority rather than an emergency response item.
Uninitialized memory read in Chrome's ANGLE graphics layer prior to version 149.0.7827.53 allows remote attackers to obtain sensitive process memory contents through a crafted HTML page, with no authentication required but mandatory user interaction. The vulnerability carries a CVSS Confidentiality impact of High (C:H), indicating potentially significant data exposure despite the Medium overall score of 6.5. EPSS is low at 0.03% (11th percentile) and no CISA KEV listing exists, meaning no public exploit or confirmed widespread exploitation has been identified at time of analysis.
Universal Cross-Site Scripting (UXSS) in Google Chrome's Keyboard implementation prior to version 149.0.7827.53 enables remote unauthenticated attackers to inject arbitrary scripts or HTML across origin boundaries via a crafted HTML page. The Scope:Changed CVSS vector reflects the fundamental nature of this class: successful exploitation bypasses the Same-Origin Policy, potentially granting script access to sessions, cookies, and DOM content across all origins open in the browser. No public exploit has been identified at time of analysis, and the EPSS score of 0.06% (18th percentile) indicates low current exploitation probability, though UXSS primitives are historically high-value for targeted attacks.
Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 149.0.7827.53, exploitable by a remote attacker who has already compromised the renderer process. Via a crafted HTML page, the attacker can abuse insufficient input validation in Skia to extract sensitive cross-origin data, bypassing browser isolation boundaries. No public exploit code has been identified at time of analysis, and the EPSS score of 0.05% (15th percentile) reflects low observed exploitation activity.
Cross-origin data leakage in Google Chrome's ANGLE graphics subsystem (prior to 149.0.7827.53) allows a remote unauthenticated attacker to read sensitive data from other web origins by enticing a user to visit a crafted HTML page. The root cause is an uninitialized memory use (CWE-457) within ANGLE, Chrome's graphics translation layer, which may expose stale memory contents - potentially including data from other browser contexts or origins. No public exploit code or CISA KEV listing has been identified; EPSS probability of 0.03% (11th percentile) indicates low real-world exploitation pressure at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics library affects all versions prior to 149.0.7827.53, allowing unauthenticated remote attackers to read sensitive cross-origin browser data by enticing a user to visit a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within ANGLE, Chrome's graphics abstraction layer, where residual memory contents from other origins can be exposed through the GPU pipeline. No public exploit identified at time of analysis, and the EPSS score of 0.03% (11th percentile) indicates low current exploitation probability; however, Chrome's broad install base makes any confirmed cross-origin data disclosure notable from a privacy and session-data standpoint.
UI spoofing in Google Chrome's Downloads component prior to version 149.0.7827.53 enables remote attackers to misrepresent download-related interface elements by serving a crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in the Downloads subsystem, allowing an attacker to manipulate what the user sees during a download interaction - potentially masking file names, types, or origin - without any authentication. No public exploit code exists and EPSS sits at 0.03% (11th percentile), indicating no public exploit identified at time of analysis; however, the no-authentication, low-complexity delivery path warrants prompt patching.
Cross-origin data leakage in Google Chrome's Media component (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive information from cross-origin pages by luring a victim to a crafted HTML page. The CVSS vector confirms unauthenticated network access with high confidentiality impact (C:H), though user interaction is required (UI:R). No public exploit identified at time of analysis, and EPSS at 0.03% (11th percentile) indicates low near-term mass exploitation probability, aligning with the Chromium team's 'Medium' severity rating.
Cross-origin data leakage in Google Chrome's WebUI component prior to version 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to extract sensitive cross-origin information via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the WebUI layer, which fails to properly sanitize input arriving from a compromised renderer, breaking Chrome's intended process isolation boundary. No active exploitation has been confirmed (not in CISA KEV), and an EPSS score of 0.04% (13th percentile) reflects low widespread exploitation probability, consistent with this being a second-stage technique requiring a chained renderer compromise.
