Information Disclosure
Monthly
Cross-origin data leakage in Google Chrome's MHTML parser prior to version 151.0.7922.72 enables remote attackers to read data from origins they should not have access to, violating the Same-Origin Policy. The vulnerability requires user interaction - a victim must open a crafted MHTML page - and produces a limited confidentiality impact with no integrity or availability exposure. No public exploit code exists and no active exploitation has been identified; EPSS of 0.17% (7th percentile) and Chromium's own 'Low' severity rating confirm this is a low-urgency finding despite broad product deployment.
Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.
Memory disclosure in Google Chrome's Dawn WebGPU component (prior to 151.0.7922.72) enables an attacker who has already obtained code execution in the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - not a standalone exploit - requiring a prior, separate renderer compromise before this flaw is reachable. Chromium's own severity rating is Low, consistent with the EPSS score of 0.19% and SSVC classification of no active exploitation and partial technical impact; no public exploit or KEV listing exists.
UI spoofing in Google Chrome's Navigation component prior to version 151.0.7922.72 enables an attacker who has already compromised the renderer process to manipulate browser UI elements via crafted HTML pages. The Chromium team assigned Low internal severity, consistent with a CVSS score of 4.3, EPSS at the 7th percentile (0.17%), and SSVC exploitation status of 'none'. No public exploit code or active exploitation has been identified, and the vulnerability is only meaningful as a second-stage element in a multi-vulnerability attack chain.
Side-channel information leakage in Google Chrome's SVG rendering engine prior to version 151.0.7922.72 allows a remote attacker to infer cross-origin data by luring a user to a crafted HTML page. Rooted in CWE-1300 (Improper Protection of Physical Side Channels), the flaw violates the browser's same-origin policy isolation by exposing measurable signals during SVG processing that reveal data from a separate origin. No public exploit has been identified, SSVC confirms exploitation status of none, and EPSS sits at 0.17% (7th percentile), placing real-world priority firmly in the low tier for most environments.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.
UI spoofing in Google Chrome's Passwords component before version 151.0.7922.72 allows remote attackers to manipulate credential-related UI elements via malicious network traffic, exploiting insufficient input validation in the password manager subsystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable without authentication but requires user interaction, limiting automated mass exploitation. With an EPSS of 0.16% (6th percentile), no KEV listing, and no known POC, real-world exploitation risk is low despite the ubiquitous deployment footprint of Chrome.
UI spoofing in Google Chrome for Android prior to version 151.0.7922.72 stems from an inappropriate FullScreen API implementation that allows remote attackers to deceive users with a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms this is network-accessible without authentication but requires user interaction with a malicious page. With an EPSS of 0.21% at the 11th percentile, no CISA KEV listing, and Chromium's own 'Low' severity designation, real-world exploitation interest is minimal and no public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's DOMStorage component (versions prior to 151.0.7922.72) permits a remote attacker to read storage data belonging to a different origin by luring a victim to a crafted HTML page. The flaw is rooted in an origin validation error (CWE-346) within the DOMStorage subsystem, violating same-origin policy enforcement. EPSS is very low at 0.17% (7th percentile), no active exploitation is confirmed, and Chromium itself rates this Low severity, placing this in the lower tier of browser security issues despite its network-reachable attack surface.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows remote attackers to read sensitive data from other origins by luring a victim to a crafted HTML page that abuses an inappropriate implementation in the DataTransfer API. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability effects, and Chromium's own security team rated this Low severity. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability of exploitation is very low at 0.17% (7th percentile).
DevTools policy enforcement failure in Google Chrome prior to 151.0.7922.72 enables cross-origin data leakage through a malicious Chrome Extension that a victim is socially engineered into installing. The vulnerability is classified as information disclosure only (C:L/I:N/A:N), requires active user participation to exploit, and carries Chromium's lowest internal severity rating. No public exploit code exists and no active exploitation has been identified; EPSS places this at the 2nd percentile, and SSVC confirms exploitation status as none with non-automatable delivery.
UI spoofing in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker to mislead users about the origin or security context of displayed content via a crafted HTML page. Classified by Chromium as Low severity and rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could be leveraged to facilitate phishing or social engineering by making malicious content visually indistinguishable from trusted interfaces. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating this is a routine patch-cycle issue rather than an active threat.
Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.
UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.
