Information Disclosure
Monthly
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
UI spoofing in Google Chrome's Transactions Platform prior to version 152.0.7977.65 enables remote attackers to misrepresent UI elements - such as payment confirmation dialogs or security indicators - through a crafted HTML page, relying on social engineering for delivery. Classified under CWE-451 (UI Misrepresentation of Critical Information), the flaw requires user interaction and carries no confidentiality or availability impact, confining harm to integrity via deception. No active exploitation is confirmed and EPSS probability is very low (0.29%), but the ubiquitous deployment footprint of Chrome means the absolute population of potential targets is large.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
Skia, the 2D graphics library embedded in Google Chrome prior to 152.0.7977.65, leaks sensitive information when an attacker who has already compromised the renderer process delivers a crafted HTML page to a victim. This CWE-200 flaw functions as a chaining component in a multi-stage exploit rather than a standalone entry point - it amplifies the impact of a prior renderer compromise rather than providing initial access. No public exploit code exists, EPSS is 0.17% (7th percentile), and Chrome's own severity classification is Low, all consistent with the mandatory pre-condition of a pre-compromised renderer.
Out-of-bounds memory read in Google Chrome's FileSystem component (versions prior to 152.0.7977.65) allows a remote unauthenticated attacker to leak memory contents from outside the browser's renderer sandbox by directing a victim to a specially crafted HTML page via social engineering. Exploitation is contingent on user interaction, limiting opportunistic or automated mass exploitation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), though the Confidentiality impact is rated High, meaning successful exploitation could expose sensitive data from browser memory. Vendor-released patch is available in Chrome 152.0.7977.65.
Observable discrepancy in Chrome's Glic component allows remote information disclosure against users running versions prior to 152.0.7977.65. An attacker who persuades a victim to visit a crafted HTML page can exploit a behavioral or timing side-channel in the Glic AI-integration subsystem to extract sensitive information with high confidentiality impact, despite the medium overall CVSS score. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) indicates very low current exploitation probability.
Race condition in Google Chrome's Editing component prior to version 152.0.7977.65 enables remote attackers who successfully socially engineer a victim to visit a crafted HTML page to extract sensitive information from the browser. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) shows the attack is network-delivered but requires high complexity timing and explicit user interaction, limiting real-world exploitability. No public exploit identified at time of analysis, and the extremely low EPSS score of 0.14% (4th percentile) corroborates the vendor's own Low Chromium severity designation.
Bluetooth information disclosure in Google Chrome on macOS (versions prior to 152.0.7977.65) enables a remote attacker - who has already compromised the renderer process - to extract sensitive Bluetooth-related information by combining a crafted HTML page with social engineering. This is a chained, multi-prerequisite vulnerability: successful exploitation requires a prior renderer compromise and active victim interaction, which the CVSS AC:H rating reflects. No public exploit code exists and no active exploitation has been observed (SSVC: Exploitation none; EPSS 0.29%), placing real-world risk substantially below what the C:H confidentiality impact alone might suggest. A vendor patch is available in Chrome 152.0.7977.65.
Sensitive information exposure in Google Chrome for Android (versions prior to 152.0.7977.65) via the Android Intents mechanism allows a remote attacker to leak confidential browser or device data by delivering a crafted HTML page to the victim. The vulnerability requires user interaction - the target must visit the malicious page - limiting opportunistic mass exploitation despite the network-accessible attack vector. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.17%, consistent with Chromium's own 'Low' severity classification, though the CVSS C:H rating reflects a meaningful confidentiality impact if triggered.
Chrome's Sharing feature on Android leaks sensitive information to local attackers in all versions prior to 152.0.7977.65, exploitable only when a malicious co-installed app is present on the target device combined with social engineering. Despite a High confidentiality impact in the CVSS vector, the overall score of 5.1 reflects severe practical constraints: local access, high complexity, and a social engineering dependency. No public exploit code has been identified, EPSS probability is 0.15% (4th percentile), and Chromium's own severity rating is Low - signals that align to suggest low near-term operational risk.
DOM information leak in Google Chrome before version 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy by luring a victim to a crafted HTML page, potentially exposing cross-origin data to the attacker. The CVSS 4.3 Medium score reflects network-exploitable, unauthenticated delivery limited to confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and an EPSS probability of 0.22% (12th percentile) indicates low near-term exploitation likelihood despite the broad affected product footprint.
Out-of-bounds read in Google Chrome's Media component prior to version 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to leak memory contents across the Chrome sandbox boundary via a crafted HTML page. The attack is a chained, second-stage capability - it requires prior renderer code execution and user interaction - not a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low observed exploitation likelihood.
Uninitialized GPU resource use in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read memory outside the Chrome sandbox boundary via a crafted HTML page. The vulnerability (CWE-908) is a second-stage primitive - it cannot be exploited in isolation and requires a pre-existing renderer process compromise as a hard prerequisite. No public exploit code has been identified and EPSS stands at 0.31%, consistent with its role as a chained exploitation component rather than a primary attack vector.
Cross-origin data exposure in Google Chrome's Extensions subsystem prior to version 152.0.7977.65 allows a remote attacker who successfully socially engineers a victim into installing a crafted malicious extension to read data from web origins the extension should not have access to. The high confidentiality impact (C:H) is real, but exploitation is gated on user interaction - the victim must install the malicious extension - which substantially limits opportunistic mass exploitation. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.27% (18th percentile) reflects low current exploitation probability consistent with no observed in-the-wild use.
Information disclosure in Google Chrome's Geolocation component prior to version 152.0.7977.65 allows a remote attacker to obtain the victim's sensitive geolocation data by tricking them into visiting a crafted HTML page. The attack relies on social engineering as the delivery mechanism and results in a high-confidentiality-impact leak of physical location information, which may expose home or workplace addresses. No public exploit code or active exploitation has been identified; EPSS at 0.21% (11th percentile) confirms low automated exploitation probability at time of analysis.
Cross-origin data exposure in Google Chrome before 152.0.7977.65 enables a chained information leak when a renderer process has already been compromised by a separate exploit. Chrome's CORS implementation incorrectly permits cross-origin data access from within a compromised renderer, allowing a remote attacker to exfiltrate data from origins the victim is authenticated to via a crafted HTML page. No public exploit code exists and no CISA KEV listing has been issued; the EPSS score of 0.17% (7th percentile) confirms this is a low-probability, low-severity secondary element of multi-stage browser attack chains rather than a standalone threat.
Memory disclosure in Google Chrome's Dawn WebGPU component exposes uninitialized memory contents to remote attackers who can lure a user to a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on desktop platforms, per the EUVD and Chrome release advisory. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage via an uninitialized resource in the WebXR API affects Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker who can socially engineer a user into visiting a crafted HTML page may trigger a read of uninitialized memory, potentially exposing data from other browser origins. Google has rated this Medium severity; a patched release (152.0.7977.65) is available, and no public exploit or active exploitation has been identified at time of analysis.
Cross-origin data exposure via a ServiceWorker flaw in Google Chrome prior to 152.0.7977.65 permits remote attackers to read data from origins they do not control. An attacker can exploit this by delivering a crafted HTML page to a victim user, leveraging Chrome's ServiceWorker API to bypass same-origin isolation and exfiltrate cross-origin responses. No public exploit code is identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation activity; the mandatory user-interaction requirement further constrains automated abuse.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.
Network-layer information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive data by directing a victim to a crafted HTML page. The attack is a multi-stage chain: the renderer compromise is a hard prerequisite not satisfied by this CVE alone, which materially constrains real-world exploitability. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) corroborates low observed exploitation probability; no CISA KEV listing exists.
Improper resource exposure in Google Chrome's StreamsAPI (versions prior to 152.0.7977.65) enables remote attackers to partially bypass the web origin policy and read limited data from privileged browser pages via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - consistent with CVSS UI:R and S:U, confining impact to the victim's own browser context. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.18% (8th percentile) indicates very low real-world exploitation probability at time of analysis.
Cross-origin data exfiltration via the BFCache mechanism in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read data across origin boundaries using a crafted HTML page. This information disclosure (CWE-200) is a second-stage capability, not a standalone attack - it requires chaining with a separate renderer RCE vulnerability, constraining real-world risk significantly. No public exploit code or active exploitation has been confirmed; EPSS is 0.17% and the vulnerability is absent from CISA KEV. Vendor patch is available in Chrome 152.0.7977.65.
CSS injection in Google Chrome prior to version 152.0.7977.65 enables a remote attacker to extract sensitive information from a victim's browser session by delivering a crafted HTML page. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N vector confirms unauthenticated network delivery requiring only that the victim navigate to attacker-controlled content, with high confidentiality impact and no integrity or availability consequences. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% at the 10th percentile indicates very low observed exploitation probability; this is not listed in the CISA KEV catalog.