Uninitialized memory exposure in the ANGLE graphics layer of Google Chrome prior to 149.0.7827.53 allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by delivering a crafted HTML page. The vulnerability is limited to confidentiality impact - no code execution or integrity compromise is possible through this vector alone. With an EPSS score of 0.03% (11th percentile), no public exploit code, and no CISA KEV listing, real-world exploitation risk is currently low despite the High confidentiality CVSS sub-score.
Uninitialized memory use in the Dawn WebGPU engine of Google Chrome on Windows (all versions prior to 149.0.7827.53) enables a remote unauthenticated attacker to leak cross-origin data from a victim's browser session. Exploitation requires the victim to visit a crafted HTML page, breaking same-origin isolation by surfacing residual memory contents from other browsing contexts. No public exploit has been identified and EPSS sits at 0.03% (11th percentile), indicating low current exploitation probability; however, the High confidentiality CVSS impact warrants prompt patching in environments handling sensitive cross-origin data.
Cross-origin data leakage in Google Chrome's GPU component (prior to 149.0.7827.53) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin information by delivering a specially crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns a score of 6.5 Medium, reflecting high confidentiality impact tempered by required user interaction and the critical prerequisite of a pre-compromised renderer. No public exploit has been identified at time of analysis, and EPSS registers at 0.05% (15th percentile), consistent with a multi-stage exploitation barrier.
Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 149.0.7827.53) enables remote attackers to exfiltrate sensitive cross-origin data by directing victims to a specially crafted HTML page. The flaw resides in an inappropriate implementation within WebView (CWE-474), effectively undermining same-origin policy protections that normally isolate web content across origins - an attacker can read data they should not have access to. No public exploit has been identified at time of analysis, and an EPSS score of 0.03% (10th percentile) signals very low current exploitation probability; the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the WebRTC component of Google Chrome prior to 149.0.7827.53 exposes potentially sensitive process memory contents to remote attackers. Exploitation requires no authentication (CVSS PR:N) but does require user interaction - a victim must visit a specially crafted HTML page (CVSS UI:R). The confidentiality impact is rated High (C:H) with no integrity or availability consequence, meaning a successful attack leaks memory contents rather than enabling code execution. No public exploit identified at time of analysis, and EPSS at 0.03% (10th percentile) reflects low observed exploitation probability.
Cross-origin data leakage in Google Chrome's Printing subsystem (all versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data by serving a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects high confidentiality impact with no integrity or availability loss, though the real-world attack requires a pre-compromised renderer - making this a second-stage chaining vulnerability rather than a standalone initial-access vector. No public exploit code or CISA KEV listing has been identified, and EPSS at 0.05% (15th percentile) confirms low current exploitation probability.
Cross-origin data leakage in Google Chrome's ANGLE graphics library (versions prior to 149.0.7827.53) allows a remote unauthenticated attacker to read memory across origin boundaries by luring a victim to a crafted HTML page. The root cause is an uninitialized variable (CWE-457) within ANGLE - Chromium's graphics translation layer - which may retain residual data from prior allocations, exposing sensitive cross-origin content. No public exploit code exists and no active exploitation is confirmed (CISA KEV absent); EPSS is 0.03% (11th percentile), indicating low current real-world exploitation pressure.
Uninitialized memory read in Google Chrome's Media component exposes sensitive process memory contents to attackers who have already compromised the renderer process. Specifically, Chrome versions prior to 149.0.7827.53 fail to initialize memory in the Media subsystem, enabling a secondary attacker-controlled read of arbitrary process memory via a crafted HTML page. EPSS stands at 0.03% (11th percentile), no public exploit has been identified, and this vulnerability is not listed in the CISA KEV catalog; the vendor-released patch is available in Chrome 149.0.7827.53.
Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to read sensitive data from other origins via a crafted HTML page. The root cause is CWE-457 (Use of Uninitialized Variable) in ANGLE - residual memory contents in the graphics pipeline can be read before proper initialization, exposing data across origin boundaries. EPSS is very low at 0.03% (11th percentile) and no public exploit or CISA KEV listing has been identified, but the cross-origin data access impact makes this relevant in chained exploit scenarios.
Cross-origin data leakage in Google Chrome's Password Manager component (prior to 149.0.7827.53) exposes sensitive credential or form data to remote attackers through a crafted HTML page. The flaw stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning the Password Manager fails to properly enforce same-origin boundaries when handling data. No privileges are required and exploitation is conditional only on user interaction with a malicious page; CVSS confidentiality impact is rated High, though no public exploit code exists and EPSS is at 0.03%, indicating low observed exploitation pressure at time of analysis.
Cross-origin data leakage via Chrome's Password Manager component affects Google Chrome versions prior to 149.0.7827.53, exploitable when a user visits an attacker-crafted HTML page. The flaw stems from an inappropriate implementation that fails to enforce proper origin boundaries within the Password Manager, allowing a remote, unauthenticated attacker to read sensitive cross-origin data - potentially including credential-related information surfaced by the Password Manager. No public exploit code has been identified and no active exploitation is confirmed (not in CISA KEV), with EPSS at 0.03% (11th percentile), though the high confidentiality impact (C:H) warrants prompt patching given Chrome's massive deployment surface.
Same-Origin Policy bypass in Google Chrome's Canvas implementation affects all versions prior to 149.0.7827.53, allowing a remote unauthenticated attacker to violate cross-origin integrity guarantees through a crafted HTML page. The vulnerability carries a High integrity impact (I:H) with no confidentiality or availability consequence, meaning an attacker can write or manipulate cross-origin data rather than read it. No public exploit code has been identified at time of analysis, and EPSS at 0.02% (4th percentile) suggests minimal observed exploitation pressure currently.
Same-origin policy bypass in Google Chrome's FileSystem API implementation affects all desktop versions prior to 149.0.7827.53, exploitable by a remote attacker who has already achieved renderer process compromise. Delivering a crafted HTML page to a victim who interacts with it triggers the flaw, resulting in high-integrity cross-origin impact with no confidentiality or availability consequence. No public exploit code exists and EPSS sits at 0.02% (6th percentile), but the integrity impact and its role as a renderer-escape pivot make it relevant to multi-stage exploitation chains.
Out-of-bounds read in Chrome's V8 JavaScript engine (versions prior to 149.0.7827.53) exposes sensitive process memory to remote attackers who can lure a victim to a crafted HTML page. The CVSS vector (PR:N/UI:R/C:H) confirms unauthenticated remote triggering with high confidentiality impact, though exploitation requires one click of user interaction. No public exploit identified at time of analysis, and EPSS sits at the 11th percentile (0.03%), suggesting low observed exploitation pressure despite the medium-severity classification.
Use-after-free in Google Chrome's WebGL component (prior to 149.0.7827.53) exposes process memory to remote attackers who can lure a user to a crafted HTML page. The vulnerability is limited to confidentiality - CVSS C:H/I:N/A:N - meaning an attacker can read potentially sensitive data from Chrome's process memory but cannot write or crash the process per the scored vector. No public exploit has been identified at time of analysis, and EPSS sits at 0.03% (10th percentile), indicating low observed exploitation pressure. Google has shipped a fix in the stable channel release 149.0.7827.53.
Same-origin policy bypass in the Cast component of Google Chrome (prior to 149.0.7827.53) enables a remote unauthenticated attacker to violate cross-origin integrity protections via a crafted HTML page, requiring only that the target user visit the attacker-controlled page. The CVSS vector confirms high integrity impact with no confidentiality or availability consequence, indicating the attack allows unauthorized cross-origin writes or data manipulation rather than information disclosure. No public exploit code has been identified at time of analysis, and the EPSS score of 0.02% (6th percentile) signals low observed exploitation interest despite the medium-severity Chromium classification.