Cross-origin data leakage in Google Chrome versions prior to 151.0.7922.72 stems from insufficient policy enforcement in the SVG rendering engine, allowing remote attackers to read data across origin boundaries by enticing a victim to visit a crafted HTML page. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation but mandates active user interaction, constraining mass exploitation. No public exploit has been identified at time of analysis; EPSS stands at 0.17% (7th percentile) and SSVC signals exploitation status of none, placing this firmly in routine-patch priority.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the browser's Web NFC API, classified under CWE-346 (Origin Validation Error). A remote attacker can serve a crafted HTML page that - when visited by a victim on an Android device - causes Chrome to violate its cross-origin isolation policy via the NFC subsystem, exposing cross-origin data to the attacker-controlled page. No public exploit has been identified at time of analysis; EPSS is 0.17% (7th percentile) and CISA SSVC rates exploitation as none, confirming low real-world urgency despite the network-accessible vector.
Cross-origin data leakage in Google Chrome's Isolated Web Apps (IWA) feature, versions prior to 151.0.7922.72, enables remote attackers to exfiltrate data across origin boundaries via crafted network traffic, contingent on user interaction. With an EPSS of 0.16% (6th percentile), no CISA KEV listing, and Chromium's own 'Low' severity classification, real-world exploitation risk is constrained despite the network-accessible vector. No public exploit has been identified at time of analysis, and impact is limited to partial confidentiality loss with no integrity or availability consequence.
Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.
Side-channel information leakage in Google Chrome's Network component prior to version 151.0.7922.72 enables remote attackers to infer cross-origin data by directing users to a crafted HTML page, violating Same-Origin Policy boundaries at the side-channel layer. The Chromium team rated this Low severity internally; with no public exploit code and no CISA KEV listing, the EPSS score of 0.17% (7th percentile) confirms that near-term mass exploitation is highly unlikely. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequences, making this a low-urgency patch for most environments, though higher priority in privacy-sensitive or intelligence-adjacent deployments.
Sandbox escape in Google Chrome's Bluetooth component (all versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox by sending crafted Bluetooth IPC messages triggered via a malicious HTML page. This is a second-stage, chained exploit - not a standalone remote attack - requiring prior renderer compromise as a hard prerequisite, which is why Chromium rates it Low severity internally despite the sandbox escape classification. No public exploit code or CISA KEV listing has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability consistent with the high attack chain complexity.
SurfaceCapture in Google Chrome prior to 151.0.7922.72 leaks cross-origin data to remote attackers through a crafted HTML page, violating browser same-origin isolation. The flaw is classified as CWE-346 (Origin Validation Error), meaning the SurfaceCapture subsystem fails to properly enforce origin boundaries, allowing data from one origin to be read by another. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the NFC subsystem, enabling a remote attacker to read data across origin boundaries. An unauthenticated attacker (per PR:N in the CVSS vector) can serve a crafted HTML page that, when visited by a target on Android Chrome, bypasses same-origin policy checks tied to NFC API handling, resulting in limited confidentiality disclosure. No active exploitation has been identified at time of analysis, EPSS sits at 0.17% (7th percentile), and Chromium itself rates this Low severity - placing real-world risk well below its nominal network-accessible footprint.
Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.
Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable by remote unauthenticated attackers who can lure a victim to a crafted HTML page that abuses an inappropriate implementation in Chrome's Opaque Response Blocking (ORB) mechanism. ORB is specifically designed to prevent unauthorized cross-origin reads; this flaw undermines that protection, allowing an attacker's page to read data belonging to a different origin in violation of the same-origin policy. EPSS is 0.18% (8th percentile), SSVC classifies exploitation as none, and no active exploitation or public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's DataTransfer API implementation (prior to 151.0.7922.72) allows a remote unauthenticated attacker to read sensitive data from a different origin when a victim performs specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. The vulnerability is rated CVSS 4.3 (Medium) with an EPSS probability of just 0.18% (8th percentile), indicating very low observed exploitation activity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but Chrome's widespread deployment makes even medium-severity browser flaws worth prioritizing for rapid patching.
Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.
Memory disclosure in Google Chrome's WebXR implementation allows remote attackers to read sensitive data from process memory by directing a victim to a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on desktop platforms. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current exploitation activity, making this a moderate-priority patching item despite the High confidentiality impact in the CVSS score.
Sandbox escape in Google Chrome DevTools prior to version 151.0.7922.72 requires a pre-compromised renderer process and user interaction with a crafted HTML page to break out of the browser sandbox. The root cause is insufficient input validation (CWE-20) in the DevTools component, where attacker-controlled input from the renderer is not properly sanitized before being processed. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.18%, indicating low observed exploitation pressure despite the meaningful impact of a successful sandbox escape.
Cross-origin data leakage in Google Chrome's WebXR implementation (versions prior to 151.0.7922.72) arises from an uninitialized memory use flaw exploitable by a remote attacker via a crafted HTML page that must be visited by the victim. The flaw allows partial disclosure of cross-origin data, with no integrity or availability impact. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.20% at the 10th percentile confirms this is a low-probability exploitation target in the near term.