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
CSS information leak in Google Chrome before 152.0.7977.65 enables remote attackers to exfiltrate sensitive browser data by luring victims to a crafted HTML page. The flaw resides in Chrome's CSS rendering subsystem (CWE-200: Information Exposure) and carries a CVSS C:H rating, meaning confidentiality impact is assessed as high despite the medium-severity label. No public exploit code has been identified and EPSS probability sits at 0.17% (7th percentile), indicating very low observed exploitation activity; the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's CustomTabs feature on Android (versions prior to 152.0.7977.65) enables a local attacker to infer cross-origin information via a co-installed malicious application. The vulnerability stems from an observable discrepancy (CWE-203) - a measurable side-channel difference in Chrome's behavior that a co-resident app can detect and use to reconstruct protected web content. Impact is confined to limited confidentiality loss; no public exploit has been identified at time of analysis, and EPSS at 0.15% (4th percentile) signals very low real-world exploitation probability.
Cross-origin data leakage through the CustomTabs component in Google Chrome for Android (versions prior to 152.0.7977.65) enables a local attacker to extract sensitive browsing data belonging to other origins via a co-installed application. The flaw is classified CWE-200 and carries a CVSS Medium score of 5.5, reflecting meaningful confidentiality impact constrained by a local-only attack vector and required user interaction. No public exploit code or active exploitation via CISA KEV has been identified; the vendor-released patch is available in Chrome 152.0.7977.65.
Information leak in the Animation component of Google Chrome prior to 152.0.7977.65 allows remote unauthenticated attackers to obtain sensitive browser data by inducing a user to visit a crafted HTML page. The flaw is classified CWE-200 (Exposure of Sensitive Information) and carries a CVSS confidentiality impact of High, though Chromium's internal team rated it Medium severity. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.22% (13th percentile) confirms very low observed exploitation probability, making this a normal patch-cycle priority rather than an emergency.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
Observable discrepancy in HTML rendering in Google Chrome prior to 152.0.7977.65 enables a remote attacker to extract sensitive information when a victim visits a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), where Chrome's handling of specific HTML constructs produces measurable behavioral differences - such as timing variations or rendering side-channels - that leak protected state. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating low opportunistic risk despite the High confidentiality impact rating in the CVSS vector.
Cross-origin data leakage in Google Chrome's Canvas API (versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to read pixel-level data from cross-origin resources rendered in a canvas element via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - and impact is limited to partial confidentiality loss (C:L), with no integrity or availability consequences. No public exploit code has been identified and EPSS sits at 0.27% (18th percentile), indicating low real-world exploitation probability; vendor-released patch is available.
ServiceWorker in Google Chrome versions prior to 152.0.7977.65 leaks sensitive information to remote attackers via a crafted HTML page, exploiting CWE-200 (Exposure of Sensitive Information to Unauthorized Actor). The vulnerability requires no attacker-side authentication (PR:N per CVSS) but does require user interaction - a victim must visit the malicious page. With CVSS C:H and no integrity or availability impact, the primary threat is data exfiltration; no public exploit has been identified at time of analysis and EPSS sits at a low 0.27%.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.
Observable discrepancy in the Forms component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by serving a crafted HTML page that induces measurable behavioral side-channel differences. The CVSS vector (AC:H/UI:R) confirms exploitation requires both high attack complexity - precise timing or environmental control to reliably observe the discrepancy - and active user interaction to visit the malicious page. No public exploit has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) signals limited automated exploitation interest despite the high confidentiality impact designation.
CustomTabs in Google Chrome on Android before version 152.0.7977.65 leaks cross-origin data through an observable discrepancy (CWE-203) exploitable by a co-installed malicious application. The information disclosure is constrained to local attack scenarios where an adversary controls a second app on the same Android device, limiting real-world exposure significantly. EPSS stands at 0.18% (7th percentile), no public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's FindInPage component affects all versions prior to 152.0.7977.65. Exploitation requires a remote attacker to have already compromised the renderer process and then deliver a crafted HTML page that triggers improper input validation, exposing data from a different origin accessible in the browser session. No public exploit code has been identified; EPSS scores this at 0.22% (13th percentile), consistent with the compound, chained nature of exploitation required.
Memory read outside Chrome's sandbox via an uninitialized resource in ANGLE affects Google Chrome prior to 152.0.7977.65, enabling an attacker who has already compromised the renderer process to exfiltrate memory beyond sandbox boundaries using a crafted HTML page. This is a chained exploit component - it does not enable initial access but extends an attacker's reach post-renderer-compromise, making it a meaningful escalation primitive in a multi-stage browser exploit chain. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.29% (21st percentile), consistent with its role as a secondary exploit stage.
Out-of-bounds memory read in the GPU component of Google Chrome on Android (prior to 152.0.7977.65) exposes process memory outside the renderer sandbox when a victim visits a crafted HTML page. The flaw targets Android-specific GPU code paths in Chrome's rendering pipeline, producing a high confidentiality impact limited to the GPU process memory space, with no integrity or availability consequence. No public exploit has been identified at time of analysis, and an EPSS probability of 0.24% at the 15th percentile indicates low near-term opportunistic exploitation likelihood.
Cross-origin data leakage in Google Chrome's Performance API implementation prior to version 152.0.7977.65 enables remote information disclosure via observable timing discrepancies. By serving a crafted HTML page, a remote unauthenticated attacker can exploit CWE-203 side-channel behavior to infer or extract data belonging to other web origins, violating the browser Same-Origin Policy. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.37% (30th percentile), indicating low near-term exploitation probability despite the high confidentiality impact rating in CVSS.
UI misrepresentation in Google Chrome prior to 152.0.7977.65 enables remote attackers to spoof browser interface elements via a crafted HTML page, potentially deceiving users about the identity or security state of a site they are visiting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) confirms network delivery with no attacker authentication required, though user interaction is a hard prerequisite. No public exploit code and no active exploitation have been identified; the EPSS score of 0.22% at the 13th percentile reflects very low near-term exploitation probability.
UI spoofing in Google Chrome on macOS prior to version 152.0.7977.65 enables a remote attacker to misrepresent input UI elements by serving a crafted HTML page, classified under CWE-451 (UI Misrepresentation of Critical Information). Victims who visit the malicious page may be deceived by falsified browser UI elements - such as address bar content, form fields, or security indicators - potentially leading to credential theft or other social engineering outcomes. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.22%; a vendor patch is available at 152.0.7977.65.
Address bar spoofing in Google Chrome prior to version 152.0.7977.65 enables remote attackers to deceive users about the true origin of a page they are visiting via a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information) in the browser's navigation subsystem. The practical impact is phishing amplification: a victim visiting the attacker's page may see a trusted domain displayed in the address bar and submit credentials or sensitive information to an attacker-controlled site. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS at 0.22% (13th percentile) confirms low automated exploitation probability, though the social-engineering utility of address bar spoofing makes targeted abuse plausible.
Cross-origin data disclosure in Google Chrome's ANGLE graphics layer on Windows allows a remote unauthenticated attacker to read data from other origins by serving a crafted HTML page to a victim user. The flaw is rooted in an uninitialized resource (CWE-908) within ANGLE, Chrome's graphics abstraction layer, affecting all Chrome versions on Windows prior to 152.0.7977.65. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS of 0.29% (21st percentile) corroborates low observed exploitation activity, though the C:H confidentiality rating reflects the severity of cross-origin data leakage if exploited.
Network-layer information disclosure in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive network-layer data by delivering a crafted HTML page to a victim. The CVSS score of 5.3 reflects constrained real-world risk: high confidentiality impact is offset by the requirement for a prior renderer compromise and active user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low anticipated exploitation activity.
Sensitive information disclosure in Google Chrome's Sync component (versions prior to 152.0.7977.65) allows remote unauthenticated attackers to extract synchronized user data via crafted network traffic. The flaw stems from improper input validation (CWE-20) in the Sync subsystem, which handles cross-device synchronization of browser data including passwords, history, and tokens. No public exploit code or CISA KEV listing exists; EPSS of 0.34% (27th percentile) reflects low real-world exploitation probability, though CVSS C:H signals potentially severe data exposure if exploited.
Information disclosure in Google Chrome's SignIn component (versions prior to 152.0.7977.65) allows remote, unauthenticated attackers to obtain sensitive user information by sending crafted network traffic during the sign-in flow. The CVSS vector assigns High complexity (AC:H), indicating exploitation is not straightforward and requires specific network conditions to be met. No public exploit code has been identified, and EPSS places exploitation probability at just 0.21%, reinforcing that real-world opportunistic exploitation is unlikely at this time.
