Monthly
Site isolation bypass in Google Chrome prior to 148.0.7778.216 enables a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page. The attack is constrained by a two-stage prerequisite: an existing renderer compromise plus user interaction with the malicious page, reflected in a CVSS score of 5.0 (AC:H/UI:R). No public exploit identified at time of analysis and an EPSS of 0.02% (6th percentile) indicate very low probability of widespread exploitation, though the technique is meaningful as a post-exploitation escalation primitive.
Universal Cross-Site Scripting (UXSS) in Google Chrome on iOS prior to 148.0.7778.216 enables a remote unauthenticated attacker to inject arbitrary scripts or HTML into the browser context by convincing a target user to perform specific UI gestures on a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's iOS-specific code layer (CWE-79), and while UXSS attacks typically carry cross-origin escalation potential, the CVSS S:U (Unchanged scope) rating suggests cross-origin impact is not confirmed by the scoring authority. No public exploit or active exploitation has been identified at time of analysis; EPSS at 0.06% places this in the 17th percentile of exploitation likelihood.
Cross-origin data leakage in Google Chrome's WebRTC component on Windows exposes limited confidential data to remote attackers via a race condition in all Chrome versions prior to 148.0.7778.216. An unauthenticated remote attacker (PR:N) can exploit this by luring a victim to a crafted HTML page, exploiting a timing window in WebRTC's concurrent execution to read cross-origin data. No public exploit has been identified at time of analysis and EPSS stands at 0.03% (9th percentile), indicating very low real-world exploitation pressure despite Chrome's internal 'High' severity classification.
Cross-origin data leakage in Google Chrome on iOS prior to 148.0.7778.216 exposes sensitive information from cross-origin resources to remote attackers via a crafted HTML page. The flaw is confined to Chrome's iOS-specific implementation (distinct from Chrome on Android, Windows, or macOS), meaning the affected population is limited to iOS users running unpatched Chrome builds. With a CVSS score of 4.3 (Medium), no CISA KEV listing, and an EPSS of 0.03% (11th percentile), no public exploit identified at time of analysis, this is a real but lower-priority disclosure issue - though the zero-privilege-required network vector merits timely patching.
Out-of-bounds read in Chrome's ANGLE graphics layer exposes process memory to remote attackers who can deliver a crafted HTML page to a victim. Unauthenticated (PR:N) remote exploitation is confirmed by the CVSS vector, though user interaction is required - the victim must open a malicious page. Confidentiality impact is rated High (C:H) with no integrity or availability consequence, making this a targeted information-disclosure primitive rather than a code-execution path. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.03% (11th percentile) reflects low observed exploitation pressure.
Same-origin policy bypass in Google Chrome for iOS (all versions prior to 148.0.7778.216) allows an attacker who has already achieved renderer process compromise to cross browser origin boundaries via a crafted HTML page, potentially exposing restricted cross-origin content. The root cause is insufficient validation of untrusted input (CWE-20) in iOS-specific Chrome code, a platform-divergent codepath not present in desktop Chrome. No public exploit has been identified and no CISA KEV listing exists; however, Chromium's internal 'High' severity rating contrasts with the NVD CVSS score of 3.1, reflecting that the renderer pre-compromise prerequisite substantially constrains standalone exploitability while the SOP bypass itself carries serious chaining potential.
Uninitialized use (CWE-457) in ANGLE, Chrome's graphics abstraction layer, exposes cross-origin data to attackers who have already compromised the renderer process in Google Chrome prior to 148.0.7778.216. Exploitation requires delivering a crafted HTML page to a victim who interacts with it, making this a post-compromise data exfiltration primitive rather than an initial access vector. The CVSS score of 3.1 and EPSS of 0.03% (11th percentile) are consistent with the constrained prerequisites; no public exploit code exists and no active exploitation has been confirmed.
Cross-origin data leakage in Google Chrome's WebGL implementation on Android affects all Chrome versions prior to 148.0.7778.216. The WebGL graphics subsystem performs an out-of-bounds read (CWE-125) when processing attacker-controlled content, exposing adjacent memory contents across origin boundaries to the initiating page. Remote unauthenticated attackers can trigger this condition by serving a crafted HTML page, but victim interaction is required - the user must visit the malicious page. No active exploitation is confirmed (not listed in CISA KEV), and EPSS of 0.03% (10th percentile) indicates low exploitation probability at time of analysis.
Uninitialized memory use in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome versions prior to 148.0.7778.216 enables a remote attacker - who has already achieved renderer process compromise - to bypass site isolation via a specially crafted HTML page. This is a chained exploitation scenario: the vulnerability is not standalone, but serves as a second-stage primitive to break Chrome's cross-origin security boundary once an initial renderer foothold exists. No public exploit code has been identified at time of analysis, and the EPSS score of 0.01% (3rd percentile) reflects minimal observed exploitation activity.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer affects all versions prior to 148.0.7778.216, enabling remote unauthenticated attackers (PR:N) to read cross-process memory contents via a crafted HTML page. The root cause is an uninitialized variable (CWE-457) in ANGLE - Chrome's OpenGL ES abstraction layer - where stale memory contents can be read and exfiltrated across security origins. No public exploit code has been identified at time of analysis and the EPSS score of 0.03% (11th percentile) indicates very low current exploitation probability; however, the low attack complexity (AC:L) and zero privilege requirement make opportunistic targeting feasible once exploitation techniques mature.
Out-of-bounds memory write in Dawn, Chrome's WebGPU implementation, affects Google Chrome on macOS prior to version 148.0.7778.216. Remote unauthenticated attackers (per CVSS PR:N) can trigger the write via a crafted HTML page requiring only a single user interaction - visiting a malicious site. The CVSS-scored impact is constrained to low integrity (I:L), with no confidentiality or availability impact confirmed, suggesting the write primitive is limited or difficult to weaponize for full code execution without chaining additional exploits. No public exploit identified at time of analysis and EPSS at 0.03% (11th percentile) indicates very low exploitation probability.
Cross-origin data leakage in Google Chrome's WebGL implementation on Android allows remote unauthenticated attackers to exfiltrate sensitive cross-origin content from a victim's browser session. Affected are all Chrome for Android releases prior to 148.0.7778.216. Exploitation requires the victim to visit a crafted HTML page, but no prior privileges or authentication are needed on the attacker's side. No public exploit identified at time of analysis and EPSS remains at 0.03%, indicating low automated or widespread exploitation pressure.
Cross-origin information disclosure in Google Chrome for Android allows a remote attacker to leak sensitive cross-origin data by luring a victim to a crafted HTML page that exploits uninitialized memory in the WebGL implementation. Affected are all Chrome for Android releases prior to 148.0.7778.216. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV), with EPSS at 0.03% (10th percentile) reflecting minimal current exploitation activity.
Cross-origin data disclosure in Google Chrome on Android (prior to 148.0.7778.216) stems from uninitialized GPU memory that a renderer-compromised attacker can read via a crafted HTML page. This is a second-stage, chained vulnerability - exploitation requires that the renderer process has already been compromised through a separate, unspecified vector. CVSS rates this Low (3.1) consistent with the constrained impact (C:L only) and high attack complexity; EPSS of 0.03% (11th percentile) confirms no public exploit identified at time of analysis.
Cross-origin data leakage in Google Chrome on Android (prior to 148.0.7778.216) via an out-of-bounds read in the WebGL rendering engine allows remote attackers to exfiltrate memory contents when a victim visits a crafted HTML page. The CVSS score of 4.3 (Medium) reflects a network-reachable, low-complexity attack requiring no privileges but dependent on user interaction, with confidentiality impact limited to partial disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS score of 0.03% (10th percentile) corroborates low active exploitation likelihood; however, the platform-specific scope (Android Chrome) and cross-origin data exposure potential make this relevant for organizations with mobile browser threat models.
Uninitialized memory exposure in the WebGL subsystem of Google Chrome on Android prior to 148.0.7778.216 allows unauthenticated remote attackers to read potentially sensitive data from browser process memory. Exploitation requires the victim to visit a specially crafted HTML page, placing this in the drive-by/social-engineering threat category rather than fully automated attacks. No public exploit code identified at time of analysis, and EPSS of 0.03% (10th percentile) reflects minimal current exploitation pressure despite the High CVSS confidentiality impact.
Out-of-bounds read in Google Chrome's ANGLE graphics abstraction layer (versions prior to 148.0.7778.216) allows remote unauthenticated attackers to potentially read limited memory contents from within the browser's process space when a user visits a crafted HTML page. The flaw originates from an inappropriate implementation within ANGLE's rendering pipeline - Chrome's cross-platform graphics engine - resulting in a CWE-125 out-of-bounds read condition with limited confidentiality impact (C:L) and no integrity or availability consequences. No public exploit code has been identified at time of analysis, and EPSS scores this at 0.03% (11th percentile), indicating very low real-world exploitation probability.
GPU memory disclosure in Google Chrome on Android (versions prior to 148.0.7778.216) exposes potentially sensitive process memory to unauthenticated remote attackers via crafted HTML pages. The root cause is an inappropriate implementation within Chrome's GPU subsystem on Android, classified as CWE-200, which permits out-of-bounds or unauthorized memory reads during rendering operations. No public exploit code exists and no active exploitation is confirmed; EPSS probability sits at a low 0.03%, though the Android-only scope and requirement for user interaction are the primary limiting factors rather than intrinsic exploitation difficulty.
Out-of-bounds memory read via integer overflow in Chrome's ANGLE graphics layer exposes limited memory contents to remote attackers who can lure victims to a malicious page. Affected are all Google Chrome versions prior to 148.0.7778.216 on desktop platforms. The vulnerability carries a CVSS score of 4.3 (Medium) with a confidentiality-only impact; no public exploit code exists and no active exploitation has been confirmed, with EPSS at 0.03% (11th percentile), placing real-world risk at low-to-moderate despite the network-accessible attack vector.
Out-of-bounds read in Chrome's ANGLE graphics layer exposes process memory contents to unauthenticated remote attackers who can lure a user to a crafted HTML page. All Google Chrome desktop versions prior to 148.0.7778.216 are affected, with the vulnerability carrying a CVSS 6.5 and exclusively a confidentiality impact - no integrity or availability loss. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (11th percentile) reflects low current exploitation activity, consistent with a typical Chrome graphics-component disclosure ahead of a stable channel patch.
Cross-origin data leakage in Google Chrome's Dawn WebGPU implementation on Windows affects all versions prior to 148.0.7778.216. The out-of-bounds read (CWE-125) in the Dawn graphics layer allows remote unauthenticated attackers to exfiltrate cross-origin data by enticing a user to visit a crafted HTML page, exploiting improper buffer boundary enforcement during GPU operations. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.03% (11th percentile) indicates very low automated exploitation likelihood, consistent with the moderate CVSS 4.3 score and required user interaction.
Site Isolation bypass in Google Chrome prior to 148.0.7778.216 enables a remote attacker - who has already compromised the renderer process - to escape cross-origin protections by delivering a crafted MHTML page. Rooted in CWE-20 (Improper Input Validation) within Chrome's Site Isolation subsystem, successful exploitation yields limited confidentiality, integrity, and availability impact across cross-origin content boundaries. No public exploit code has been identified and no CISA KEV listing exists; EPSS sits at 0.02% (6th percentile), consistent with a constrained, multi-prerequisite attack chain rather than widespread opportunistic exploitation.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (prior to 148.0.7778.216) allows unauthenticated remote attackers to read sensitive cross-origin information by luring a victim to a crafted HTML page. The root cause is an integer overflow in ANGLE, Chrome's graphics translation engine, which is internally rated Critical by the Chrome security team despite a CVSS score of only 4.3. No public exploit has been identified at time of analysis, and the EPSS exploitation probability is very low at 0.03% (11th percentile), though the cross-origin data leakage class of vulnerability has historically attracted targeted exploitation in browser ecosystems.