Uninitialized memory read in Chrome's Dawn (WebGPU) component exposes process memory contents to remote unauthenticated attackers who can entice a user to visit a crafted HTML page. All Chrome desktop versions prior to 149.0.7827.53 are affected, with confidentiality impact rated High (C:H) due to potential exposure of sensitive in-process data such as credentials or session tokens. No public exploit code or active exploitation has been identified at time of analysis; EPSS at 0.03% (11th percentile) reflects low current exploitation pressure.
Cross-origin data leakage in Google Chrome for Android (prior to 149.0.7827.53) is enabled by a race condition in the GPU component, exploitable only after the attacker has already achieved renderer process compromise. Using a crafted HTML page, the attacker can then trigger the GPU race to read cross-origin data, constituting a second-stage information disclosure step in a broader attack chain. No public exploit code or CISA KEV listing exists at time of analysis; EPSS sits at 0.03% (11th percentile), consistent with limited real-world exploitation activity.
Script and HTML injection into privileged Chrome pages is possible in Google Chrome prior to 149.0.7827.53 through insufficient policy enforcement in the Extensions subsystem. An attacker who convinces a user to install a crafted malicious extension can leverage this to inject content into otherwise-restricted privileged pages, compromising page integrity. EPSS is 0.01% (1st percentile), no KEV listing exists, and no public exploit has been identified at time of analysis - indicating low observed exploitation pressure despite the network-accessible attack vector.
Uninitialized memory use in Skia, Chrome's 2D graphics library, exposes process memory contents to a remote attacker who has already compromised the renderer process. Affected versions are all Chrome releases prior to 149.0.7827.53 on desktop platforms. An attacker leveraging this flaw can read potentially sensitive data from process memory - such as credentials, tokens, or page content - by delivering a crafted HTML page that triggers Skia's uninitialized memory path. No public exploit identified at time of analysis and EPSS stands at 0.03% (11th percentile), indicating low current exploitation pressure; however, the confidentiality impact is rated High by NVD.
Out-of-bounds read in ANGLE (Google's graphics abstraction layer) within Chrome on Linux exposes sensitive process memory to remote attackers via a crafted HTML page. All Chrome for Linux versions prior to 149.0.7827.53 are affected; Windows and macOS are not in scope. The CVSS vector confirms unauthenticated remote exploitability at low complexity, though user interaction is required, and no public exploit has been identified at time of analysis - EPSS at 0.03% (11th percentile) signals minimal current exploitation pressure.
Same-origin policy bypass in Google Chrome's Extensions subsystem (versions prior to 149.0.7827.53) allows an attacker who socially engineers a user into installing a crafted malicious extension to violate cross-origin boundaries, enabling unauthorized integrity impact against content from other origins. The CVSS vector (I:H, C:N) confirms the impact is write/modify-only - sensitive data exfiltration is not a direct consequence. No public exploit code or active exploitation has been identified at time of analysis; EPSS is negligible at 0.01% (1st percentile), consistent with the social-engineering prerequisite limiting mass exploitation.
Memory disclosure in Google Chrome's GPU component (versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to read sensitive data from process memory by delivering a crafted HTML page. The vulnerability stems from insufficient validation of untrusted input passed to the GPU subsystem, classified as CWE-20 (Improper Input Validation), and is rated Medium severity by the Chromium security team despite a CVSS Confidentiality impact of High - reflecting that successful exploitation requires a prior renderer compromise as a prerequisite. No public exploit code has been identified and EPSS probability stands at just 0.05% (15th percentile), indicating low current exploitation likelihood.
Integer overflow in ANGLE (Google's graphics abstraction layer) within Chrome on macOS prior to 149.0.7827.53 enables remote information disclosure from process memory via crafted HTML pages. An unauthenticated remote attacker who induces user interaction can trigger out-of-bounds memory reads through a malicious webpage, potentially exposing credentials, session tokens, or other sensitive in-memory data. No active exploitation is confirmed (not listed in CISA KEV) and EPSS of 0.03% (11th percentile) reflects low real-world exploitation probability at time of analysis.