Memory disclosure in Google Chrome's ANGLE graphics subsystem (prior to 152.0.7977.65) exposes out-of-sandbox memory contents when a user visits a crafted HTML page. The uninitialized resource flaw (CWE-908) in ANGLE - Chrome's cross-platform graphics abstraction layer - allows a remote attacker to read memory that should be isolated within the renderer sandbox, leading to high-confidence confidentiality impact. No public exploit has been identified at time of analysis, and EPSS at 0.29% reflects currently low exploitation probability despite the high CVSS confidentiality rating.
Cross-origin data disclosure in Google Chrome's ANGLE graphics translation layer affects all desktop versions prior to 152.0.7977.65. The uninitialized GPU resource (CWE-908) can be triggered by a crafted HTML page, allowing a remote attacker to read residual data across origin boundaries - a direct violation of browser isolation guarantees. No public exploit code or active exploitation is identified at the time of analysis; the 0.24% EPSS score (15th percentile) places real-world exploitation probability in low-priority territory despite the High confidentiality sub-score in the CVSS rating.
Cross-origin data leakage in Google Chrome's Payments subsystem, affecting all versions prior to 152.0.7977.65, stems from a TOCTOU race condition exploitable by an attacker who has already compromised the renderer process. By delivering a crafted HTML page, the attacker can race the Payments component to read data across origin boundaries, violating the Same-Origin Policy. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.25% (16th percentile) reflects low real-world exploitation probability.
Memory disclosure in Google Chrome's Video component (versions prior to 152.0.7977.65) allows a remote attacker to read memory contents from within the Chrome sandbox by directing a victim to a specially crafted HTML page. The uninitialized resource flaw (CWE-908) means the Video subsystem may expose stale memory - potentially including session tokens, credentials, or other sensitive browser data - without requiring any authentication from the attacker. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.34% (26th percentile) confirms low automated exploitation probability.
Improper resource exposure in Google Chrome's Preload mechanism prior to version 152.0.7977.65 enables remote attackers to bypass Site Isolation by luring a user to a crafted HTML page. The flaw (CWE-668) allows cross-origin resource data to leak across security boundaries, undermining Chrome's core renderer isolation architecture and potentially exposing sensitive information from other origins loaded in the browser. No public exploit has been identified at time of analysis; EPSS at 0.39% (32nd percentile) and the absence of a CISA KEV listing indicate low but non-zero exploitation probability.
WebProtect race condition in Google Chrome prior to 152.0.7977.65 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) enables a second-stage information disclosure step within a broader browser exploitation chain, requiring a victim to interact with a crafted HTML page. No public exploit code has been identified and EPSS sits at 0.29% (22nd percentile), indicating limited real-world exploitation pressure at this time; a vendor patch is available.
Cross-origin data leakage in Google Chrome's Payments subsystem (prior to 152.0.7977.65) exposes information from other origins when a user visits a crafted HTML page. The vulnerability stems from improper isolation within the Payments component, allowing a remote unauthenticated attacker to read data across origin boundaries - a violation of the Same-Origin Policy that underpins browser security. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates low observed exploitation probability in the wild.
Cross-origin data exfiltration via Skia, Chrome's graphics rendering engine, affects all Google Chrome versions prior to 152.0.7977.65, enabling remote unauthenticated attackers to read pixel-level cross-origin data from a victim's browser session. Exploitation requires user interaction - the victim must visit a crafted HTML page - and impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates minimal observed exploitation pressure.
DOM information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive browser data by inducing a victim to visit a crafted HTML page via social engineering. The vulnerability (CWE-200) reflects improper information exposure within Chrome's Document Object Model, with high confidentiality impact per CVSS. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 13th percentile (0.22%), and a vendor-released patch is available in stable channel 152.0.7977.65.
Canvas API information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy and read cross-origin pixel data via a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) and results in low confidentiality impact - pixel-level canvas data leakage rather than credential or file system exposure. No public exploit has been identified and EPSS at 0.39% (32nd percentile) confirms low real-world exploitation probability; no CISA KEV listing exists.
Observable discrepancy (CWE-203) in Google Chrome's network stack prior to version 152.0.7977.65 enables remote attackers to extract sensitive information by exploiting behavioral differences observable from a crafted HTML page. Exploitation requires high attack complexity and user interaction - the victim must visit a malicious page - constraining real-world impact despite the high confidentiality rating in the CVSS vector. No public exploit code exists and no active exploitation has been reported; Google has released a patch in Chrome 152.0.7977.65.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 enables cross-origin information disclosure via a crafted HTML page, but only when an attacker has already achieved renderer process compromise through a separate, chained exploit. The flaw, tracked internally as Chromium issue 498327743, carries a CVSS score of 3.1 reflecting the high-complexity, multi-stage attack prerequisite. No public exploit code or active exploitation has been identified; EPSS exploitation probability stands at 0.33% (25th percentile), consistent with no observed widespread abuse.
Cross-origin data leakage in Google Chrome's SVG rendering engine (prior to 152.0.7977.65) allows a remote attacker to bypass same-origin policy boundaries through observable behavioral discrepancies. Exploitation requires the victim to interact with a crafted HTML page (UI:R), limiting opportunistic mass exploitation. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.37% (30th percentile) confirms low current exploitation probability.
UI misrepresentation in the Chrome Extensions subsystem (CWE-451) enables remote attackers to use social engineering and a crafted extension to deceive users into disclosing sensitive information. All Google Chrome desktop installations prior to version 152.0.7977.65 are affected. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV; however, the high confidentiality impact in the CVSS vector reflects the potential for credential or sensitive-data theft if a user is successfully deceived into installing a malicious extension.
Cross-origin data disclosure in Google Chrome's Skia graphics library (versions prior to 152.0.7977.65) enables a remote attacker who has already achieved renderer process compromise to leak cross-origin data by loading a crafted HTML page. The uninitialized resource flaw (CWE-908) exposes stale Skia memory contents that may contain pixel or data residue from other origins. No public exploit code has been identified, the vulnerability is absent from CISA KEV, and an EPSS of 0.34% (26th percentile) reflects low current exploitation activity.
Chrome's browser Sync subsystem in versions prior to 152.0.7977.65 leaks sensitive user data due to improper validation of crafted inbound network traffic (CWE-20), enabling a remote attacker to read high-confidentiality synchronized content such as credentials or browsing history. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable with no privilege requirement, but a user interaction step limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists; EPSS at 0.25% (16th percentile) corroborates low near-term exploitation probability, and the vendor-released patch (152.0.7977.65) is already available.
Sensitive information disclosure via the QUIC protocol stack in Google Chrome affects all versions prior to 152.0.7977.65, exploitable by remote unauthenticated attackers through a crafted HTML page. When a victim navigates to an attacker-controlled page, Chrome's QUIC (HTTP/3) implementation improperly exposes confidential data, with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified at time of analysis; CISA SSVC rates exploitation status as none and EPSS is 0.31% (23rd percentile), indicating low near-term exploitation probability despite the medium-severity classification.
Memory disclosure via uninitialized GPU resource in Google Chrome prior to 152.0.7977.65 enables a remote attacker - who has already compromised the renderer process - to read memory contents outside the Chrome sandbox through a crafted HTML page. This is a chained, second-stage attack: the GPU component fails to initialize memory before use (CWE-908), leaking data only after renderer compromise. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS of 0.40% (33rd percentile) further signals limited real-world exploitation pressure. A vendor-released patch is available in Chrome 152.0.7977.65.
Observable discrepancy in Chrome's Autofill subsystem allows remote information disclosure via a crafted HTML page, affecting all desktop Chrome versions before 152.0.7977.65. The flaw (CWE-203) enables a network-reachable attacker to infer sensitive stored autofill data - such as addresses or payment fields - by measuring behavioral or timing differences triggered by form elements on a malicious page. Google has issued a patch in stable channel version 152.0.7977.65; no public exploit code exists and no CISA KEV listing has been recorded at time of analysis.
Cross-origin data exposure via the GPU subsystem in Google Chrome prior to 152.0.7977.65 allows a remote, unauthenticated attacker to read data from other web origins by luring a user to a crafted HTML page. The vulnerability resides in Chrome's GPU rendering path and violates the browser's same-origin policy, potentially exposing session tokens, rendered content, or other sensitive cross-origin data. No public exploit code or CISA KEV listing has been identified, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Uninitialized memory in Chrome's ANGLE graphics abstraction layer, across all desktop platforms prior to version 152.0.7977.65, enables remote attackers to read cross-origin data by delivering a crafted HTML page to a victim user. The flaw breaks the browser's same-origin policy through the graphics pipeline rather than through JavaScript or DOM manipulation. No public exploit or CISA KEV listing exists; EPSS of 0.24% at the 15th percentile reflects low current exploitation pressure.
Cross-origin information leak in Google Chrome's Paint rendering component (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy by delivering a crafted HTML page. The vulnerability is confined to the confidentiality dimension - no integrity or availability impact - and requires user interaction (visiting the attacker-controlled page) to trigger. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.33% places it in the 25th percentile, indicating low exploitation probability in the near term.