NULL pointer dereference in the Linux kernel's cros_ec_typec driver crashes the kernel when a Thunderbolt alternate mode operation is processed on affected ChromeOS devices. The flaw originates in cros_typec_register_thunderbolt(), which allocates the adata structure but omits mutex_init(&adata->lock); when cros_typec_altmode_work() later acquires that uninitialized mutex, the kernel dereferences a NULL or garbage pointer and panics. No public exploit code exists and EPSS of 0.02% (4th percentile) reflects the narrow hardware prerequisite and strictly local-only attack surface; the vulnerability is not listed in CISA KEV.
Authorization bypass in the Geo Mashup WordPress plugin (all versions ≤ 1.13.19) exposes sensitive plugin configuration data to unauthenticated remote attackers, including Google Maps API keys and GeoNames service credentials. The flaw (CWE-862 Missing Authorization) exists at specific request-handling code paths in geo-mashup.php (lines 515, 528, and 1525), where the plugin returns configuration data without verifying requester authorization. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no authentication, no complexity, and no user interaction required against any affected installation.
Authentication bypass in SpSoft AppLock 7.9.40 for Android allows a local attacker with physical device access to circumvent fingerprint or PIN protection and access locked applications such as Chrome. The flaw stems from the app's reliance on a custom UI overlay rather than enforcing authentication at a deeper system level - cascading interface navigation triggered via advertisement or browser intents exposes routes that allow the attacker to exit the lock screen without re-authenticating. No public exploitation (CISA KEV) has been confirmed, but a researcher-published proof-of-concept exists on GitHub, and EPSS is low at 0.04% (11th percentile), consistent with the physical-access requirement limiting opportunistic exploitation.
Bridge multicast MDB entry counter underflow in the Linux kernel's `net/bridge/br_multicast.c` allows local attackers with low privileges to trigger a kernel WARN_ON - and a system panic on hosts configured with `panic_on_warn=1` - by manipulating VLAN snooping state on a bridge interface before flushing multicast group entries. Multiple stable kernel branches are affected across all architectures that include the bridge multicast subsystem. No public exploit identified at time of analysis, with an EPSS score of 0.02% (5th percentile) confirming low exploitation probability; patches are available across kernel stable series 6.12, 6.6, 6.18, 6.19, and 7.0.
Stored Cross-Site Scripting in the Google+ Link Name WordPress plugin (versions up to and including 1.0) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'gplusnamelink' shortcode's 'id' and 'name' attributes. The root cause is the absence of WordPress output-escaping functions (esc_attr() or esc_html()) in the gplusnamelink_generate() function, permitting raw attribute values to be concatenated directly into rendered HTML. Scope is Changed (S:C) per CVSS, meaning the injected script executes in victims' browser sessions outside the plugin's own security context. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS score of 0.03% (9th percentile) reflects low observed exploitation probability.
Pre-Account Takeover in Chatwoot's OmniAuth integration affects all releases from 2.14.0 through 4.12.x, allowing an attacker who pre-registers a victim's email address to retain persistent login access after the legitimate owner authenticates via Google OAuth. The OAuth callback controller failed to invalidate attacker-set password credentials when confirming a pre-existing unconfirmed account, leaving the attacker's session viable indefinitely. No public exploit identified at time of analysis and EPSS is 0.04% (12th percentile), consistent with SSVC's 'Exploitation: none' finding, though SSVC rates technical impact as 'total' given the attacker gains full workspace access including PII, API keys, and conversation history.
Arbitrary JavaScript execution in SailingLab AppLock 4.3.8 for Android is triggered by a malicious co-installed app sending a crafted VIEW intent with a javascript: URI to the exposed BrowserMainActivity component. Because AppLock operates with elevated permissions by design (it restricts access to other apps), this unsafe WebView navigation path creates a changed-scope impact: script execution occurs within AppLock's privilege context, enabling UI spoofing and potential privilege escalation beyond what a normal app could achieve. No public exploit identified at time of analysis beyond the publicly available proof-of-concept published by the reporter on GitHub.
PIN lock bypass in Easyelife App Lock 1.9.2 for Android allows a local attacker with physical device access to reach applications that were supposedly secured behind a PIN. The root cause is architectural: the lock is implemented as a UI overlay rather than through Android's native secure authentication APIs (BiometricPrompt, KeyguardManager), meaning it can be circumvented by triggering advertisement or browser intents that cause the app to navigate cascading activity flows, effectively routing around the overlay. EPSS is very low at 0.05% (16th percentile), no public exploit is confirmed in CISA KEV, and a researcher disclosure with likely proof-of-concept steps is publicly available on GitHub.
PIN lock bypass in SailingLab AppLock 4.3.8 for Android exposes protected applications to anyone with brief physical device access. The root cause is architectural: the lock is implemented as a screen overlay rather than through Android's secure authentication APIs, meaning the underlying apps remain accessible via exposed intent routes triggered through advertisement or browser interactions. An attacker with physical access can navigate cascading UI flows to dismiss or circumvent the overlay entirely, gaining access to locked apps such as Chrome, resulting in information disclosure and unintended privilege escalation. No public exploit is confirmed in CISA KEV, but a researcher disclosure is publicly available on GitHub, and EPSS is negligible at 0.04% (11th percentile), consistent with the physical-access-only attack vector.
Physical-access PIN lock bypass in AppLockZ 4.2.11 for Android exposes protected applications to unauthorized access without valid credentials. The root cause is architectural: the lock mechanism is implemented as a UI overlay rather than through Android's secure authentication APIs, leaving it vulnerable to circumvention via exposed activity routes reachable through advertisement or browser intents. An attacker with physical possession of the device can navigate cascading interface flows to evade lockscreen verification and access apps protected by AppLockZ (e.g., Chrome), resulting in information disclosure. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.04% reflects minimal real-world exploitation probability at this time.
Missing capability check in GSheet For Woo Importer (WordPress plugin, all versions through 2.3.1) allows authenticated attackers with Subscriber-level access to invoke the process_ajax_restore_action() AJAX function and permanently delete the plugin's Google Sheets API token and associated configuration options. This disrupts WooCommerce product import workflows dependent on the Google Sheets integration. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Open ISES Tickets exposes a hardcoded Google Maps API key committed directly to its public GitHub source repository in tables.php, affecting all versions before 3.44.2. Any party with read access to the repository - effectively the entire internet - can extract the key and authenticate to Google Maps Platform as the application owner, generating API usage billed against the victim's Google Cloud project. No public exploit has been identified at time of analysis, but the SSVC framework rates this as automatable with partial technical impact, and the v3.44.2 release notes confirm the key is one of five hardcoded secrets removed in a batch of 88 security fixes.
Hardcoded Google Maps API key exposure in Open ISES Tickets before v3.44.2 enables any party with read access to the public GitHub repository to extract a valid API credential from settings.inc.php and issue arbitrary Google Maps Platform requests billed against the victim organization's Google Cloud project. All versions from the initial release up to (but not including) 3.44.2 are affected per CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but exploitation requires only the ability to read a publicly hosted source file - effectively zero technical barrier for any motivated actor.
Silent file download in RoboForm Password Manager for Android (Siber Systems, Inc.) can be triggered by a co-installed malicious application delivering a crafted Android Intent containing an attacker-controlled URL. RoboForm fails to validate the URL destination, request user confirmation, or surface any notification before fetching and writing remote content to the device. Reported by JPCERT (JVNVU93461473) with no CISA KEV listing and no public exploit identified at time of analysis, placing this in a moderate-low real-world risk category despite the sensitive nature of the affected product - a password manager.
Cross-origin data leakage in Google Chrome prior to 148.0.7778.179 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw stems from insufficient input validation (CWE-20) in Chrome's Input handling, enabling a crafted HTML page to exfiltrate data across origin boundaries. No active exploitation is confirmed - SSVC assigns exploitation status 'none' and the vulnerability is not listed in CISA KEV - but the confidentiality impact is rated High by CVSS, warranting prompt patching.
Out-of-bounds read in the GPU process of Google Chrome on macOS prior to 148.0.7778.179 exposes potentially sensitive data from process memory to remote attackers. Exploitation requires a victim to visit a crafted HTML page (CVSS UI:R), limiting automation potential - consistent with SSVC's 'Automatable: no' determination. No public exploit identified at time of analysis and CISA has not added this to the Known Exploited Vulnerabilities catalog; Chrome's own severity rating is Medium.
ServiceWorker policy enforcement failure in Google Chrome prior to version 148.0.7778.179 enables unauthenticated remote attackers to leak cross-origin data by luring a victim to a crafted HTML page. The vulnerability stems from Chrome's ServiceWorker layer failing to adequately enforce isolation boundaries (CWE-693), allowing a malicious origin to read data it should not have access to under the same-origin policy. No public exploit identified at time of analysis, and the CVSS score of 4.3 reflects limited confidentiality impact; however, the zero-privilege, network-accessible attack vector means any Chrome user browsing a malicious page could be affected.
Same-origin policy bypass in Google Chrome's Service Worker subsystem (all versions prior to 148.0.7778.179) allows remote unauthenticated attackers to read cross-origin data by luring a victim to a crafted HTML page. The flaw originates from insufficient policy enforcement (CWE-693) within the Service Worker layer, enabling unauthorized access to confidential data across origins. No public exploit code has been identified and no active exploitation is confirmed; Google has shipped a fix in stable channel version 148.0.7778.179.
Out-of-bounds memory read in the GPU component of Google Chrome on macOS exposes process memory to remote attackers via a crafted HTML page. Affected versions are all Chrome releases prior to 148.0.7778.179 on Mac; Windows and Linux are not identified as affected. No public exploit or active exploitation has been identified at time of analysis, and SSVC confirms exploitation status as none with non-automatable attack delivery.
UI spoofing in Google Chrome on Windows (prior to 148.0.7778.179) enables a remote attacker who has already achieved renderer process compromise to deceive end users through a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information). Affected users on Windows running any Chrome version below 148.0.7778.179 are exposed to potential phishing or credential-harvesting scenarios dressed up as legitimate browser UI. No public exploit code or CISA KEV listing exists at time of analysis, but the Chromium team assigned a Critical internal severity - a meaningful contrast with the NVD CVSS score of 4.2 - suggesting the spoofing potential carries downstream risk beyond what the base score reflects.
Source code disclosure in Nuxt's webpack and rspack dev server middleware enables a malicious website on the same local network to exfiltrate full application source code when developers run `nuxt dev --host`. The previous fix for GHSA-4gf7-ff8x-hq99 relied exclusively on Sec-Fetch-Mode and Sec-Fetch-Site headers, which browsers only send from potentially trustworthy origins (HTTPS or localhost) per the W3C Fetch Metadata specification - requests originating from plain HTTP pages on LAN omit these headers entirely, bypassing the same-origin check. A working proof-of-concept is embedded in the vendor advisory; no public exploit identified at time of analysis in CISA KEV.