Cross-origin data leakage in Google Chrome's Skia graphics library (prior to 149.0.7827.53) enables a remote attacker to read sensitive data from other origins by enticing a user to visit a crafted HTML page. The flaw stems from uninitialized memory use (CWE-457) in Skia, Chrome's 2D rendering engine, where residual memory contents can be exposed across security boundaries. No active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.03% (11th percentile), indicating low real-world exploitation probability at time of analysis, though the confidentiality impact is rated High by CVSS.
Subresource Integrity (SRI) policy enforcement failure in Google Chrome prior to 149.0.7827.53 enables remote attackers to bypass Content Security Policy protections via malicious network traffic. Affected users who visit attacker-influenced pages may have tampered scripts or resources loaded without the expected cryptographic hash validation that SRI is designed to enforce, undermining integrity guarantees that web applications depend on as a security boundary. No active exploitation is confirmed (not in CISA KEV), EPSS is very low at 0.02% (6th percentile), and a vendor patch is available at 149.0.7827.53.
Same-origin policy bypass in Google Chrome prior to 149.0.7827.53 enables remote unauthenticated attackers to violate cross-origin isolation boundaries through a crafted HTML page, producing high integrity impact with no confidentiality or availability loss. Rooted in an inappropriate DOM implementation (CWE-346: Origin Validation Error), the flaw allows a malicious page to cross origin boundaries and manipulate content or state belonging to a different origin. No public exploit code and no CISA KEV listing exist at time of analysis; the EPSS score of 0.02% (4th percentile) reinforces limited real-world exploitation pressure despite the medium CVSS 6.5 rating.
Universal Cross-Site Scripting (UXSS) in Google Chrome for Android's Tab Group Sync feature allows remote unauthenticated attackers to inject arbitrary scripts or HTML via malicious network traffic against Chrome versions prior to 149.0.7827.53. The CVSS Changed Scope (S:C) confirms that injected content escapes the vulnerable component's origin boundary, affecting other origins - the defining characteristic of UXSS, which is more severe than conventional XSS because it bypasses the browser-level same-origin policy rather than just application-level controls. No public exploit has been identified at time of analysis, and EPSS at 0.07% (22nd percentile) reflects low current exploitation probability; the vulnerability is not listed in CISA KEV.
Uninitialized memory read in Chrome's WebML component on macOS exposes potentially sensitive process memory contents to remote attackers. Affected are all Chrome versions prior to 149.0.7827.53 on Mac; exploitation requires convincing a user to visit a specially crafted HTML page. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.03% (10th percentile) reflects low real-world exploitation likelihood at time of analysis.
Cross-origin data leakage in Google Chrome's Password Manager component (versions prior to 149.0.7827.53) enables unauthenticated remote attackers to access sensitive data across security origin boundaries when a victim visits a specially crafted HTML page. The flaw involves an inappropriate implementation of origin validation (CWE-346) within the Password Manager subsystem, potentially exposing saved credentials or autofill data to a malicious origin. No active exploitation has been confirmed - SSVC classifies exploitation as none and EPSS places this in the 11th percentile - though the High confidentiality impact in the CVSS vector reflects meaningful data exposure if triggered.
UI spoofing in Google Chrome's Password Manager component (versions prior to 149.0.7827.53) allows remote unauthenticated attackers to manipulate browser interface elements via crafted malicious network traffic. The flaw stems from insufficient input validation (CWE-20) in the Password Manager subsystem, enabling an attacker to deceive victims about the legitimacy of password prompts or credential states. No public exploit code or active exploitation has been identified; EPSS at 0.05% (15th percentile) reflects low community-assessed exploitation probability, and the mandatory user interaction requirement prevents automated mass exploitation.