Cross-origin pixel data leakage in the Canvas API of Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web same-origin policy by enticing a victim to visit a crafted HTML page. The flaw is classified High severity by the Chromium team and Medium (CVSS 4.3) by NVD, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing is identified at time of analysis, and EPSS at 0.33% indicates very low observed exploitation probability.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (versions prior to 152.0.7977.65) allows an unauthenticated remote attacker to read limited data across origin boundaries by inducing a victim to visit a crafted HTML page. The root cause is an uninitialized resource (CWE-908) in ANGLE, Chrome's graphics abstraction engine, which can expose residual GPU buffer contents from other origins. No public exploit identified at time of analysis; EPSS is low at 0.40% (33rd percentile), and the vulnerability is not listed in CISA KEV.
Information disclosure in Google Chrome's Autofill component on Android (prior to 152.0.7977.65) enables a remote attacker to extract sensitive user data - likely form-fill credentials or PII - by luring a victim to a specially crafted HTML page. The vulnerability stems from CWE-20 improper input validation in the Autofill subsystem, which fails to sanitize attacker-controlled HTML before processing it. No public exploit code or CISA KEV listing is present at time of analysis; EPSS sits at the 13th percentile, indicating low current exploitation momentum despite the high confidentiality impact.
Cross-origin data exposure in Google Chrome's GPU component prior to version 152.0.7977.65 can be triggered by a remote attacker who has already compromised the renderer process. The vulnerability stems from an uninitialized GPU resource (CWE-908) that leaks memory contents readable across origin boundaries. Exploitation requires chaining this issue with a separate renderer compromise, significantly raising the bar; no public exploit code has been identified and EPSS probability sits at 0.40%.
PyOpenEXR Python bindings in OpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 leak uninitialized same-process heap memory to calling Python code when processing crafted deep scanline EXR files that contain layer-prefixed RGB channels. The flaw originates in PyPart::setDeepSliceData(), where lane assignment uses exact unprefixed string matching, leaving the green and blue NumPy array lanes uninitialized before returning them to the caller. Python applications ingesting untrusted EXR files that subsequently log, serialize, or transmit the resulting arrays may inadvertently expose heap contents; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Crash-inducing out-of-bounds read in OpenEXR's multipart file processing allows an attacker to cause a denial of service by supplying a crafted EXR file with an empty multiView header attribute. Affected are OpenEXR releases before 3.2.11, within the 3.3.x branch before 3.3.13, and within the 3.4.x branch before 3.4.14 - all maintained by the Academy Software Foundation. Exploitation requires user interaction to open the malicious file, limiting impact to availability only; no public exploit code or active exploitation has been identified at time of analysis.
Heap out-of-bounds read in OpenEXR's RLE decompression path crashes the decoding process on ILP32 (32-bit) builds across versions 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. A crafted .exr file with a malicious RLE-compressed payload causes the 64-bit unpacked size to truncate before buffer allocation in OpenEXRCore decoding.c, after which unpack_32bit() reads past the allocated buffer boundary, resulting in denial of service. Exploitation requires a victim or automated pipeline to open the malicious file; no public exploit identified at time of analysis, and the vulnerability is constrained to ILP32 build environments.
Out-of-bounds read in OpenEXR's ILP32 builds enables denial of service via crafted uncompressed deep-tile EXR files across three active release branches (before 3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13). The root cause is a 32-bit integer overflow in OpenEXRCore's sample-count table size calculation that causes unpack_sample_table() to iterate beyond an undersized allocation. No public exploit or active exploitation has been identified; vendor-released patches are available for all three affected branches.
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafted malicious file. The flaw, classified as CWE-125, causes the application to read beyond allocated buffer boundaries during file parsing, potentially leaking in-memory data such as credentials or session tokens accessible to the attacker. Adobe has published security advisory APSB26-129 addressing the issue; no public exploit code has been identified at time of analysis.
Out-of-bounds read in Adobe Illustrator Desktop 2025 and 2026 exposes sensitive process memory to disclosure when a victim opens a specially crafted file. The vulnerability carries a CVSS 3.1 score of 5.5 (Medium) with a local attack vector and required user interaction, limiting opportunistic exploitation but making it viable in targeted social-engineering campaigns. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
NVIDIA Unified Fabric Manager Enterprise session management embeds a hard-coded cryptographic key (CWE-321), enabling a local attacker to extract session material and potentially escalate privileges within the InfiniBand fabric management plane. All four active UFM Enterprise release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per CPE data published by NVIDIA. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data is absent from available intelligence, limiting probabilistic exploitation forecasting.
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level network access to execute arbitrary OS commands on the host system, potentially achieving full compromise. All major release trains are affected - GA, LTS 2023, LTS 2024, and LTS 2025 - as confirmed by NVIDIA's own advisory and NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world opportunistic risk constrained by the high privilege and network adjacency prerequisites.
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the adjacent network attack vector (AV:A) constrains the realistic attacker population to those with both admin credentials and access to the management network segment.
Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the NVIDIA DGX Spark standalone Memory Management (MM) firmware enables a local high-privileged attacker to read beyond allocated buffer boundaries, leaking potentially sensitive memory contents across security boundaries (S:C/C:H per the CVSS vector). The scope change in the CVSS vector suggests that data disclosed may originate from security domains beyond the firmware itself, such as the host OS or adjacent processes. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege local access requirement substantially constrains the realistic attacker population.
Out-of-bounds read in NI LabVIEW 2026 Q3 and all prior versions can result in information disclosure or arbitrary code execution when the application processes a maliciously crafted VI file containing a specially structured image. The root cause is a signed-to-unsigned integer conversion error (CWE-195) in the image-loading code path, causing the parser to read beyond intended memory boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.
Credential exposure in rclone before v1.75.0 allows network-adjacent attackers to capture IBM IAM bearer tokens during same-host HTTPS-to-HTTP redirect downgrades, or SSE-C customer-provided encryption keys during cross-origin S3 redirects. The S3 redirect callback in s3.go correctly strips X-Amz-Security-Token on host changes but omits IBM IAM Authorization headers and SSE-C key headers from its denylist, exploiting a gap in Go's built-in redirect sanitization that does not treat scheme downgrades as a credential boundary. A proof-of-concept is documented in GHSA-8mxv-9xhp-86h4; no public exploit tool has been independently identified, and the vulnerability is not listed in CISA KEV at time of analysis.
Credential exposure in rclone's WebDAV backend allows an adjacent on-path attacker to capture and replay Basic authentication passwords, bearer tokens, or session cookies transmitted in cleartext after a same-host HTTPS-to-HTTP redirect. All rclone versions through v1.74.0-240 are affected when the WebDAV backend is configured with Basic credentials or cookie-based authentication. No public exploit code has been released, but a proof-of-concept was demonstrated and documented in the GHSA advisory as part of responsible disclosure.
Stack trace disclosure in rclone's RC API exposes internal file paths, Go module versions, goroutine states, and memory addresses to authenticated API callers who intentionally trigger panics. All rclone versions through v1.74.4 with the RC API enabled are affected; the vulnerability is rooted in the panic recovery handler at fs/rc/jobs/job.go including raw debug.Stack() output directly in HTTP JSON error responses. A proof-of-concept is confirmed in the GHSA advisory; no public exploit identified at time of analysis beyond that PoC, and this vulnerability is not listed in CISA KEV.
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
UI spoofing in Google Chrome's Transactions Platform prior to version 152.0.7977.65 enables remote attackers to misrepresent UI elements - such as payment confirmation dialogs or security indicators - through a crafted HTML page, relying on social engineering for delivery. Classified under CWE-451 (UI Misrepresentation of Critical Information), the flaw requires user interaction and carries no confidentiality or availability impact, confining harm to integrity via deception. No active exploitation is confirmed and EPSS probability is very low (0.29%), but the ubiquitous deployment footprint of Chrome means the absolute population of potential targets is large.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
Skia, the 2D graphics library embedded in Google Chrome prior to 152.0.7977.65, leaks sensitive information when an attacker who has already compromised the renderer process delivers a crafted HTML page to a victim. This CWE-200 flaw functions as a chaining component in a multi-stage exploit rather than a standalone entry point - it amplifies the impact of a prior renderer compromise rather than providing initial access. No public exploit code exists, EPSS is 0.17% (7th percentile), and Chrome's own severity classification is Low, all consistent with the mandatory pre-condition of a pre-compromised renderer.
Out-of-bounds memory read in Google Chrome's FileSystem component (versions prior to 152.0.7977.65) allows a remote unauthenticated attacker to leak memory contents from outside the browser's renderer sandbox by directing a victim to a specially crafted HTML page via social engineering. Exploitation is contingent on user interaction, limiting opportunistic or automated mass exploitation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), though the Confidentiality impact is rated High, meaning successful exploitation could expose sensitive data from browser memory. Vendor-released patch is available in Chrome 152.0.7977.65.