Toolbar component spoofing in Firefox for Android allows a remote unauthenticated attacker to mislead users about the origin or security state of a web page, achieving high integrity impact without confidentiality or availability consequences. The vulnerability affects Firefox for Android versions prior to 151 and is classified under CWE-290 (Authentication Bypass by Spoofing), meaning the Toolbar UI element can be manipulated to present false trust signals. No public exploit exists and no active exploitation has been confirmed; Mozilla released a fix in Firefox 151, and the advisory is published at mfsa2026-46.
Cross-site scripting (XSS)-based spoofing in Microsoft Edge (Chromium-based) versions prior to 148.0.3967.70 allows remote unauthenticated attackers to inject and execute scripts within the browser context, manipulating rendered content or UI trust indicators to deceive users. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms low-complexity, network-reachable exploitation requiring only that a victim visit a malicious page. Impact is constrained to limited confidentiality and integrity loss (C:L/I:L/A:N), consistent with spoofing and credential-phishing scenarios rather than full system compromise. No public exploit identified at time of analysis and no CISA KEV listing.
Security feature bypass in Microsoft Edge (Chromium-based) versions prior to 148.0.3967.70 enables remote attackers to circumvent browser security controls through improper input validation (CWE-20), resulting in limited confidentiality and integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms exploitation is network-based, requires no attacker privileges, but demands user interaction - consistent with a browser-based attack requiring a victim to engage with malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis.
Google Drive for WordPress 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by injecting directory traversal sequences in the file_name. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Open redirect in SimpleSAMLphp casserver module allows remote attackers to redirect authenticated users to arbitrary external domains after logout. Versions prior to 6.3.1 and 7.0.0-rc1 through 7.0.0-rc2 are affected. The logout endpoint accepts an unchecked 'url' query parameter without validating it against configured service URLs, enabling phishing attacks that leverage the trusted SimpleSAML domain. Public exploit code exists (POC: YES). EPSS data not available, but exploitation requires only user interaction (no authentication), making this readily exploitable in phishing campaigns targeting SSO users.
Server-Side Request Forgery in @utcp/http <= 1.1.1 allows remote attackers to redirect tool invocations to internal services via malicious OpenAPI specs. An attacker hosting a malicious OpenAPI specification on a legitimate HTTPS endpoint can declare internal server URLs (e.g., http://127.0.0.1:9090 or http://169.254.169.254) in the servers array; the OpenApiConverter blindly trusts these URLs without revalidation during tool invocation, enabling access to cloud metadata endpoints, internal databases, and loopback services. Additionally, a prefix-bypass in hostname validation (startsWith check) allows URLs like http://localhost.evil.com to bypass discovery-time restrictions. Patch version 1.1.2 is available.
Open WebUI versions up to 0.8.8 expose admin-configured system prompts to authenticated regular (non-admin) users through the /api/models API endpoint, allowing information disclosure of sensitive model instructions and internal configuration details. The vulnerability requires valid user authentication but no administrative privileges, enabling any authenticated user to retrieve confidential system prompts via a simple HTTP GET request. This is confirmed actively exploited in production deployments with a publicly available proof-of-concept.
Discretionary access control bypass in Chrome Remote Desktop (Chromoting) allows adjacent network attackers to achieve limited confidentiality, integrity, and availability impact through a malicious file requiring user interaction. Google released Chrome 148.0.7778.168 to address this medium-severity flaw. EPSS score of 0.01% (1st percentile) and CISA SSVC assessment indicate low real-world exploitation probability with no observed exploitation activity. The adjacent network attack vector (AV:A) significantly constrains attacker positioning compared to typical remote vulnerabilities.
UI spoofing in Google Chrome on iOS (prior to 148.0.7778.168) enables a remote attacker - who has already compromised the renderer process - to manipulate browser interface elements via a crafted HTML page, potentially deceiving users into accepting false security prompts or disclosing information to spoofed dialogs. This is a chained, post-renderer-compromise technique classified CWE-451 (UI Misrepresentation of Critical Information), rated Medium by Google with CVSS 4.2. No public exploit code exists, EPSS stands at 0.06% (18th percentile), and CISA SSVC confirms no active exploitation, placing real-world risk well below the theoretical ceiling implied by the network attack vector.
WebXR policy enforcement failure in Google Chrome for Android (prior to 148.0.7778.168) enables a remote attacker who has already compromised the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage information-disclosure primitive, not a standalone initial-access vector - exploitation requires chaining with a prior renderer compromise. No active exploitation is confirmed: CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at 0.04% (14th percentile), collectively indicating low real-world exploitation pressure.
Process memory disclosure in Google Chrome's Dawn WebGPU engine (prior to 148.0.7778.168) allows a remote attacker to read potentially sensitive data from the renderer process by directing a victim to a crafted HTML page. The flaw stems from an object lifecycle mismanagement in the Dawn graphics layer, falling under CWE-664, and results in high confidentiality impact despite a moderate overall CVSS score due to high attack complexity and required user interaction. No public exploit code has been identified and SSVC assessment indicates no known exploitation activity, placing this in the 'monitor and patch' tier rather than emergency response.
Out-of-bounds memory write in Google Chrome's Skia graphics library (versions prior to 148.0.7778.168) enables attackers with an already-compromised renderer process to escalate privileges via malicious print files. This represents a sandbox escape vulnerability requiring high attack complexity and user interaction (printing or opening a crafted print file). While CVSS rates this 3.1 (Low), the real-world risk depends on the attacker already having achieved renderer compromise — making this a second-stage attack vector. No active exploitation confirmed (EPSS 0.05%, not in CISA KEV), but vendor patch available as of Chrome 148.0.7778.168.
Google Chrome on Linux versions prior to 148.0.7778.168 suffers from an out-of-bounds read vulnerability in GPU processing that enables cross-origin data leakage. An attacker who has already compromised the renderer process can craft malicious HTML to read sensitive memory beyond allocated bounds, exposing data from other origins that should be isolated by the browser's same-origin policy. EPSS exploitation probability is very low (0.03%, 10th percentile) and no active exploitation or public POC has been identified. Google rates this Medium severity and released patch 148.0.7778.168 to address the issue.
Cross-origin data leakage in Google Chrome on Linux and ChromeOS allows remote attackers to read sensitive data from other origins via malicious HTML pages exploiting flawed CORS implementation. Affects versions prior to 148.0.7778.168. Google released a patch in their May 2026 stable channel update. EPSS score of 0.03% (10th percentile) indicates low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). SSVC assessment indicates no current exploitation, non-automatable attack requiring user interaction, with partial technical impact limited to confidentiality breach.
Cross-origin data leakage in Google Chrome on Android allows compromised renderer processes to access sensitive information from other sites via malicious HTML pages. Affects Chrome versions prior to 148.0.7778.168 on Android platforms. Attack requires high complexity (user interaction with crafted content) and prior renderer compromise, limiting practical exploitation. EPSS score of 0.03% (10th percentile) and SSVC assessment indicating no active exploitation align with the limited real-world risk profile despite the cross-origin information disclosure capability.
Type confusion in V8, Chrome's JavaScript engine, exposes potentially sensitive process memory to remote attackers in all Chrome versions prior to 148.0.7778.168. Exploitation requires a victim to navigate to a specially crafted HTML page, after which the type confusion bug can be leveraged to read memory contents from the renderer process. No active exploitation is confirmed (not in CISA KEV), EPSS is extremely low at 0.03%, and SSVC classifies exploitation as none - placing real-world urgency in the routine patching tier despite the CVSS 6.5 rating.
Site Isolation bypass in Google Chrome prior to 148.0.7778.168 allows remote attackers who have already compromised the renderer process to access cross-site data via crafted HTML pages. The vulnerability affects Chrome's AI policy enforcement, enabling a second-stage attack after initial renderer compromise. Attack complexity is high, requiring both initial renderer compromise and user interaction. EPSS score of 0.02% indicates very low exploitation probability, and no active exploitation or public POC has been identified. Vendor patch is available in Chrome 148.0.7778.168.
Integer overflow in ANGLE, Chrome's graphics translation layer on Windows, enables out-of-bounds memory writes when processing crafted HTML pages in versions prior to 148.0.7778.168. The flaw is scoped to the Windows-specific ANGLE DirectX backend and requires a user to visit an attacker-controlled page, limiting automated exploitation. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.03% - corroborated by the SSVC assessment of no current exploitation and non-automatable attack path.
Insufficient policy enforcement in Google Chrome's Android payment implementation allows remote attackers to bypass access control restrictions through specially crafted HTML pages, affecting Chrome versions prior to 148.0.7778.168 on Android. The vulnerability requires user interaction (visiting a malicious page) but can be exploited remotely without authentication. EPSS exploitation probability is low (0.02%, 4th percentile), and a vendor-released patch is available. While tagged as an authentication bypass, the CVSS impact indicates only low integrity compromise with no confidentiality or availability impact.
UI spoofing in Google Chrome's Downloads component on macOS (versions prior to 148.0.7778.168) enables an attacker to misrepresent critical download-related interface elements to users who have been socially engineered into installing a malicious Chrome extension. The flaw stems from an inappropriate implementation (CWE-451) in how the Downloads feature handles extension-controlled rendering within trusted Chrome UI context, permitting a crafted extension to manipulate what users perceive about file origins or download safety prompts. No public exploit code is identified, EPSS is at 0.01% (3rd percentile), and CISA SSVC classifies exploitation status as none - indicating this is a real but low-operational-priority issue.
UI spoofing in Google Chrome's Downloads component on Android and macOS allows a remote, unauthenticated attacker to deceive users about the origin or safety of downloaded files by serving a crafted HTML page. All Chrome versions prior to 148.0.7778.168 on these two platforms are affected; Windows and Linux builds are not listed. No active exploitation has been identified - CISA KEV has no entry for this CVE, EPSS sits at 0.06% (18th percentile), and SSVC rates exploitation as none - placing this firmly in a low-urgency category despite the broad deployment footprint of the browser.
Navigation restrictions can be bypassed in Google Chrome for Windows versions prior to 148.0.7778.168 when attackers craft malicious HTML pages that exploit insufficient sandbox policy enforcement in iframe elements. User interaction (opening/visiting the crafted page) is required for exploitation. Google released a patched version addressing this medium-severity flaw. With EPSS exploitation probability at 0.02% (4th percentile) and no KEV listing, this represents a moderate-priority issue primarily affecting organizations running outdated Chrome versions on Windows systems.
Cross-origin data leakage in Google Chrome versions prior to 148.0.7778.168 enables remote attackers to extract sensitive information from other origins through side-channel attacks in the Navigation component. The vulnerability requires user interaction with a malicious HTML page and exploits timing or behavioral characteristics to bypass same-origin policy protections. EPSS score of 0.03% (10th percentile) indicates low observed exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis. Google has released a patch in Chrome 148.0.7778.168.
UI spoofing in Google Chrome's fullscreen mode exposes users to phishing and deception attacks via crafted HTML pages that manipulate security-critical browser UI elements. All Chrome desktop releases prior to 148.0.7778.168 are affected (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). No public exploit identified at time of analysis; EPSS at 0.06% (18th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation pressure despite Chrome's ubiquitous deployment footprint.
Out-of-bounds memory read in Google Chrome's SwiftShader software GPU rasterizer (versions prior to 148.0.7778.168 on macOS and iOS) exposes limited heap memory contents to a remote attacker who can lure a victim to a crafted HTML page. The root cause is a heap-based buffer overflow (CWE-122) in SwiftShader, Chrome's software fallback rasterizer, triggered during processing of malicious graphics content. No active exploitation is confirmed - CISA KEV is absent, EPSS sits at the 7th percentile (0.03%), and SSVC classifies exploitation as none - making this a low-urgency but patch-eligible finding for macOS and iOS Chrome deployments.