Cross-origin data leakage in the Glic component of Google Chrome (prior to 149.0.7827.53) can be triggered by a remote attacker who has already compromised the renderer process, using a crafted HTML page to exfiltrate sensitive cross-origin content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) reflects high confidentiality impact but masks the realistic complexity: renderer compromise is an explicit prerequisite, making this a chained exploit rather than a standalone attack. No active exploitation has been confirmed (CISA KEV absent, SSVC exploitation=none, EPSS 0.05% at 15th percentile), and a vendor-released patch is available.
Navigation restriction bypass in Google Chrome's Extensions subsystem (all versions prior to 149.0.7827.53) enables circumvention of browser-enforced navigation controls when a user installs a crafted malicious extension. Rooted in CWE-284 (Improper Access Control), the flaw allows the extension to override navigation guards - potentially enabling unauthorized redirects or bypass of URL-based security policies - with a high integrity impact per CVSS (I:H). No public exploit has been identified at time of analysis, EPSS is 0.01% (1st percentile), and the vulnerability is not listed in CISA's KEV catalog, indicating low current exploitation momentum despite a medium CVSS score of 6.5.
Content Security Policy bypass in Google Chrome for Android prior to 149.0.7827.53 allows a remote attacker to circumvent CSP restrictions by delivering a crafted HTML page to a victim user. The flaw resides in Chrome's Navigation subsystem, where policy enforcement is insufficient, enabling injection or execution of content that CSP headers would otherwise block. No public exploit has been identified at time of analysis, and EPSS sits at the 4th percentile, but the zero-privilege-required, network-accessible attack surface warrants prompt patching on Android deployments.
Same-origin policy bypass in Google Chrome's WebAppInstalls component allows a remote attacker who has already compromised the renderer process to circumvent cross-origin protections via a crafted HTML page, yielding high integrity impact with no confidentiality or availability loss. All Chrome versions prior to 149.0.7827.53 are affected. No public exploit code has been identified and EPSS places this at the 6th percentile (0.02%), indicating very low observed exploitation probability; this is not listed in CISA KEV.
Same-origin policy bypass in Google Chrome DevTools (versions prior to 149.0.7827.53) enables a remote attacker who has already compromised the renderer process to cross origin boundaries via a crafted HTML page. The flaw stems from insufficient input validation (CWE-20) within the DevTools component, yielding a High integrity impact while leaving confidentiality and availability unaffected. No public exploit code exists at time of analysis, and EPSS sits at 0.02% (6th percentile), indicating low observed exploitation pressure; this vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Cross-origin data disclosure in Google Chrome's Extensions component (versions prior to 149.0.7827.53) enables a remote attacker to read sensitive data belonging to other origins by delivering a crafted XML file to a victim. The CVSS vector confirms network-reachable, unauthenticated access (AV:N/PR:N) with High confidentiality impact, though user interaction is required (UI:R). No public exploit has been identified at time of analysis and EPSS probability sits at a low 0.03% (11th percentile), indicating limited exploitation likelihood despite the meaningful confidentiality impact.
Domain spoofing in the Google Chrome Payments component on Android (versions prior to 149.0.7827.53) enables integrity manipulation of payment flows when an attacker has already compromised the renderer process. By serving a crafted HTML page, the attacker can make the Chrome Payments UI display a spoofed domain, potentially deceiving users into authorizing payments to attacker-controlled origins. EPSS stands at 0.03% (11th percentile), no public exploit code has been identified, and this CVE does not appear in the CISA KEV catalog.
Navigation restriction bypass in Google Chrome prior to version 149.0.7827.53 enables a remote, unauthenticated attacker to circumvent browser navigation policies by delivering a crafted HTML page to a victim. The flaw resides in the 'Actor' component of the Chromium engine, where policy enforcement is insufficient, leading to a high-integrity-impact breach (CVSS I:H) without any compromise of confidentiality or availability. No public exploit code and no active exploitation have been identified at time of analysis; EPSS stands at 0.02% (4th percentile), reinforcing a currently low real-world exploitation probability.