Observable discrepancy in Chrome's Glic component allows remote information disclosure against users running versions prior to 152.0.7977.65. An attacker who persuades a victim to visit a crafted HTML page can exploit a behavioral or timing side-channel in the Glic AI-integration subsystem to extract sensitive information with high confidentiality impact, despite the medium overall CVSS score. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) indicates very low current exploitation probability.
Race condition in Google Chrome's Editing component prior to version 152.0.7977.65 enables remote attackers who successfully socially engineer a victim to visit a crafted HTML page to extract sensitive information from the browser. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) shows the attack is network-delivered but requires high complexity timing and explicit user interaction, limiting real-world exploitability. No public exploit identified at time of analysis, and the extremely low EPSS score of 0.14% (4th percentile) corroborates the vendor's own Low Chromium severity designation.
Bluetooth information disclosure in Google Chrome on macOS (versions prior to 152.0.7977.65) enables a remote attacker - who has already compromised the renderer process - to extract sensitive Bluetooth-related information by combining a crafted HTML page with social engineering. This is a chained, multi-prerequisite vulnerability: successful exploitation requires a prior renderer compromise and active victim interaction, which the CVSS AC:H rating reflects. No public exploit code exists and no active exploitation has been observed (SSVC: Exploitation none; EPSS 0.29%), placing real-world risk substantially below what the C:H confidentiality impact alone might suggest. A vendor patch is available in Chrome 152.0.7977.65.
Sensitive information exposure in Google Chrome for Android (versions prior to 152.0.7977.65) via the Android Intents mechanism allows a remote attacker to leak confidential browser or device data by delivering a crafted HTML page to the victim. The vulnerability requires user interaction - the target must visit the malicious page - limiting opportunistic mass exploitation despite the network-accessible attack vector. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.17%, consistent with Chromium's own 'Low' severity classification, though the CVSS C:H rating reflects a meaningful confidentiality impact if triggered.
Chrome's Sharing feature on Android leaks sensitive information to local attackers in all versions prior to 152.0.7977.65, exploitable only when a malicious co-installed app is present on the target device combined with social engineering. Despite a High confidentiality impact in the CVSS vector, the overall score of 5.1 reflects severe practical constraints: local access, high complexity, and a social engineering dependency. No public exploit code has been identified, EPSS probability is 0.15% (4th percentile), and Chromium's own severity rating is Low - signals that align to suggest low near-term operational risk.
DOM information leak in Google Chrome before version 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy by luring a victim to a crafted HTML page, potentially exposing cross-origin data to the attacker. The CVSS 4.3 Medium score reflects network-exploitable, unauthenticated delivery limited to confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and an EPSS probability of 0.22% (12th percentile) indicates low near-term exploitation likelihood despite the broad affected product footprint.
Out-of-bounds read in Google Chrome's Media component prior to version 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to leak memory contents across the Chrome sandbox boundary via a crafted HTML page. The attack is a chained, second-stage capability - it requires prior renderer code execution and user interaction - not a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low observed exploitation likelihood.
Uninitialized GPU resource use in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read memory outside the Chrome sandbox boundary via a crafted HTML page. The vulnerability (CWE-908) is a second-stage primitive - it cannot be exploited in isolation and requires a pre-existing renderer process compromise as a hard prerequisite. No public exploit code has been identified and EPSS stands at 0.31%, consistent with its role as a chained exploitation component rather than a primary attack vector.
Cross-origin data exposure in Google Chrome's Extensions subsystem prior to version 152.0.7977.65 allows a remote attacker who successfully socially engineers a victim into installing a crafted malicious extension to read data from web origins the extension should not have access to. The high confidentiality impact (C:H) is real, but exploitation is gated on user interaction - the victim must install the malicious extension - which substantially limits opportunistic mass exploitation. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.27% (18th percentile) reflects low current exploitation probability consistent with no observed in-the-wild use.
Information disclosure in Google Chrome's Geolocation component prior to version 152.0.7977.65 allows a remote attacker to obtain the victim's sensitive geolocation data by tricking them into visiting a crafted HTML page. The attack relies on social engineering as the delivery mechanism and results in a high-confidentiality-impact leak of physical location information, which may expose home or workplace addresses. No public exploit code or active exploitation has been identified; EPSS at 0.21% (11th percentile) confirms low automated exploitation probability at time of analysis.
Cross-origin data exposure in Google Chrome before 152.0.7977.65 enables a chained information leak when a renderer process has already been compromised by a separate exploit. Chrome's CORS implementation incorrectly permits cross-origin data access from within a compromised renderer, allowing a remote attacker to exfiltrate data from origins the victim is authenticated to via a crafted HTML page. No public exploit code exists and no CISA KEV listing has been issued; the EPSS score of 0.17% (7th percentile) confirms this is a low-probability, low-severity secondary element of multi-stage browser attack chains rather than a standalone threat.
Memory disclosure in Google Chrome's Dawn WebGPU component exposes uninitialized memory contents to remote attackers who can lure a user to a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on desktop platforms, per the EUVD and Chrome release advisory. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage via an uninitialized resource in the WebXR API affects Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker who can socially engineer a user into visiting a crafted HTML page may trigger a read of uninitialized memory, potentially exposing data from other browser origins. Google has rated this Medium severity; a patched release (152.0.7977.65) is available, and no public exploit or active exploitation has been identified at time of analysis.
Cross-origin data exposure via a ServiceWorker flaw in Google Chrome prior to 152.0.7977.65 permits remote attackers to read data from origins they do not control. An attacker can exploit this by delivering a crafted HTML page to a victim user, leveraging Chrome's ServiceWorker API to bypass same-origin isolation and exfiltrate cross-origin responses. No public exploit code is identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation activity; the mandatory user-interaction requirement further constrains automated abuse.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.
Network-layer information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive data by directing a victim to a crafted HTML page. The attack is a multi-stage chain: the renderer compromise is a hard prerequisite not satisfied by this CVE alone, which materially constrains real-world exploitability. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) corroborates low observed exploitation probability; no CISA KEV listing exists.
Improper resource exposure in Google Chrome's StreamsAPI (versions prior to 152.0.7977.65) enables remote attackers to partially bypass the web origin policy and read limited data from privileged browser pages via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - consistent with CVSS UI:R and S:U, confining impact to the victim's own browser context. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.18% (8th percentile) indicates very low real-world exploitation probability at time of analysis.
Cross-origin data exfiltration via the BFCache mechanism in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to read data across origin boundaries using a crafted HTML page. This information disclosure (CWE-200) is a second-stage capability, not a standalone attack - it requires chaining with a separate renderer RCE vulnerability, constraining real-world risk significantly. No public exploit code or active exploitation has been confirmed; EPSS is 0.17% and the vulnerability is absent from CISA KEV. Vendor patch is available in Chrome 152.0.7977.65.
CSS injection in Google Chrome prior to version 152.0.7977.65 enables a remote attacker to extract sensitive information from a victim's browser session by delivering a crafted HTML page. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N vector confirms unauthenticated network delivery requiring only that the victim navigate to attacker-controlled content, with high confidentiality impact and no integrity or availability consequences. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% at the 10th percentile indicates very low observed exploitation probability; this is not listed in the CISA KEV catalog.
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
CSS information leak in Google Chrome before 152.0.7977.65 enables remote attackers to exfiltrate sensitive browser data by luring victims to a crafted HTML page. The flaw resides in Chrome's CSS rendering subsystem (CWE-200: Information Exposure) and carries a CVSS C:H rating, meaning confidentiality impact is assessed as high despite the medium-severity label. No public exploit code has been identified and EPSS probability sits at 0.17% (7th percentile), indicating very low observed exploitation activity; the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's CustomTabs feature on Android (versions prior to 152.0.7977.65) enables a local attacker to infer cross-origin information via a co-installed malicious application. The vulnerability stems from an observable discrepancy (CWE-203) - a measurable side-channel difference in Chrome's behavior that a co-resident app can detect and use to reconstruct protected web content. Impact is confined to limited confidentiality loss; no public exploit has been identified at time of analysis, and EPSS at 0.15% (4th percentile) signals very low real-world exploitation probability.
Cross-origin data leakage through the CustomTabs component in Google Chrome for Android (versions prior to 152.0.7977.65) enables a local attacker to extract sensitive browsing data belonging to other origins via a co-installed application. The flaw is classified CWE-200 and carries a CVSS Medium score of 5.5, reflecting meaningful confidentiality impact constrained by a local-only attack vector and required user interaction. No public exploit code or active exploitation via CISA KEV has been identified; the vendor-released patch is available in Chrome 152.0.7977.65.