Out-of-bounds memory write in Google Chrome's Internationalization component on Windows allows remote unauthenticated attackers to corrupt process memory by luring a user to a crafted HTML page that triggers an integer overflow, affecting all Chrome versions prior to 148.0.7778.168. Google has rated this High severity internally, though the NVD CVSS scores it 4.3 Medium, reflecting a limited integrity-only impact in the current analysis. No public exploit has been identified at time of analysis; EPSS probability is negligible at 0.03% (7th percentile) and CISA SSVC classifies exploitation as none.
Cross-origin data leakage in Google Chrome on Windows via ANGLE graphics library allows renderer-compromised attackers to steal sensitive data from other origins through specially crafted web pages. Affects Chrome versions prior to 148.0.7778.168 on Windows platforms. EPSS probability of 0.03% (10th percentile) indicates low observed exploitation likelihood, with CISA SSVC confirming no active exploitation and non-automatable attack chain. Vendor patch released in Chrome 148.0.7778.168 stable channel update. Attack requires successful renderer process compromise as prerequisite, combined with user interaction, creating a chained exploitation scenario rather than standalone vulnerability.
Out-of-bounds memory write in Google Chrome's ANGLE graphics library (Windows only) enables attackers who have already compromised the renderer process to corrupt memory via specially crafted HTML pages. Chrome 148.0.7778.168 patches this type confusion vulnerability. Despite high Chromium severity rating, CVSS 3.1 scores only 3.1 due to prerequisite renderer compromise, high attack complexity, and required user interaction. EPSS 0.03% (10th percentile) and SSVC indicating no known exploitation suggest limited real-world risk at time of analysis.
Use-after-free in Chrome's GPU component prior to version 148.0.7778.168 enables an attacker who has already achieved renderer process compromise to perform out-of-bounds memory writes via a specially crafted HTML page. This is a second-stage exploit component embedded within a multi-step browser exploitation chain, requiring a pre-existing renderer foothold before the GPU flaw can be triggered. No active exploitation has been identified - CISA KEV is absent, EPSS probability stands at 0.03% (7th percentile), and SSVC rates exploitation as 'none' - and a vendor patch is confirmed available in Chrome 148.0.7778.168.
Heap buffer overflow in Chrome's GPU process on Android allows remote attackers to perform an out-of-bounds memory write by delivering a crafted HTML page, affecting all Chrome for Android versions prior to 148.0.7778.168. User interaction is required to trigger the vulnerability, and the assessed impact is limited to a partial integrity compromise within the browser's sandboxed GPU process. No public exploit code has been identified at time of analysis, EPSS sits at the 7th percentile, and CISA SSVC classifies exploitation as none - collectively indicating low near-term exploitation likelihood despite the network-facing attack vector.
Use-after-free in the Google Lens component of Chrome prior to 148.0.7778.168 enables memory disclosure from a multi-stage attack chain requiring prior renderer compromise. An attacker who has already subverted the renderer process can leverage a crafted HTML page to trigger the UAF condition in Lens, reading potentially sensitive data from process memory. This is a chained exploitation scenario - not standalone remote code execution - and while CVSS scores PR:N, the renderer prerequisite substantially narrows real-world exploitability. No public exploit code or CISA KEV listing has been identified; EPSS probability sits at 0.03%.
Out-of-bounds read in Chrome's GPU process on Mac and Windows exposes process memory to an attacker who has already compromised the renderer. Specifically, a crafted HTML page can be used to trigger the GPU component to read beyond valid memory bounds, leaking potentially sensitive data from GPU process memory. This is a second-stage, chained vulnerability - exploitation requires a pre-existing renderer compromise - and carries no KEV status and a very low EPSS score of 0.03%, indicating no observed widespread exploitation at time of analysis. Patch is available in Chrome 148.0.7778.168.
Cross-origin data leakage in Google Chrome versions prior to 148.0.7778.168 occurs when an attacker who has already compromised the renderer process exploits an object corruption flaw in the Compositing component. The vulnerability requires user interaction with a malicious HTML page and high attack complexity to leak sensitive cross-origin data. Google has released a patch in Chrome 148.0.7778.168, and with EPSS at 0.03% (10th percentile) and no evidence of active exploitation (SSVC: none), this represents a medium-priority targeted threat rather than widespread exploitation risk.
Out-of-bounds read in the FileSystem component of Google Chrome on macOS (prior to 148.0.7778.168) exposes process memory contents to a remote attacker via a crafted HTML page. Exploitation requires high attack complexity and a user to perform specific UI gestures, substantially constraining opportunistic mass exploitation. No public exploit code has been identified and EPSS sits at the 8th percentile; CISA has not listed this in KEV, and SSVC classifies exploitation status as none.
Out-of-bounds read in Google Chrome's UI component (versions prior to 148.0.7778.168) enables a remote attacker who has already compromised the renderer process to extract potentially sensitive data from process memory via a crafted HTML page. This is a second-stage exploitation primitive - not an initial access vector - requiring a pre-existing renderer compromise as a hard prerequisite. No public exploit code has been identified, EPSS sits at 0.03% (8th percentile), and SSVC rates exploitation status as none, collectively indicating low near-term exploitation probability despite the High confidentiality impact in the CVSS score.
Script injection in Google Chrome's SanitizerAPI on Android (versions prior to 148.0.7778.168) enables Universal Cross-Site Scripting (UXSS), allowing unauthenticated remote attackers to bypass same-origin policy protections via a crafted HTML page when visited by a victim. The Sanitizer API - ironically a defensive web platform feature designed to strip dangerous markup - contains a code injection flaw that permits injected scripts or HTML to survive sanitization. No active exploitation has been confirmed (not in CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC classifies exploitation as none; however, the UXSS impact class warrants prompt patching given Chrome's ubiquitous deployment footprint.
Denial of service in Google Chrome's GPU process prior to 148.0.7778.168 allows a remote attacker who has already compromised the renderer process to crash the browser by passing malformed input through a crafted HTML page. This is a chained, post-exploitation DoS - not a standalone attack - requiring a prior renderer breach as an explicit prerequisite. No public exploit code has been identified, CISA KEV does not list this CVE, and EPSS sits at 0.06%, all consistently signaling low real-world priority.
Google Chrome versions prior to 148.0.7778.168 leak cross-origin data through insufficient policy enforcement in the ViewTransitions API when users interact with specially crafted HTML pages. The vulnerability enables remote attackers to bypass same-origin policy protections and extract sensitive information from other origins without authentication, though exploitation requires user interaction (clicking a link or visiting a malicious page). With EPSS at 0.03% (10th percentile) and no confirmed active exploitation, this represents a moderate information disclosure risk primarily affecting organizations where targeted phishing could deliver malicious pages to Chrome users.
Site Isolation bypass in Google Chrome on macOS allows attackers who have already compromised the renderer process to leak limited cross-origin data via malicious HTML in ReadingMode. Affects Chrome versions prior to 148.0.7778.168 on Mac only. EPSS score of 0.02% (6th percentile) indicates very low predicted exploitation probability. No active exploitation detected (not in CISA KEV), no public POC identified. CVSS 3.1 assigns Low severity despite High vendor severity rating due to requiring both renderer compromise and user interaction, with impact limited to confidentiality only.
Out-of-bounds read in the Media component of Google Chrome on Linux and ChromeOS exposes sensitive process memory to a remote attacker who has already achieved renderer process compromise. Affected are all Chrome versions prior to 148.0.7778.168 on Linux and ChromeOS; Windows and macOS are explicitly excluded. No public exploit or active exploitation is identified - EPSS stands at 0.03% and SSVC exploitation status is confirmed none - but this functions as a high-value chaining primitive in multi-stage browser exploit chains.
Site Isolation bypass in Google Chrome versions prior to 148.0.7778.168 enables attackers who have already compromised the renderer process to break out of security sandboxes via specially crafted HTML pages. This represents an escalation path within Chrome's multi-process architecture, allowing cross-origin data access after initial renderer compromise. Vendor patch available as of May 2026 stable channel update. EPSS score of 0.02% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing or public POC exists at time of analysis, suggesting lower immediate priority despite the architectural significance of Site Isolation failures.
Memory disclosure in Google Chrome's DataTransfer component prior to version 148.0.7778.168 enables remote attackers to read potentially sensitive data from the browser's process memory by convincing a victim to perform specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. While Chromium's internal security team rated this Critical due to the high-confidentiality impact of process memory exposure, the NVD CVSS score of 5.3 reflects the significant exploitation barriers of high attack complexity and mandatory user interaction. No public exploit code exists, EPSS is 0.03% (8th percentile), and CISA has not added this to the KEV catalog, confirming no confirmed active exploitation at time of analysis.
Cleartext transmission of sensitive information in KDDI's Android parental-control app 'あんしんフィルター for au' (Anshin Filter for au) exposes communications to interception and modification by man-in-the-middle attackers. Versions prior to 4.9_b0003 transmit data over unencrypted channels, enabling an attacker with a privileged network position to read sensitive user data or tamper with app communications. Disclosed by JPCERT/CC (JVN#24167657), no public exploit code exists and CISA has not listed this in KEV; EPSS of 0.01% (3rd percentile) and SSVC exploitation status of 'none' confirm negligible current threat activity.
Improper certificate validation in Palo Alto Networks Prisma Access Agent versions below 26.2.1 on Android and Chrome OS exposes VPN sessions to man-in-the-middle interception by adjacent-network attackers. An attacker co-located on the same network segment can present any certificate for any domain issued by a trusted Certificate Authority - bypassing domain-specific validation - to intercept VPN tunnel traffic and capture sensitive device information. No public exploit code exists and no active exploitation has been confirmed (EPSS 0.00%, not in CISA KEV); however, a vendor patch is available at version 26.2.1 and should be prioritized for mobile and Chrome OS deployments.
Prisma Access Agent on Windows and macOS exposes sensitive configuration data and credentials to local low-privileged users through multiple information disclosure weaknesses. Palo Alto Networks has confirmed these vulnerabilities affect agent versions prior to 26.2.1; Linux, ChromeOS, Android, and iOS deployments are explicitly out of scope. No public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none, making this a low-urgency but real credential-hygiene risk on affected desktop platforms.
Local privilege escalation in Palo Alto Networks Prisma Access Agent (all versions prior to 26.2.1) allows any locally authenticated non-administrative user to elevate to root on macOS and Linux, or NT AUTHORITY\SYSTEM on Windows, by exploiting a flawed privilege management mechanism. Successful exploitation grants full control of the affected endpoint, enabling arbitrary code execution and unauthorized access to data restricted to privileged accounts. No public exploit exists and the vulnerability is absent from CISA KEV; however, SSVC rates technical impact as total, making patching a meaningful priority for multi-user and enterprise endpoint environments.
Site isolation bypass in Google Chrome prior to 148.0.7778.216 enables a remote attacker who has already compromised the renderer process to escape cross-origin boundaries via a crafted HTML page. The attack is constrained by a two-stage prerequisite: an existing renderer compromise plus user interaction with the malicious page, reflected in a CVSS score of 5.0 (AC:H/UI:R). No public exploit identified at time of analysis and an EPSS of 0.02% (6th percentile) indicate very low probability of widespread exploitation, though the technique is meaningful as a post-exploitation escalation primitive.
Universal Cross-Site Scripting (UXSS) in Google Chrome on iOS prior to 148.0.7778.216 enables a remote unauthenticated attacker to inject arbitrary scripts or HTML into the browser context by convincing a target user to perform specific UI gestures on a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's iOS-specific code layer (CWE-79), and while UXSS attacks typically carry cross-origin escalation potential, the CVSS S:U (Unchanged scope) rating suggests cross-origin impact is not confirmed by the scoring authority. No public exploit or active exploitation has been identified at time of analysis; EPSS at 0.06% places this in the 17th percentile of exploitation likelihood.
Cross-origin data leakage in Google Chrome's WebRTC component on Windows exposes limited confidential data to remote attackers via a race condition in all Chrome versions prior to 148.0.7778.216. An unauthenticated remote attacker (PR:N) can exploit this by luring a victim to a crafted HTML page, exploiting a timing window in WebRTC's concurrent execution to read cross-origin data. No public exploit has been identified at time of analysis and EPSS stands at 0.03% (9th percentile), indicating very low real-world exploitation pressure despite Chrome's internal 'High' severity classification.
Cross-origin data leakage in Google Chrome on iOS prior to 148.0.7778.216 exposes sensitive information from cross-origin resources to remote attackers via a crafted HTML page. The flaw is confined to Chrome's iOS-specific implementation (distinct from Chrome on Android, Windows, or macOS), meaning the affected population is limited to iOS users running unpatched Chrome builds. With a CVSS score of 4.3 (Medium), no CISA KEV listing, and an EPSS of 0.03% (11th percentile), no public exploit identified at time of analysis, this is a real but lower-priority disclosure issue - though the zero-privilege-required network vector merits timely patching.
Out-of-bounds read in Chrome's ANGLE graphics layer exposes process memory to remote attackers who can deliver a crafted HTML page to a victim. Unauthenticated (PR:N) remote exploitation is confirmed by the CVSS vector, though user interaction is required - the victim must open a malicious page. Confidentiality impact is rated High (C:H) with no integrity or availability consequence, making this a targeted information-disclosure primitive rather than a code-execution path. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.03% (11th percentile) reflects low observed exploitation pressure.
Same-origin policy bypass in Google Chrome for iOS (all versions prior to 148.0.7778.216) allows an attacker who has already achieved renderer process compromise to cross browser origin boundaries via a crafted HTML page, potentially exposing restricted cross-origin content. The root cause is insufficient validation of untrusted input (CWE-20) in iOS-specific Chrome code, a platform-divergent codepath not present in desktop Chrome. No public exploit has been identified and no CISA KEV listing exists; however, Chromium's internal 'High' severity rating contrasts with the NVD CVSS score of 3.1, reflecting that the renderer pre-compromise prerequisite substantially constrains standalone exploitability while the SOP bypass itself carries serious chaining potential.
Uninitialized use (CWE-457) in ANGLE, Chrome's graphics abstraction layer, exposes cross-origin data to attackers who have already compromised the renderer process in Google Chrome prior to 148.0.7778.216. Exploitation requires delivering a crafted HTML page to a victim who interacts with it, making this a post-compromise data exfiltration primitive rather than an initial access vector. The CVSS score of 3.1 and EPSS of 0.03% (11th percentile) are consistent with the constrained prerequisites; no public exploit code exists and no active exploitation has been confirmed.
Cross-origin data leakage in Google Chrome's WebGL implementation on Android affects all Chrome versions prior to 148.0.7778.216. The WebGL graphics subsystem performs an out-of-bounds read (CWE-125) when processing attacker-controlled content, exposing adjacent memory contents across origin boundaries to the initiating page. Remote unauthenticated attackers can trigger this condition by serving a crafted HTML page, but victim interaction is required - the user must visit the malicious page. No active exploitation is confirmed (not listed in CISA KEV), and EPSS of 0.03% (10th percentile) indicates low exploitation probability at time of analysis.
Uninitialized memory use in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome versions prior to 148.0.7778.216 enables a remote attacker - who has already achieved renderer process compromise - to bypass site isolation via a specially crafted HTML page. This is a chained exploitation scenario: the vulnerability is not standalone, but serves as a second-stage primitive to break Chrome's cross-origin security boundary once an initial renderer foothold exists. No public exploit code has been identified at time of analysis, and the EPSS score of 0.01% (3rd percentile) reflects minimal observed exploitation activity.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer affects all versions prior to 148.0.7778.216, enabling remote unauthenticated attackers (PR:N) to read cross-process memory contents via a crafted HTML page. The root cause is an uninitialized variable (CWE-457) in ANGLE - Chrome's OpenGL ES abstraction layer - where stale memory contents can be read and exfiltrated across security origins. No public exploit code has been identified at time of analysis and the EPSS score of 0.03% (11th percentile) indicates very low current exploitation probability; however, the low attack complexity (AC:L) and zero privilege requirement make opportunistic targeting feasible once exploitation techniques mature.
Out-of-bounds memory write in Dawn, Chrome's WebGPU implementation, affects Google Chrome on macOS prior to version 148.0.7778.216. Remote unauthenticated attackers (per CVSS PR:N) can trigger the write via a crafted HTML page requiring only a single user interaction - visiting a malicious site. The CVSS-scored impact is constrained to low integrity (I:L), with no confidentiality or availability impact confirmed, suggesting the write primitive is limited or difficult to weaponize for full code execution without chaining additional exploits. No public exploit identified at time of analysis and EPSS at 0.03% (11th percentile) indicates very low exploitation probability.
Cross-origin data leakage in Google Chrome's WebGL implementation on Android allows remote unauthenticated attackers to exfiltrate sensitive cross-origin content from a victim's browser session. Affected are all Chrome for Android releases prior to 148.0.7778.216. Exploitation requires the victim to visit a crafted HTML page, but no prior privileges or authentication are needed on the attacker's side. No public exploit identified at time of analysis and EPSS remains at 0.03%, indicating low automated or widespread exploitation pressure.
Cross-origin information disclosure in Google Chrome for Android allows a remote attacker to leak sensitive cross-origin data by luring a victim to a crafted HTML page that exploits uninitialized memory in the WebGL implementation. Affected are all Chrome for Android releases prior to 148.0.7778.216. No public exploit code exists and no active exploitation has been confirmed (not in CISA KEV), with EPSS at 0.03% (10th percentile) reflecting minimal current exploitation activity.
Cross-origin data disclosure in Google Chrome on Android (prior to 148.0.7778.216) stems from uninitialized GPU memory that a renderer-compromised attacker can read via a crafted HTML page. This is a second-stage, chained vulnerability - exploitation requires that the renderer process has already been compromised through a separate, unspecified vector. CVSS rates this Low (3.1) consistent with the constrained impact (C:L only) and high attack complexity; EPSS of 0.03% (11th percentile) confirms no public exploit identified at time of analysis.
Cross-origin data leakage in Google Chrome on Android (prior to 148.0.7778.216) via an out-of-bounds read in the WebGL rendering engine allows remote attackers to exfiltrate memory contents when a victim visits a crafted HTML page. The CVSS score of 4.3 (Medium) reflects a network-reachable, low-complexity attack requiring no privileges but dependent on user interaction, with confidentiality impact limited to partial disclosure. No public exploit code or CISA KEV listing has been identified at time of analysis, and an EPSS score of 0.03% (10th percentile) corroborates low active exploitation likelihood; however, the platform-specific scope (Android Chrome) and cross-origin data exposure potential make this relevant for organizations with mobile browser threat models.
Uninitialized memory exposure in the WebGL subsystem of Google Chrome on Android prior to 148.0.7778.216 allows unauthenticated remote attackers to read potentially sensitive data from browser process memory. Exploitation requires the victim to visit a specially crafted HTML page, placing this in the drive-by/social-engineering threat category rather than fully automated attacks. No public exploit code identified at time of analysis, and EPSS of 0.03% (10th percentile) reflects minimal current exploitation pressure despite the High CVSS confidentiality impact.
Out-of-bounds read in Google Chrome's ANGLE graphics abstraction layer (versions prior to 148.0.7778.216) allows remote unauthenticated attackers to potentially read limited memory contents from within the browser's process space when a user visits a crafted HTML page. The flaw originates from an inappropriate implementation within ANGLE's rendering pipeline - Chrome's cross-platform graphics engine - resulting in a CWE-125 out-of-bounds read condition with limited confidentiality impact (C:L) and no integrity or availability consequences. No public exploit code has been identified at time of analysis, and EPSS scores this at 0.03% (11th percentile), indicating very low real-world exploitation probability.
GPU memory disclosure in Google Chrome on Android (versions prior to 148.0.7778.216) exposes potentially sensitive process memory to unauthenticated remote attackers via crafted HTML pages. The root cause is an inappropriate implementation within Chrome's GPU subsystem on Android, classified as CWE-200, which permits out-of-bounds or unauthorized memory reads during rendering operations. No public exploit code exists and no active exploitation is confirmed; EPSS probability sits at a low 0.03%, though the Android-only scope and requirement for user interaction are the primary limiting factors rather than intrinsic exploitation difficulty.
Out-of-bounds memory read via integer overflow in Chrome's ANGLE graphics layer exposes limited memory contents to remote attackers who can lure victims to a malicious page. Affected are all Google Chrome versions prior to 148.0.7778.216 on desktop platforms. The vulnerability carries a CVSS score of 4.3 (Medium) with a confidentiality-only impact; no public exploit code exists and no active exploitation has been confirmed, with EPSS at 0.03% (11th percentile), placing real-world risk at low-to-moderate despite the network-accessible attack vector.
Out-of-bounds read in Chrome's ANGLE graphics layer exposes process memory contents to unauthenticated remote attackers who can lure a user to a crafted HTML page. All Google Chrome desktop versions prior to 148.0.7778.216 are affected, with the vulnerability carrying a CVSS 6.5 and exclusively a confidentiality impact - no integrity or availability loss. No public exploit code has been identified at time of analysis, and the EPSS score of 0.03% (11th percentile) reflects low current exploitation activity, consistent with a typical Chrome graphics-component disclosure ahead of a stable channel patch.
Cross-origin data leakage in Google Chrome's Dawn WebGPU implementation on Windows affects all versions prior to 148.0.7778.216. The out-of-bounds read (CWE-125) in the Dawn graphics layer allows remote unauthenticated attackers to exfiltrate cross-origin data by enticing a user to visit a crafted HTML page, exploiting improper buffer boundary enforcement during GPU operations. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.03% (11th percentile) indicates very low automated exploitation likelihood, consistent with the moderate CVSS 4.3 score and required user interaction.
Site Isolation bypass in Google Chrome prior to 148.0.7778.216 enables a remote attacker - who has already compromised the renderer process - to escape cross-origin protections by delivering a crafted MHTML page. Rooted in CWE-20 (Improper Input Validation) within Chrome's Site Isolation subsystem, successful exploitation yields limited confidentiality, integrity, and availability impact across cross-origin content boundaries. No public exploit code has been identified and no CISA KEV listing exists; EPSS sits at 0.02% (6th percentile), consistent with a constrained, multi-prerequisite attack chain rather than widespread opportunistic exploitation.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (prior to 148.0.7778.216) allows unauthenticated remote attackers to read sensitive cross-origin information by luring a victim to a crafted HTML page. The root cause is an integer overflow in ANGLE, Chrome's graphics translation engine, which is internally rated Critical by the Chrome security team despite a CVSS score of only 4.3. No public exploit has been identified at time of analysis, and the EPSS exploitation probability is very low at 0.03% (11th percentile), though the cross-origin data leakage class of vulnerability has historically attracted targeted exploitation in browser ecosystems.