Information leak in the Animation component of Google Chrome prior to 152.0.7977.65 allows remote unauthenticated attackers to obtain sensitive browser data by inducing a user to visit a crafted HTML page. The flaw is classified CWE-200 (Exposure of Sensitive Information) and carries a CVSS confidentiality impact of High, though Chromium's internal team rated it Medium severity. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.22% (13th percentile) confirms very low observed exploitation probability, making this a normal patch-cycle priority rather than an emergency.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
Observable discrepancy in HTML rendering in Google Chrome prior to 152.0.7977.65 enables a remote attacker to extract sensitive information when a victim visits a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), where Chrome's handling of specific HTML constructs produces measurable behavioral differences - such as timing variations or rendering side-channels - that leak protected state. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating low opportunistic risk despite the High confidentiality impact rating in the CVSS vector.
Cross-origin data leakage in Google Chrome's Canvas API (versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to read pixel-level data from cross-origin resources rendered in a canvas element via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - and impact is limited to partial confidentiality loss (C:L), with no integrity or availability consequences. No public exploit code has been identified and EPSS sits at 0.27% (18th percentile), indicating low real-world exploitation probability; vendor-released patch is available.
ServiceWorker in Google Chrome versions prior to 152.0.7977.65 leaks sensitive information to remote attackers via a crafted HTML page, exploiting CWE-200 (Exposure of Sensitive Information to Unauthorized Actor). The vulnerability requires no attacker-side authentication (PR:N per CVSS) but does require user interaction - a victim must visit the malicious page. With CVSS C:H and no integrity or availability impact, the primary threat is data exfiltration; no public exploit has been identified at time of analysis and EPSS sits at a low 0.27%.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.
Observable discrepancy in the Forms component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by serving a crafted HTML page that induces measurable behavioral side-channel differences. The CVSS vector (AC:H/UI:R) confirms exploitation requires both high attack complexity - precise timing or environmental control to reliably observe the discrepancy - and active user interaction to visit the malicious page. No public exploit has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) signals limited automated exploitation interest despite the high confidentiality impact designation.
CustomTabs in Google Chrome on Android before version 152.0.7977.65 leaks cross-origin data through an observable discrepancy (CWE-203) exploitable by a co-installed malicious application. The information disclosure is constrained to local attack scenarios where an adversary controls a second app on the same Android device, limiting real-world exposure significantly. EPSS stands at 0.18% (7th percentile), no public exploit code has been identified, and the vulnerability is not listed in the CISA KEV catalog.
Cross-origin data leakage in Google Chrome's FindInPage component affects all versions prior to 152.0.7977.65. Exploitation requires a remote attacker to have already compromised the renderer process and then deliver a crafted HTML page that triggers improper input validation, exposing data from a different origin accessible in the browser session. No public exploit code has been identified; EPSS scores this at 0.22% (13th percentile), consistent with the compound, chained nature of exploitation required.
Memory read outside Chrome's sandbox via an uninitialized resource in ANGLE affects Google Chrome prior to 152.0.7977.65, enabling an attacker who has already compromised the renderer process to exfiltrate memory beyond sandbox boundaries using a crafted HTML page. This is a chained exploit component - it does not enable initial access but extends an attacker's reach post-renderer-compromise, making it a meaningful escalation primitive in a multi-stage browser exploit chain. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.29% (21st percentile), consistent with its role as a secondary exploit stage.
Out-of-bounds memory read in the GPU component of Google Chrome on Android (prior to 152.0.7977.65) exposes process memory outside the renderer sandbox when a victim visits a crafted HTML page. The flaw targets Android-specific GPU code paths in Chrome's rendering pipeline, producing a high confidentiality impact limited to the GPU process memory space, with no integrity or availability consequence. No public exploit has been identified at time of analysis, and an EPSS probability of 0.24% at the 15th percentile indicates low near-term opportunistic exploitation likelihood.
Cross-origin data leakage in Google Chrome's Performance API implementation prior to version 152.0.7977.65 enables remote information disclosure via observable timing discrepancies. By serving a crafted HTML page, a remote unauthenticated attacker can exploit CWE-203 side-channel behavior to infer or extract data belonging to other web origins, violating the browser Same-Origin Policy. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.37% (30th percentile), indicating low near-term exploitation probability despite the high confidentiality impact rating in CVSS.
UI misrepresentation in Google Chrome prior to 152.0.7977.65 enables remote attackers to spoof browser interface elements via a crafted HTML page, potentially deceiving users about the identity or security state of a site they are visiting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) confirms network delivery with no attacker authentication required, though user interaction is a hard prerequisite. No public exploit code and no active exploitation have been identified; the EPSS score of 0.22% at the 13th percentile reflects very low near-term exploitation probability.
UI spoofing in Google Chrome on macOS prior to version 152.0.7977.65 enables a remote attacker to misrepresent input UI elements by serving a crafted HTML page, classified under CWE-451 (UI Misrepresentation of Critical Information). Victims who visit the malicious page may be deceived by falsified browser UI elements - such as address bar content, form fields, or security indicators - potentially leading to credential theft or other social engineering outcomes. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.22%; a vendor patch is available at 152.0.7977.65.
Address bar spoofing in Google Chrome prior to version 152.0.7977.65 enables remote attackers to deceive users about the true origin of a page they are visiting via a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information) in the browser's navigation subsystem. The practical impact is phishing amplification: a victim visiting the attacker's page may see a trusted domain displayed in the address bar and submit credentials or sensitive information to an attacker-controlled site. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS at 0.22% (13th percentile) confirms low automated exploitation probability, though the social-engineering utility of address bar spoofing makes targeted abuse plausible.
Cross-origin data disclosure in Google Chrome's ANGLE graphics layer on Windows allows a remote unauthenticated attacker to read data from other origins by serving a crafted HTML page to a victim user. The flaw is rooted in an uninitialized resource (CWE-908) within ANGLE, Chrome's graphics abstraction layer, affecting all Chrome versions on Windows prior to 152.0.7977.65. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS of 0.29% (21st percentile) corroborates low observed exploitation activity, though the C:H confidentiality rating reflects the severity of cross-origin data leakage if exploited.
Network-layer information disclosure in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive network-layer data by delivering a crafted HTML page to a victim. The CVSS score of 5.3 reflects constrained real-world risk: high confidentiality impact is offset by the requirement for a prior renderer compromise and active user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low anticipated exploitation activity.
Sensitive information disclosure in Google Chrome's Sync component (versions prior to 152.0.7977.65) allows remote unauthenticated attackers to extract synchronized user data via crafted network traffic. The flaw stems from improper input validation (CWE-20) in the Sync subsystem, which handles cross-device synchronization of browser data including passwords, history, and tokens. No public exploit code or CISA KEV listing exists; EPSS of 0.34% (27th percentile) reflects low real-world exploitation probability, though CVSS C:H signals potentially severe data exposure if exploited.
Information disclosure in Google Chrome's SignIn component (versions prior to 152.0.7977.65) allows remote, unauthenticated attackers to obtain sensitive user information by sending crafted network traffic during the sign-in flow. The CVSS vector assigns High complexity (AC:H), indicating exploitation is not straightforward and requires specific network conditions to be met. No public exploit code has been identified, and EPSS places exploitation probability at just 0.21%, reinforcing that real-world opportunistic exploitation is unlikely at this time.
Memory disclosure in Google Chrome's ANGLE graphics subsystem (prior to 152.0.7977.65) exposes out-of-sandbox memory contents when a user visits a crafted HTML page. The uninitialized resource flaw (CWE-908) in ANGLE - Chrome's cross-platform graphics abstraction layer - allows a remote attacker to read memory that should be isolated within the renderer sandbox, leading to high-confidence confidentiality impact. No public exploit has been identified at time of analysis, and EPSS at 0.29% reflects currently low exploitation probability despite the high CVSS confidentiality rating.
Cross-origin data disclosure in Google Chrome's ANGLE graphics translation layer affects all desktop versions prior to 152.0.7977.65. The uninitialized GPU resource (CWE-908) can be triggered by a crafted HTML page, allowing a remote attacker to read residual data across origin boundaries - a direct violation of browser isolation guarantees. No public exploit code or active exploitation is identified at the time of analysis; the 0.24% EPSS score (15th percentile) places real-world exploitation probability in low-priority territory despite the High confidentiality sub-score in the CVSS rating.
Cross-origin data leakage in Google Chrome's Payments subsystem, affecting all versions prior to 152.0.7977.65, stems from a TOCTOU race condition exploitable by an attacker who has already compromised the renderer process. By delivering a crafted HTML page, the attacker can race the Payments component to read data across origin boundaries, violating the Same-Origin Policy. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog; the EPSS score of 0.25% (16th percentile) reflects low real-world exploitation probability.