NULL pointer dereference in the Linux kernel's cros_ec_typec driver crashes the kernel when a Thunderbolt alternate mode operation is processed on affected ChromeOS devices. The flaw originates in cros_typec_register_thunderbolt(), which allocates the adata structure but omits mutex_init(&adata->lock); when cros_typec_altmode_work() later acquires that uninitialized mutex, the kernel dereferences a NULL or garbage pointer and panics. No public exploit code exists and EPSS of 0.02% (4th percentile) reflects the narrow hardware prerequisite and strictly local-only attack surface; the vulnerability is not listed in CISA KEV.
Authorization bypass in the Geo Mashup WordPress plugin (all versions ≤ 1.13.19) exposes sensitive plugin configuration data to unauthenticated remote attackers, including Google Maps API keys and GeoNames service credentials. The flaw (CWE-862 Missing Authorization) exists at specific request-handling code paths in geo-mashup.php (lines 515, 528, and 1525), where the plugin returns configuration data without verifying requester authorization. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms this is trivially exploitable with no authentication, no complexity, and no user interaction required against any affected installation.
Authentication bypass in SpSoft AppLock 7.9.40 for Android allows a local attacker with physical device access to circumvent fingerprint or PIN protection and access locked applications such as Chrome. The flaw stems from the app's reliance on a custom UI overlay rather than enforcing authentication at a deeper system level - cascading interface navigation triggered via advertisement or browser intents exposes routes that allow the attacker to exit the lock screen without re-authenticating. No public exploitation (CISA KEV) has been confirmed, but a researcher-published proof-of-concept exists on GitHub, and EPSS is low at 0.04% (11th percentile), consistent with the physical-access requirement limiting opportunistic exploitation.
Bridge multicast MDB entry counter underflow in the Linux kernel's `net/bridge/br_multicast.c` allows local attackers with low privileges to trigger a kernel WARN_ON - and a system panic on hosts configured with `panic_on_warn=1` - by manipulating VLAN snooping state on a bridge interface before flushing multicast group entries. Multiple stable kernel branches are affected across all architectures that include the bridge multicast subsystem. No public exploit identified at time of analysis, with an EPSS score of 0.02% (5th percentile) confirming low exploitation probability; patches are available across kernel stable series 6.12, 6.6, 6.18, 6.19, and 7.0.
Stored Cross-Site Scripting in the Google+ Link Name WordPress plugin (versions up to and including 1.0) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'gplusnamelink' shortcode's 'id' and 'name' attributes. The root cause is the absence of WordPress output-escaping functions (esc_attr() or esc_html()) in the gplusnamelink_generate() function, permitting raw attribute values to be concatenated directly into rendered HTML. Scope is Changed (S:C) per CVSS, meaning the injected script executes in victims' browser sessions outside the plugin's own security context. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS score of 0.03% (9th percentile) reflects low observed exploitation probability.
Pre-Account Takeover in Chatwoot's OmniAuth integration affects all releases from 2.14.0 through 4.12.x, allowing an attacker who pre-registers a victim's email address to retain persistent login access after the legitimate owner authenticates via Google OAuth. The OAuth callback controller failed to invalidate attacker-set password credentials when confirming a pre-existing unconfirmed account, leaving the attacker's session viable indefinitely. No public exploit identified at time of analysis and EPSS is 0.04% (12th percentile), consistent with SSVC's 'Exploitation: none' finding, though SSVC rates technical impact as 'total' given the attacker gains full workspace access including PII, API keys, and conversation history.
Arbitrary JavaScript execution in SailingLab AppLock 4.3.8 for Android is triggered by a malicious co-installed app sending a crafted VIEW intent with a javascript: URI to the exposed BrowserMainActivity component. Because AppLock operates with elevated permissions by design (it restricts access to other apps), this unsafe WebView navigation path creates a changed-scope impact: script execution occurs within AppLock's privilege context, enabling UI spoofing and potential privilege escalation beyond what a normal app could achieve. No public exploit identified at time of analysis beyond the publicly available proof-of-concept published by the reporter on GitHub.
PIN lock bypass in Easyelife App Lock 1.9.2 for Android allows a local attacker with physical device access to reach applications that were supposedly secured behind a PIN. The root cause is architectural: the lock is implemented as a UI overlay rather than through Android's native secure authentication APIs (BiometricPrompt, KeyguardManager), meaning it can be circumvented by triggering advertisement or browser intents that cause the app to navigate cascading activity flows, effectively routing around the overlay. EPSS is very low at 0.05% (16th percentile), no public exploit is confirmed in CISA KEV, and a researcher disclosure with likely proof-of-concept steps is publicly available on GitHub.
PIN lock bypass in SailingLab AppLock 4.3.8 for Android exposes protected applications to anyone with brief physical device access. The root cause is architectural: the lock is implemented as a screen overlay rather than through Android's secure authentication APIs, meaning the underlying apps remain accessible via exposed intent routes triggered through advertisement or browser interactions. An attacker with physical access can navigate cascading UI flows to dismiss or circumvent the overlay entirely, gaining access to locked apps such as Chrome, resulting in information disclosure and unintended privilege escalation. No public exploit is confirmed in CISA KEV, but a researcher disclosure is publicly available on GitHub, and EPSS is negligible at 0.04% (11th percentile), consistent with the physical-access-only attack vector.
Physical-access PIN lock bypass in AppLockZ 4.2.11 for Android exposes protected applications to unauthorized access without valid credentials. The root cause is architectural: the lock mechanism is implemented as a UI overlay rather than through Android's secure authentication APIs, leaving it vulnerable to circumvention via exposed activity routes reachable through advertisement or browser intents. An attacker with physical possession of the device can navigate cascading interface flows to evade lockscreen verification and access apps protected by AppLockZ (e.g., Chrome), resulting in information disclosure. No active exploitation is confirmed in CISA KEV, and the EPSS score of 0.04% reflects minimal real-world exploitation probability at this time.
Missing capability check in GSheet For Woo Importer (WordPress plugin, all versions through 2.3.1) allows authenticated attackers with Subscriber-level access to invoke the process_ajax_restore_action() AJAX function and permanently delete the plugin's Google Sheets API token and associated configuration options. This disrupts WooCommerce product import workflows dependent on the Google Sheets integration. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Open ISES Tickets exposes a hardcoded Google Maps API key committed directly to its public GitHub source repository in tables.php, affecting all versions before 3.44.2. Any party with read access to the repository - effectively the entire internet - can extract the key and authenticate to Google Maps Platform as the application owner, generating API usage billed against the victim's Google Cloud project. No public exploit has been identified at time of analysis, but the SSVC framework rates this as automatable with partial technical impact, and the v3.44.2 release notes confirm the key is one of five hardcoded secrets removed in a batch of 88 security fixes.
Hardcoded Google Maps API key exposure in Open ISES Tickets before v3.44.2 enables any party with read access to the public GitHub repository to extract a valid API credential from settings.inc.php and issue arbitrary Google Maps Platform requests billed against the victim organization's Google Cloud project. All versions from the initial release up to (but not including) 3.44.2 are affected per CPE cpe:2.3:a:open_ises:tickets:*:*:*:*:*:*:*:*. No public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV, but exploitation requires only the ability to read a publicly hosted source file - effectively zero technical barrier for any motivated actor.
Silent file download in RoboForm Password Manager for Android (Siber Systems, Inc.) can be triggered by a co-installed malicious application delivering a crafted Android Intent containing an attacker-controlled URL. RoboForm fails to validate the URL destination, request user confirmation, or surface any notification before fetching and writing remote content to the device. Reported by JPCERT (JVNVU93461473) with no CISA KEV listing and no public exploit identified at time of analysis, placing this in a moderate-low real-world risk category despite the sensitive nature of the affected product - a password manager.
Cross-origin data leakage in Google Chrome prior to 148.0.7778.179 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw stems from insufficient input validation (CWE-20) in Chrome's Input handling, enabling a crafted HTML page to exfiltrate data across origin boundaries. No active exploitation is confirmed - SSVC assigns exploitation status 'none' and the vulnerability is not listed in CISA KEV - but the confidentiality impact is rated High by CVSS, warranting prompt patching.
Out-of-bounds read in the GPU process of Google Chrome on macOS prior to 148.0.7778.179 exposes potentially sensitive data from process memory to remote attackers. Exploitation requires a victim to visit a crafted HTML page (CVSS UI:R), limiting automation potential - consistent with SSVC's 'Automatable: no' determination. No public exploit identified at time of analysis and CISA has not added this to the Known Exploited Vulnerabilities catalog; Chrome's own severity rating is Medium.
ServiceWorker policy enforcement failure in Google Chrome prior to version 148.0.7778.179 enables unauthenticated remote attackers to leak cross-origin data by luring a victim to a crafted HTML page. The vulnerability stems from Chrome's ServiceWorker layer failing to adequately enforce isolation boundaries (CWE-693), allowing a malicious origin to read data it should not have access to under the same-origin policy. No public exploit identified at time of analysis, and the CVSS score of 4.3 reflects limited confidentiality impact; however, the zero-privilege, network-accessible attack vector means any Chrome user browsing a malicious page could be affected.
Same-origin policy bypass in Google Chrome's Service Worker subsystem (all versions prior to 148.0.7778.179) allows remote unauthenticated attackers to read cross-origin data by luring a victim to a crafted HTML page. The flaw originates from insufficient policy enforcement (CWE-693) within the Service Worker layer, enabling unauthorized access to confidential data across origins. No public exploit code has been identified and no active exploitation is confirmed; Google has shipped a fix in stable channel version 148.0.7778.179.
Out-of-bounds memory read in the GPU component of Google Chrome on macOS exposes process memory to remote attackers via a crafted HTML page. Affected versions are all Chrome releases prior to 148.0.7778.179 on Mac; Windows and Linux are not identified as affected. No public exploit or active exploitation has been identified at time of analysis, and SSVC confirms exploitation status as none with non-automatable attack delivery.
UI spoofing in Google Chrome on Windows (prior to 148.0.7778.179) enables a remote attacker who has already achieved renderer process compromise to deceive end users through a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information). Affected users on Windows running any Chrome version below 148.0.7778.179 are exposed to potential phishing or credential-harvesting scenarios dressed up as legitimate browser UI. No public exploit code or CISA KEV listing exists at time of analysis, but the Chromium team assigned a Critical internal severity - a meaningful contrast with the NVD CVSS score of 4.2 - suggesting the spoofing potential carries downstream risk beyond what the base score reflects.
Source code disclosure in Nuxt's webpack and rspack dev server middleware enables a malicious website on the same local network to exfiltrate full application source code when developers run `nuxt dev --host`. The previous fix for GHSA-4gf7-ff8x-hq99 relied exclusively on Sec-Fetch-Mode and Sec-Fetch-Site headers, which browsers only send from potentially trustworthy origins (HTTPS or localhost) per the W3C Fetch Metadata specification - requests originating from plain HTTP pages on LAN omit these headers entirely, bypassing the same-origin check. A working proof-of-concept is embedded in the vendor advisory; no public exploit identified at time of analysis in CISA KEV.
Toolbar component spoofing in Firefox for Android allows a remote unauthenticated attacker to mislead users about the origin or security state of a web page, achieving high integrity impact without confidentiality or availability consequences. The vulnerability affects Firefox for Android versions prior to 151 and is classified under CWE-290 (Authentication Bypass by Spoofing), meaning the Toolbar UI element can be manipulated to present false trust signals. No public exploit exists and no active exploitation has been confirmed; Mozilla released a fix in Firefox 151, and the advisory is published at mfsa2026-46.
Cross-site scripting (XSS)-based spoofing in Microsoft Edge (Chromium-based) versions prior to 148.0.3967.70 allows remote unauthenticated attackers to inject and execute scripts within the browser context, manipulating rendered content or UI trust indicators to deceive users. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms low-complexity, network-reachable exploitation requiring only that a victim visit a malicious page. Impact is constrained to limited confidentiality and integrity loss (C:L/I:L/A:N), consistent with spoofing and credential-phishing scenarios rather than full system compromise. No public exploit identified at time of analysis and no CISA KEV listing.
Security feature bypass in Microsoft Edge (Chromium-based) versions prior to 148.0.3967.70 enables remote attackers to circumvent browser security controls through improper input validation (CWE-20), resulting in limited confidentiality and integrity compromise. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms exploitation is network-based, requires no attacker privileges, but demands user interaction - consistent with a browser-based attack requiring a victim to engage with malicious content. No public exploit code or CISA KEV listing has been identified at time of analysis.
Google Drive for WordPress 2.2 contains a path traversal vulnerability that allows unauthenticated attackers to read arbitrary files by injecting directory traversal sequences in the file_name. Rated high severity (CVSS 8.7), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Open redirect in SimpleSAMLphp casserver module allows remote attackers to redirect authenticated users to arbitrary external domains after logout. Versions prior to 6.3.1 and 7.0.0-rc1 through 7.0.0-rc2 are affected. The logout endpoint accepts an unchecked 'url' query parameter without validating it against configured service URLs, enabling phishing attacks that leverage the trusted SimpleSAML domain. Public exploit code exists (POC: YES). EPSS data not available, but exploitation requires only user interaction (no authentication), making this readily exploitable in phishing campaigns targeting SSO users.
Server-Side Request Forgery in @utcp/http <= 1.1.1 allows remote attackers to redirect tool invocations to internal services via malicious OpenAPI specs. An attacker hosting a malicious OpenAPI specification on a legitimate HTTPS endpoint can declare internal server URLs (e.g., http://127.0.0.1:9090 or http://169.254.169.254) in the servers array; the OpenApiConverter blindly trusts these URLs without revalidation during tool invocation, enabling access to cloud metadata endpoints, internal databases, and loopback services. Additionally, a prefix-bypass in hostname validation (startsWith check) allows URLs like http://localhost.evil.com to bypass discovery-time restrictions. Patch version 1.1.2 is available.
Open WebUI versions up to 0.8.8 expose admin-configured system prompts to authenticated regular (non-admin) users through the /api/models API endpoint, allowing information disclosure of sensitive model instructions and internal configuration details. The vulnerability requires valid user authentication but no administrative privileges, enabling any authenticated user to retrieve confidential system prompts via a simple HTTP GET request. This is confirmed actively exploited in production deployments with a publicly available proof-of-concept.
Discretionary access control bypass in Chrome Remote Desktop (Chromoting) allows adjacent network attackers to achieve limited confidentiality, integrity, and availability impact through a malicious file requiring user interaction. Google released Chrome 148.0.7778.168 to address this medium-severity flaw. EPSS score of 0.01% (1st percentile) and CISA SSVC assessment indicate low real-world exploitation probability with no observed exploitation activity. The adjacent network attack vector (AV:A) significantly constrains attacker positioning compared to typical remote vulnerabilities.
UI spoofing in Google Chrome on iOS (prior to 148.0.7778.168) enables a remote attacker - who has already compromised the renderer process - to manipulate browser interface elements via a crafted HTML page, potentially deceiving users into accepting false security prompts or disclosing information to spoofed dialogs. This is a chained, post-renderer-compromise technique classified CWE-451 (UI Misrepresentation of Critical Information), rated Medium by Google with CVSS 4.2. No public exploit code exists, EPSS stands at 0.06% (18th percentile), and CISA SSVC confirms no active exploitation, placing real-world risk well below the theoretical ceiling implied by the network attack vector.
WebXR policy enforcement failure in Google Chrome for Android (prior to 148.0.7778.168) enables a remote attacker who has already compromised the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage information-disclosure primitive, not a standalone initial-access vector - exploitation requires chaining with a prior renderer compromise. No active exploitation is confirmed: CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at 0.04% (14th percentile), collectively indicating low real-world exploitation pressure.
Process memory disclosure in Google Chrome's Dawn WebGPU engine (prior to 148.0.7778.168) allows a remote attacker to read potentially sensitive data from the renderer process by directing a victim to a crafted HTML page. The flaw stems from an object lifecycle mismanagement in the Dawn graphics layer, falling under CWE-664, and results in high confidentiality impact despite a moderate overall CVSS score due to high attack complexity and required user interaction. No public exploit code has been identified and SSVC assessment indicates no known exploitation activity, placing this in the 'monitor and patch' tier rather than emergency response.
Out-of-bounds memory write in Google Chrome's Skia graphics library (versions prior to 148.0.7778.168) enables attackers with an already-compromised renderer process to escalate privileges via malicious print files. This represents a sandbox escape vulnerability requiring high attack complexity and user interaction (printing or opening a crafted print file). While CVSS rates this 3.1 (Low), the real-world risk depends on the attacker already having achieved renderer compromise — making this a second-stage attack vector. No active exploitation confirmed (EPSS 0.05%, not in CISA KEV), but vendor patch available as of Chrome 148.0.7778.168.
Google Chrome on Linux versions prior to 148.0.7778.168 suffers from an out-of-bounds read vulnerability in GPU processing that enables cross-origin data leakage. An attacker who has already compromised the renderer process can craft malicious HTML to read sensitive memory beyond allocated bounds, exposing data from other origins that should be isolated by the browser's same-origin policy. EPSS exploitation probability is very low (0.03%, 10th percentile) and no active exploitation or public POC has been identified. Google rates this Medium severity and released patch 148.0.7778.168 to address the issue.
Cross-origin data leakage in Google Chrome on Linux and ChromeOS allows remote attackers to read sensitive data from other origins via malicious HTML pages exploiting flawed CORS implementation. Affects versions prior to 148.0.7778.168. Google released a patch in their May 2026 stable channel update. EPSS score of 0.03% (10th percentile) indicates low observed exploitation probability. No active exploitation confirmed (not in CISA KEV). SSVC assessment indicates no current exploitation, non-automatable attack requiring user interaction, with partial technical impact limited to confidentiality breach.
Cross-origin data leakage in Google Chrome on Android allows compromised renderer processes to access sensitive information from other sites via malicious HTML pages. Affects Chrome versions prior to 148.0.7778.168 on Android platforms. Attack requires high complexity (user interaction with crafted content) and prior renderer compromise, limiting practical exploitation. EPSS score of 0.03% (10th percentile) and SSVC assessment indicating no active exploitation align with the limited real-world risk profile despite the cross-origin information disclosure capability.
Type confusion in V8, Chrome's JavaScript engine, exposes potentially sensitive process memory to remote attackers in all Chrome versions prior to 148.0.7778.168. Exploitation requires a victim to navigate to a specially crafted HTML page, after which the type confusion bug can be leveraged to read memory contents from the renderer process. No active exploitation is confirmed (not in CISA KEV), EPSS is extremely low at 0.03%, and SSVC classifies exploitation as none - placing real-world urgency in the routine patching tier despite the CVSS 6.5 rating.
Site Isolation bypass in Google Chrome prior to 148.0.7778.168 allows remote attackers who have already compromised the renderer process to access cross-site data via crafted HTML pages. The vulnerability affects Chrome's AI policy enforcement, enabling a second-stage attack after initial renderer compromise. Attack complexity is high, requiring both initial renderer compromise and user interaction. EPSS score of 0.02% indicates very low exploitation probability, and no active exploitation or public POC has been identified. Vendor patch is available in Chrome 148.0.7778.168.
Integer overflow in ANGLE, Chrome's graphics translation layer on Windows, enables out-of-bounds memory writes when processing crafted HTML pages in versions prior to 148.0.7778.168. The flaw is scoped to the Windows-specific ANGLE DirectX backend and requires a user to visit an attacker-controlled page, limiting automated exploitation. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.03% - corroborated by the SSVC assessment of no current exploitation and non-automatable attack path.
Insufficient policy enforcement in Google Chrome's Android payment implementation allows remote attackers to bypass access control restrictions through specially crafted HTML pages, affecting Chrome versions prior to 148.0.7778.168 on Android. The vulnerability requires user interaction (visiting a malicious page) but can be exploited remotely without authentication. EPSS exploitation probability is low (0.02%, 4th percentile), and a vendor-released patch is available. While tagged as an authentication bypass, the CVSS impact indicates only low integrity compromise with no confidentiality or availability impact.
UI spoofing in Google Chrome's Downloads component on macOS (versions prior to 148.0.7778.168) enables an attacker to misrepresent critical download-related interface elements to users who have been socially engineered into installing a malicious Chrome extension. The flaw stems from an inappropriate implementation (CWE-451) in how the Downloads feature handles extension-controlled rendering within trusted Chrome UI context, permitting a crafted extension to manipulate what users perceive about file origins or download safety prompts. No public exploit code is identified, EPSS is at 0.01% (3rd percentile), and CISA SSVC classifies exploitation status as none - indicating this is a real but low-operational-priority issue.
UI spoofing in Google Chrome's Downloads component on Android and macOS allows a remote, unauthenticated attacker to deceive users about the origin or safety of downloaded files by serving a crafted HTML page. All Chrome versions prior to 148.0.7778.168 on these two platforms are affected; Windows and Linux builds are not listed. No active exploitation has been identified - CISA KEV has no entry for this CVE, EPSS sits at 0.06% (18th percentile), and SSVC rates exploitation as none - placing this firmly in a low-urgency category despite the broad deployment footprint of the browser.
Navigation restrictions can be bypassed in Google Chrome for Windows versions prior to 148.0.7778.168 when attackers craft malicious HTML pages that exploit insufficient sandbox policy enforcement in iframe elements. User interaction (opening/visiting the crafted page) is required for exploitation. Google released a patched version addressing this medium-severity flaw. With EPSS exploitation probability at 0.02% (4th percentile) and no KEV listing, this represents a moderate-priority issue primarily affecting organizations running outdated Chrome versions on Windows systems.
Cross-origin data leakage in Google Chrome versions prior to 148.0.7778.168 enables remote attackers to extract sensitive information from other origins through side-channel attacks in the Navigation component. The vulnerability requires user interaction with a malicious HTML page and exploits timing or behavioral characteristics to bypass same-origin policy protections. EPSS score of 0.03% (10th percentile) indicates low observed exploitation probability, and no active exploitation or public proof-of-concept has been identified at time of analysis. Google has released a patch in Chrome 148.0.7778.168.
UI spoofing in Google Chrome's fullscreen mode exposes users to phishing and deception attacks via crafted HTML pages that manipulate security-critical browser UI elements. All Chrome desktop releases prior to 148.0.7778.168 are affected (CPE: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*). No public exploit identified at time of analysis; EPSS at 0.06% (18th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world exploitation pressure despite Chrome's ubiquitous deployment footprint.