Memory disclosure in Google Chrome's Video component (versions prior to 152.0.7977.65) allows a remote attacker to read memory contents from within the Chrome sandbox by directing a victim to a specially crafted HTML page. The uninitialized resource flaw (CWE-908) means the Video subsystem may expose stale memory - potentially including session tokens, credentials, or other sensitive browser data - without requiring any authentication from the attacker. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.34% (26th percentile) confirms low automated exploitation probability.
Improper resource exposure in Google Chrome's Preload mechanism prior to version 152.0.7977.65 enables remote attackers to bypass Site Isolation by luring a user to a crafted HTML page. The flaw (CWE-668) allows cross-origin resource data to leak across security boundaries, undermining Chrome's core renderer isolation architecture and potentially exposing sensitive information from other origins loaded in the browser. No public exploit has been identified at time of analysis; EPSS at 0.39% (32nd percentile) and the absence of a CISA KEV listing indicate low but non-zero exploitation probability.
WebProtect race condition in Google Chrome prior to 152.0.7977.65 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) enables a second-stage information disclosure step within a broader browser exploitation chain, requiring a victim to interact with a crafted HTML page. No public exploit code has been identified and EPSS sits at 0.29% (22nd percentile), indicating limited real-world exploitation pressure at this time; a vendor patch is available.
Cross-origin data leakage in Google Chrome's Payments subsystem (prior to 152.0.7977.65) exposes information from other origins when a user visits a crafted HTML page. The vulnerability stems from improper isolation within the Payments component, allowing a remote unauthenticated attacker to read data across origin boundaries - a violation of the Same-Origin Policy that underpins browser security. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates low observed exploitation probability in the wild.
Cross-origin data exfiltration via Skia, Chrome's graphics rendering engine, affects all Google Chrome versions prior to 152.0.7977.65, enabling remote unauthenticated attackers to read pixel-level cross-origin data from a victim's browser session. Exploitation requires user interaction - the victim must visit a crafted HTML page - and impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates minimal observed exploitation pressure.
DOM information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive browser data by inducing a victim to visit a crafted HTML page via social engineering. The vulnerability (CWE-200) reflects improper information exposure within Chrome's Document Object Model, with high confidentiality impact per CVSS. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 13th percentile (0.22%), and a vendor-released patch is available in stable channel 152.0.7977.65.
Canvas API information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy and read cross-origin pixel data via a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) and results in low confidentiality impact - pixel-level canvas data leakage rather than credential or file system exposure. No public exploit has been identified and EPSS at 0.39% (32nd percentile) confirms low real-world exploitation probability; no CISA KEV listing exists.
Observable discrepancy (CWE-203) in Google Chrome's network stack prior to version 152.0.7977.65 enables remote attackers to extract sensitive information by exploiting behavioral differences observable from a crafted HTML page. Exploitation requires high attack complexity and user interaction - the victim must visit a malicious page - constraining real-world impact despite the high confidentiality rating in the CVSS vector. No public exploit code exists and no active exploitation has been reported; Google has released a patch in Chrome 152.0.7977.65.
Site isolation bypass in Google Chrome prior to 152.0.7977.65 enables cross-origin information disclosure via a crafted HTML page, but only when an attacker has already achieved renderer process compromise through a separate, chained exploit. The flaw, tracked internally as Chromium issue 498327743, carries a CVSS score of 3.1 reflecting the high-complexity, multi-stage attack prerequisite. No public exploit code or active exploitation has been identified; EPSS exploitation probability stands at 0.33% (25th percentile), consistent with no observed widespread abuse.
Cross-origin data leakage in Google Chrome's SVG rendering engine (prior to 152.0.7977.65) allows a remote attacker to bypass same-origin policy boundaries through observable behavioral discrepancies. Exploitation requires the victim to interact with a crafted HTML page (UI:R), limiting opportunistic mass exploitation. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.37% (30th percentile) confirms low current exploitation probability.
UI misrepresentation in the Chrome Extensions subsystem (CWE-451) enables remote attackers to use social engineering and a crafted extension to deceive users into disclosing sensitive information. All Google Chrome desktop installations prior to version 152.0.7977.65 are affected. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV; however, the high confidentiality impact in the CVSS vector reflects the potential for credential or sensitive-data theft if a user is successfully deceived into installing a malicious extension.
Cross-origin data disclosure in Google Chrome's Skia graphics library (versions prior to 152.0.7977.65) enables a remote attacker who has already achieved renderer process compromise to leak cross-origin data by loading a crafted HTML page. The uninitialized resource flaw (CWE-908) exposes stale Skia memory contents that may contain pixel or data residue from other origins. No public exploit code has been identified, the vulnerability is absent from CISA KEV, and an EPSS of 0.34% (26th percentile) reflects low current exploitation activity.
Chrome's browser Sync subsystem in versions prior to 152.0.7977.65 leaks sensitive user data due to improper validation of crafted inbound network traffic (CWE-20), enabling a remote attacker to read high-confidentiality synchronized content such as credentials or browsing history. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable with no privilege requirement, but a user interaction step limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists; EPSS at 0.25% (16th percentile) corroborates low near-term exploitation probability, and the vendor-released patch (152.0.7977.65) is already available.
Sensitive information disclosure via the QUIC protocol stack in Google Chrome affects all versions prior to 152.0.7977.65, exploitable by remote unauthenticated attackers through a crafted HTML page. When a victim navigates to an attacker-controlled page, Chrome's QUIC (HTTP/3) implementation improperly exposes confidential data, with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified at time of analysis; CISA SSVC rates exploitation status as none and EPSS is 0.31% (23rd percentile), indicating low near-term exploitation probability despite the medium-severity classification.
Memory disclosure via uninitialized GPU resource in Google Chrome prior to 152.0.7977.65 enables a remote attacker - who has already compromised the renderer process - to read memory contents outside the Chrome sandbox through a crafted HTML page. This is a chained, second-stage attack: the GPU component fails to initialize memory before use (CWE-908), leaking data only after renderer compromise. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS of 0.40% (33rd percentile) further signals limited real-world exploitation pressure. A vendor-released patch is available in Chrome 152.0.7977.65.
Observable discrepancy in Chrome's Autofill subsystem allows remote information disclosure via a crafted HTML page, affecting all desktop Chrome versions before 152.0.7977.65. The flaw (CWE-203) enables a network-reachable attacker to infer sensitive stored autofill data - such as addresses or payment fields - by measuring behavioral or timing differences triggered by form elements on a malicious page. Google has issued a patch in stable channel version 152.0.7977.65; no public exploit code exists and no CISA KEV listing has been recorded at time of analysis.
Cross-origin data exposure via the GPU subsystem in Google Chrome prior to 152.0.7977.65 allows a remote, unauthenticated attacker to read data from other web origins by luring a user to a crafted HTML page. The vulnerability resides in Chrome's GPU rendering path and violates the browser's same-origin policy, potentially exposing session tokens, rendered content, or other sensitive cross-origin data. No public exploit code or CISA KEV listing has been identified, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Uninitialized memory in Chrome's ANGLE graphics abstraction layer, across all desktop platforms prior to version 152.0.7977.65, enables remote attackers to read cross-origin data by delivering a crafted HTML page to a victim user. The flaw breaks the browser's same-origin policy through the graphics pipeline rather than through JavaScript or DOM manipulation. No public exploit or CISA KEV listing exists; EPSS of 0.24% at the 15th percentile reflects low current exploitation pressure.
Cross-origin information leak in Google Chrome's Paint rendering component (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy by delivering a crafted HTML page. The vulnerability is confined to the confidentiality dimension - no integrity or availability impact - and requires user interaction (visiting the attacker-controlled page) to trigger. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.33% places it in the 25th percentile, indicating low exploitation probability in the near term.
Cross-origin pixel data leakage in the Canvas API of Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web same-origin policy by enticing a victim to visit a crafted HTML page. The flaw is classified High severity by the Chromium team and Medium (CVSS 4.3) by NVD, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing is identified at time of analysis, and EPSS at 0.33% indicates very low observed exploitation probability.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (versions prior to 152.0.7977.65) allows an unauthenticated remote attacker to read limited data across origin boundaries by inducing a victim to visit a crafted HTML page. The root cause is an uninitialized resource (CWE-908) in ANGLE, Chrome's graphics abstraction engine, which can expose residual GPU buffer contents from other origins. No public exploit identified at time of analysis; EPSS is low at 0.40% (33rd percentile), and the vulnerability is not listed in CISA KEV.
Information disclosure in Google Chrome's Autofill component on Android (prior to 152.0.7977.65) enables a remote attacker to extract sensitive user data - likely form-fill credentials or PII - by luring a victim to a specially crafted HTML page. The vulnerability stems from CWE-20 improper input validation in the Autofill subsystem, which fails to sanitize attacker-controlled HTML before processing it. No public exploit code or CISA KEV listing is present at time of analysis; EPSS sits at the 13th percentile, indicating low current exploitation momentum despite the high confidentiality impact.