Out-of-bounds memory read in Google Chrome's SwiftShader software GPU rasterizer (versions prior to 148.0.7778.168 on macOS and iOS) exposes limited heap memory contents to a remote attacker who can lure a victim to a crafted HTML page. The root cause is a heap-based buffer overflow (CWE-122) in SwiftShader, Chrome's software fallback rasterizer, triggered during processing of malicious graphics content. No active exploitation is confirmed - CISA KEV is absent, EPSS sits at the 7th percentile (0.03%), and SSVC classifies exploitation as none - making this a low-urgency but patch-eligible finding for macOS and iOS Chrome deployments.
Out-of-bounds memory write in Google Chrome's Internationalization component on Windows allows remote unauthenticated attackers to corrupt process memory by luring a user to a crafted HTML page that triggers an integer overflow, affecting all Chrome versions prior to 148.0.7778.168. Google has rated this High severity internally, though the NVD CVSS scores it 4.3 Medium, reflecting a limited integrity-only impact in the current analysis. No public exploit has been identified at time of analysis; EPSS probability is negligible at 0.03% (7th percentile) and CISA SSVC classifies exploitation as none.
Cross-origin data leakage in Google Chrome on Windows via ANGLE graphics library allows renderer-compromised attackers to steal sensitive data from other origins through specially crafted web pages. Affects Chrome versions prior to 148.0.7778.168 on Windows platforms. EPSS probability of 0.03% (10th percentile) indicates low observed exploitation likelihood, with CISA SSVC confirming no active exploitation and non-automatable attack chain. Vendor patch released in Chrome 148.0.7778.168 stable channel update. Attack requires successful renderer process compromise as prerequisite, combined with user interaction, creating a chained exploitation scenario rather than standalone vulnerability.
Out-of-bounds memory write in Google Chrome's ANGLE graphics library (Windows only) enables attackers who have already compromised the renderer process to corrupt memory via specially crafted HTML pages. Chrome 148.0.7778.168 patches this type confusion vulnerability. Despite high Chromium severity rating, CVSS 3.1 scores only 3.1 due to prerequisite renderer compromise, high attack complexity, and required user interaction. EPSS 0.03% (10th percentile) and SSVC indicating no known exploitation suggest limited real-world risk at time of analysis.
Use-after-free in Chrome's GPU component prior to version 148.0.7778.168 enables an attacker who has already achieved renderer process compromise to perform out-of-bounds memory writes via a specially crafted HTML page. This is a second-stage exploit component embedded within a multi-step browser exploitation chain, requiring a pre-existing renderer foothold before the GPU flaw can be triggered. No active exploitation has been identified - CISA KEV is absent, EPSS probability stands at 0.03% (7th percentile), and SSVC rates exploitation as 'none' - and a vendor patch is confirmed available in Chrome 148.0.7778.168.
Heap buffer overflow in Chrome's GPU process on Android allows remote attackers to perform an out-of-bounds memory write by delivering a crafted HTML page, affecting all Chrome for Android versions prior to 148.0.7778.168. User interaction is required to trigger the vulnerability, and the assessed impact is limited to a partial integrity compromise within the browser's sandboxed GPU process. No public exploit code has been identified at time of analysis, EPSS sits at the 7th percentile, and CISA SSVC classifies exploitation as none - collectively indicating low near-term exploitation likelihood despite the network-facing attack vector.
Use-after-free in the Google Lens component of Chrome prior to 148.0.7778.168 enables memory disclosure from a multi-stage attack chain requiring prior renderer compromise. An attacker who has already subverted the renderer process can leverage a crafted HTML page to trigger the UAF condition in Lens, reading potentially sensitive data from process memory. This is a chained exploitation scenario - not standalone remote code execution - and while CVSS scores PR:N, the renderer prerequisite substantially narrows real-world exploitability. No public exploit code or CISA KEV listing has been identified; EPSS probability sits at 0.03%.
Out-of-bounds read in Chrome's GPU process on Mac and Windows exposes process memory to an attacker who has already compromised the renderer. Specifically, a crafted HTML page can be used to trigger the GPU component to read beyond valid memory bounds, leaking potentially sensitive data from GPU process memory. This is a second-stage, chained vulnerability - exploitation requires a pre-existing renderer compromise - and carries no KEV status and a very low EPSS score of 0.03%, indicating no observed widespread exploitation at time of analysis. Patch is available in Chrome 148.0.7778.168.
Cross-origin data leakage in Google Chrome versions prior to 148.0.7778.168 occurs when an attacker who has already compromised the renderer process exploits an object corruption flaw in the Compositing component. The vulnerability requires user interaction with a malicious HTML page and high attack complexity to leak sensitive cross-origin data. Google has released a patch in Chrome 148.0.7778.168, and with EPSS at 0.03% (10th percentile) and no evidence of active exploitation (SSVC: none), this represents a medium-priority targeted threat rather than widespread exploitation risk.
Out-of-bounds read in the FileSystem component of Google Chrome on macOS (prior to 148.0.7778.168) exposes process memory contents to a remote attacker via a crafted HTML page. Exploitation requires high attack complexity and a user to perform specific UI gestures, substantially constraining opportunistic mass exploitation. No public exploit code has been identified and EPSS sits at the 8th percentile; CISA has not listed this in KEV, and SSVC classifies exploitation status as none.
Out-of-bounds read in Google Chrome's UI component (versions prior to 148.0.7778.168) enables a remote attacker who has already compromised the renderer process to extract potentially sensitive data from process memory via a crafted HTML page. This is a second-stage exploitation primitive - not an initial access vector - requiring a pre-existing renderer compromise as a hard prerequisite. No public exploit code has been identified, EPSS sits at 0.03% (8th percentile), and SSVC rates exploitation status as none, collectively indicating low near-term exploitation probability despite the High confidentiality impact in the CVSS score.
Script injection in Google Chrome's SanitizerAPI on Android (versions prior to 148.0.7778.168) enables Universal Cross-Site Scripting (UXSS), allowing unauthenticated remote attackers to bypass same-origin policy protections via a crafted HTML page when visited by a victim. The Sanitizer API - ironically a defensive web platform feature designed to strip dangerous markup - contains a code injection flaw that permits injected scripts or HTML to survive sanitization. No active exploitation has been confirmed (not in CISA KEV), EPSS stands at 0.03% (7th percentile), and SSVC classifies exploitation as none; however, the UXSS impact class warrants prompt patching given Chrome's ubiquitous deployment footprint.
Denial of service in Google Chrome's GPU process prior to 148.0.7778.168 allows a remote attacker who has already compromised the renderer process to crash the browser by passing malformed input through a crafted HTML page. This is a chained, post-exploitation DoS - not a standalone attack - requiring a prior renderer breach as an explicit prerequisite. No public exploit code has been identified, CISA KEV does not list this CVE, and EPSS sits at 0.06%, all consistently signaling low real-world priority.
Google Chrome versions prior to 148.0.7778.168 leak cross-origin data through insufficient policy enforcement in the ViewTransitions API when users interact with specially crafted HTML pages. The vulnerability enables remote attackers to bypass same-origin policy protections and extract sensitive information from other origins without authentication, though exploitation requires user interaction (clicking a link or visiting a malicious page). With EPSS at 0.03% (10th percentile) and no confirmed active exploitation, this represents a moderate information disclosure risk primarily affecting organizations where targeted phishing could deliver malicious pages to Chrome users.
Site Isolation bypass in Google Chrome on macOS allows attackers who have already compromised the renderer process to leak limited cross-origin data via malicious HTML in ReadingMode. Affects Chrome versions prior to 148.0.7778.168 on Mac only. EPSS score of 0.02% (6th percentile) indicates very low predicted exploitation probability. No active exploitation detected (not in CISA KEV), no public POC identified. CVSS 3.1 assigns Low severity despite High vendor severity rating due to requiring both renderer compromise and user interaction, with impact limited to confidentiality only.
Out-of-bounds read in the Media component of Google Chrome on Linux and ChromeOS exposes sensitive process memory to a remote attacker who has already achieved renderer process compromise. Affected are all Chrome versions prior to 148.0.7778.168 on Linux and ChromeOS; Windows and macOS are explicitly excluded. No public exploit or active exploitation is identified - EPSS stands at 0.03% and SSVC exploitation status is confirmed none - but this functions as a high-value chaining primitive in multi-stage browser exploit chains.
Site Isolation bypass in Google Chrome versions prior to 148.0.7778.168 enables attackers who have already compromised the renderer process to break out of security sandboxes via specially crafted HTML pages. This represents an escalation path within Chrome's multi-process architecture, allowing cross-origin data access after initial renderer compromise. Vendor patch available as of May 2026 stable channel update. EPSS score of 0.02% (6th percentile) indicates minimal observed exploitation activity, and no CISA KEV listing or public POC exists at time of analysis, suggesting lower immediate priority despite the architectural significance of Site Isolation failures.
Memory disclosure in Google Chrome's DataTransfer component prior to version 148.0.7778.168 enables remote attackers to read potentially sensitive data from the browser's process memory by convincing a victim to perform specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. While Chromium's internal security team rated this Critical due to the high-confidentiality impact of process memory exposure, the NVD CVSS score of 5.3 reflects the significant exploitation barriers of high attack complexity and mandatory user interaction. No public exploit code exists, EPSS is 0.03% (8th percentile), and CISA has not added this to the KEV catalog, confirming no confirmed active exploitation at time of analysis.
Cleartext transmission of sensitive information in KDDI's Android parental-control app 'あんしんフィルター for au' (Anshin Filter for au) exposes communications to interception and modification by man-in-the-middle attackers. Versions prior to 4.9_b0003 transmit data over unencrypted channels, enabling an attacker with a privileged network position to read sensitive user data or tamper with app communications. Disclosed by JPCERT/CC (JVN#24167657), no public exploit code exists and CISA has not listed this in KEV; EPSS of 0.01% (3rd percentile) and SSVC exploitation status of 'none' confirm negligible current threat activity.
Improper certificate validation in Palo Alto Networks Prisma Access Agent versions below 26.2.1 on Android and Chrome OS exposes VPN sessions to man-in-the-middle interception by adjacent-network attackers. An attacker co-located on the same network segment can present any certificate for any domain issued by a trusted Certificate Authority - bypassing domain-specific validation - to intercept VPN tunnel traffic and capture sensitive device information. No public exploit code exists and no active exploitation has been confirmed (EPSS 0.00%, not in CISA KEV); however, a vendor patch is available at version 26.2.1 and should be prioritized for mobile and Chrome OS deployments.
Prisma Access Agent on Windows and macOS exposes sensitive configuration data and credentials to local low-privileged users through multiple information disclosure weaknesses. Palo Alto Networks has confirmed these vulnerabilities affect agent versions prior to 26.2.1; Linux, ChromeOS, Android, and iOS deployments are explicitly out of scope. No public exploit has been identified at time of analysis, and SSVC classifies exploitation status as none, making this a low-urgency but real credential-hygiene risk on affected desktop platforms.
Local privilege escalation in Palo Alto Networks Prisma Access Agent (all versions prior to 26.2.1) allows any locally authenticated non-administrative user to elevate to root on macOS and Linux, or NT AUTHORITY\SYSTEM on Windows, by exploiting a flawed privilege management mechanism. Successful exploitation grants full control of the affected endpoint, enabling arbitrary code execution and unauthorized access to data restricted to privileged accounts. No public exploit exists and the vulnerability is absent from CISA KEV; however, SSVC rates technical impact as total, making patching a meaningful priority for multi-user and enterprise endpoint environments.