Cross-origin data exposure in Google Chrome's GPU component prior to version 152.0.7977.65 can be triggered by a remote attacker who has already compromised the renderer process. The vulnerability stems from an uninitialized GPU resource (CWE-908) that leaks memory contents readable across origin boundaries. Exploitation requires chaining this issue with a separate renderer compromise, significantly raising the bar; no public exploit code has been identified and EPSS probability sits at 0.40%.
PyOpenEXR Python bindings in OpenEXR versions 3.3.0-3.3.12 and 3.4.0-3.4.13 leak uninitialized same-process heap memory to calling Python code when processing crafted deep scanline EXR files that contain layer-prefixed RGB channels. The flaw originates in PyPart::setDeepSliceData(), where lane assignment uses exact unprefixed string matching, leaving the green and blue NumPy array lanes uninitialized before returning them to the caller. Python applications ingesting untrusted EXR files that subsequently log, serialize, or transmit the resulting arrays may inadvertently expose heap contents; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV.
Crash-inducing out-of-bounds read in OpenEXR's multipart file processing allows an attacker to cause a denial of service by supplying a crafted EXR file with an empty multiView header attribute. Affected are OpenEXR releases before 3.2.11, within the 3.3.x branch before 3.3.13, and within the 3.4.x branch before 3.4.14 - all maintained by the Academy Software Foundation. Exploitation requires user interaction to open the malicious file, limiting impact to availability only; no public exploit code or active exploitation has been identified at time of analysis.
Heap out-of-bounds read in OpenEXR's RLE decompression path crashes the decoding process on ILP32 (32-bit) builds across versions 3.2.0-3.2.10, 3.3.0-3.3.12, and 3.4.0-3.4.13. A crafted .exr file with a malicious RLE-compressed payload causes the 64-bit unpacked size to truncate before buffer allocation in OpenEXRCore decoding.c, after which unpack_32bit() reads past the allocated buffer boundary, resulting in denial of service. Exploitation requires a victim or automated pipeline to open the malicious file; no public exploit identified at time of analysis, and the vulnerability is constrained to ILP32 build environments.
Out-of-bounds read in OpenEXR's ILP32 builds enables denial of service via crafted uncompressed deep-tile EXR files across three active release branches (before 3.2.11, 3.3.0-3.3.12, and 3.4.0-3.4.13). The root cause is a 32-bit integer overflow in OpenEXRCore's sample-count table size calculation that causes unpack_sample_table() to iterate beyond an undersized allocation. No public exploit or active exploitation has been identified; vendor-released patches are available for all three affected branches.
Out-of-bounds read in Adobe Substance 3D Painter exposes sensitive process memory when a victim opens a specially crafted malicious file. The flaw, classified as CWE-125, causes the application to read beyond allocated buffer boundaries during file parsing, potentially leaking in-memory data such as credentials or session tokens accessible to the attacker. Adobe has published security advisory APSB26-129 addressing the issue; no public exploit code has been identified at time of analysis.
Out-of-bounds read in Adobe Illustrator Desktop 2025 and 2026 exposes sensitive process memory to disclosure when a victim opens a specially crafted file. The vulnerability carries a CVSS 3.1 score of 5.5 (Medium) with a local attack vector and required user interaction, limiting opportunistic exploitation but making it viable in targeted social-engineering campaigns. No public exploit code has been identified and the vulnerability is not listed in the CISA KEV catalog at time of analysis.
Arbitrary file system read in Adobe's Content Credentials (C2PA Tool and Content Credentials Rust SDK) exposes sensitive files and directories outside the intended access scope through improper input validation during file parsing. The attack requires a victim to open a malicious file crafted by the attacker, making this a local, user-interaction-dependent vulnerability with high confidentiality impact but no integrity or availability consequence. No public exploit code exists and this CVE is not listed in the CISA KEV catalog at time of analysis.
NVIDIA Unified Fabric Manager Enterprise session management embeds a hard-coded cryptographic key (CWE-321), enabling a local attacker to extract session material and potentially escalate privileges within the InfiniBand fabric management plane. All four active UFM Enterprise release tracks - GA, LTS 2023, LTS 2024, and LTS 2025 - are confirmed affected per CPE data published by NVIDIA. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS data is absent from available intelligence, limiting probabilistic exploitation forecasting.
Command injection in NVIDIA UFM Enterprise's IBDiagnet API allows an authenticated administrator with adjacency-level network access to execute arbitrary OS commands on the host system, potentially achieving full compromise. All major release trains are affected - GA, LTS 2023, LTS 2024, and LTS 2025 - as confirmed by NVIDIA's own advisory and NVD CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, keeping real-world opportunistic risk constrained by the high privilege and network adjacency prerequisites.
Command injection in NVIDIA UFM Enterprise's user management component enables an authenticated administrator to execute arbitrary OS-level commands by sending a crafted API request, spanning all active release tracks (GA, LTS 2023, LTS 2024, LTS 2025). Successful exploitation can yield full code execution on the UFM host, privilege escalation beyond the administrative role, and disclosure of sensitive InfiniBand fabric management data. No public exploit code or CISA KEV listing has been identified at time of analysis, and the adjacent network attack vector (AV:A) constrains the realistic attacker population to those with both admin credentials and access to the management network segment.
Integer overflow leading to out-of-bounds write in NI LabVIEW 2026 Q3 and prior enables information disclosure or arbitrary code execution when a user opens a specially crafted VI file. The attack is file-based and requires social engineering to deliver a malicious Virtual Instrument file to a target, making it a credible threat in engineering, research, and industrial automation environments where VI files are routinely shared. No public exploit identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Out-of-bounds read in the NVIDIA DGX Spark standalone Memory Management (MM) firmware enables a local high-privileged attacker to read beyond allocated buffer boundaries, leaking potentially sensitive memory contents across security boundaries (S:C/C:H per the CVSS vector). The scope change in the CVSS vector suggests that data disclosed may originate from security domains beyond the firmware itself, such as the host OS or adjacent processes. No public exploit code or active exploitation has been identified at time of analysis, and the high-privilege local access requirement substantially constrains the realistic attacker population.
Out-of-bounds read in NI LabVIEW 2026 Q3 and all prior versions can result in information disclosure or arbitrary code execution when the application processes a maliciously crafted VI file containing a specially structured image. The root cause is a signed-to-unsigned integer conversion error (CWE-195) in the image-loading code path, causing the parser to read beyond intended memory boundaries. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Out-of-bounds read in the Zephyr ext2 filesystem driver crashes any device that mounts a crafted ext2 image. The superblock fields s_blocks_count and s_first_data_block are consumed verbatim without being bounded against the single-group bitmap capacity, allowing a malicious image to drive ext2_bitmap_count_set() roughly 512 MB past the allocated bitmap block. The resulting memory access crosses an unmapped or MPU-protected region and faults, producing a denial-of-service crash. No public exploit exists and the vulnerability is not in CISA KEV; real-world risk is bounded by the requirement to supply untrusted ext2 media to a target device.
Credential exposure in rclone before v1.75.0 allows network-adjacent attackers to capture IBM IAM bearer tokens during same-host HTTPS-to-HTTP redirect downgrades, or SSE-C customer-provided encryption keys during cross-origin S3 redirects. The S3 redirect callback in s3.go correctly strips X-Amz-Security-Token on host changes but omits IBM IAM Authorization headers and SSE-C key headers from its denylist, exploiting a gap in Go's built-in redirect sanitization that does not treat scheme downgrades as a credential boundary. A proof-of-concept is documented in GHSA-8mxv-9xhp-86h4; no public exploit tool has been independently identified, and the vulnerability is not listed in CISA KEV at time of analysis.
Credential exposure in rclone's WebDAV backend allows an adjacent on-path attacker to capture and replay Basic authentication passwords, bearer tokens, or session cookies transmitted in cleartext after a same-host HTTPS-to-HTTP redirect. All rclone versions through v1.74.0-240 are affected when the WebDAV backend is configured with Basic credentials or cookie-based authentication. No public exploit code has been released, but a proof-of-concept was demonstrated and documented in the GHSA advisory as part of responsible disclosure.
Stack trace disclosure in rclone's RC API exposes internal file paths, Go module versions, goroutine states, and memory addresses to authenticated API callers who intentionally trigger panics. All rclone versions through v1.74.4 with the RC API enabled are affected; the vulnerability is rooted in the panic recovery handler at fs/rc/jobs/job.go including raw debug.Stack() output directly in HTTP JSON error responses. A proof-of-concept is confirmed in the GHSA advisory; no public exploit identified at time of analysis beyond that PoC, and this vulnerability is not listed in CISA KEV.