Cross-origin data leakage in Google Chrome's Paint subsystem (all versions prior to 151.0.7922.72) allows a remote attacker to read data belonging to other web origins by delivering a crafted HTML page to a victim. The root cause is an origin validation error (CWE-346) in the Paint rendering component, permitting cross-origin information to surface where it should be isolated. No public exploit code exists and EPSS registers 0.18% (8th percentile), confirming low exploitation probability - this is a medium-severity patch-cycle priority, not an emergency.
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) can be triggered remotely by luring a victim to a crafted HTML page, exposing data that should be isolated under the Same-Origin Policy. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's Autofill implementation fails to properly enforce cross-origin boundaries when processing form data. No public exploit exists and the EPSS score of 0.22% (12th percentile) reflects low near-term exploitation likelihood; the issue is patched in the stable channel release 151.0.7922.72.
Cross-origin data leakage in Google Chrome's Autofill subsystem (versions prior to 151.0.7922.72) enables remote attackers to extract sensitive cross-origin information by directing a user to a specially crafted HTML page. The root cause is an inappropriate implementation within Autofill that fails to enforce proper origin boundaries (CWE-346), allowing page-level interactions to surface data from contexts the page should not be able to read. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.22% (12th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
Cross-origin data leakage in Google Chrome's Payments component (all versions prior to 151.0.7922.72) enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is an inappropriate implementation in the Payments subsystem (CWE-346: Origin Validation Error), violating the browser's same-origin policy for payment-related data flows. EPSS is 0.18% (8th percentile) and no CISA KEV listing or public exploit has been identified, indicating low exploitation probability despite ubiquitous product deployment.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), enabling a remote attacker to exfiltrate limited cross-origin credential-related data via a crafted HTML page. Exploitation requires the target user to perform specific, undisclosed UI gestures - such as interacting with a password field or autofill prompt - on the attacker's page, limiting mass-scale automation. No public exploit code or CISA KEV listing exists; EPSS at 0.18% (8th percentile) confirms low real-world exploitation probability, consistent with the mandatory social-engineering prerequisite.
Cross-origin data leakage in Google Chrome's Cast component allows an unauthenticated attacker positioned on the same local network segment to read data from origins they should not have access to via maliciously crafted network traffic. All Chrome versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA has not listed this in the KEV catalog, placing real-world risk at low-to-moderate despite the unauthenticated attack vector.
Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.
Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.
Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.
Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.
Cross-origin data leakage in Google Chrome prior to version 151.0.7922.72 allows remote attackers to read data across origin boundaries by inducing a user to visit a specially crafted HTML page. The flaw resides in Chrome's network layer and is classified as CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce origin boundaries during certain network operations. No active exploitation has been confirmed (not in CISA KEV), and EPSS places exploitation probability at 0.18% (8th percentile), indicating low current threat activity despite widespread browser deployment.
Side-channel information leakage in Chrome's Autofill component exposes cross-origin data to remote attackers who have already achieved renderer process compromise. All Chrome versions prior to 151.0.7922.72 are affected across all platforms. With an EPSS of 0.22% (12th percentile), no CISA KEV listing, and a mandatory renderer-compromise prerequisite, real-world exploitation risk is substantially lower than the CVSS base score implies - this is a chained second-stage disclosure, not a standalone attack. No public exploit identified at time of analysis.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to manipulate the displayed URL via malicious network traffic, deceiving users about the true origin of page content. The flaw is iOS-platform-specific and classified under CWE-451 (UI Misrepresentation of Critical Information), making it a phishing-enablement vulnerability rather than a code execution or data-exfiltration primitive. No public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.20% (10th percentile).
Cross-origin data leakage in Google Chrome's Cast subsystem (versions prior to 151.0.7922.72) allows unauthenticated attackers on the same local network segment to extract sensitive cross-origin browser data via crafted network traffic. The insufficient input validation in the Cast component bypasses browser isolation boundaries, exposing data from origins the victim is actively browsing. No public exploit code or active exploitation (CISA KEV) has been identified, and an EPSS of 0.12% (2nd percentile) reflects very low near-term exploitation probability.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a user to a crafted HTML page exploiting an origin validation flaw in the CSS engine. The vulnerability is classified under CWE-346 (Origin Validation Error) and is confirmed patched in the 151.0.7922.72 stable channel release. No public exploit code has been identified, SSVC rates exploitation as none, and EPSS sits at 0.18% - all consistent with low near-term exploitation likelihood.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.
Domain spoofing via incorrect security UI in Google Chrome's built-in Passwords feature affects all Chrome versions prior to 151.0.7922.72. Remote unauthenticated attackers can serve a crafted HTML page that causes Chrome to misrepresent the origin domain within the password management UI, enabling deception of users into associating saved credentials with an attacker-controlled domain. No public exploit code has been identified at time of analysis, and EPSS at 0.18% (8th percentile) signals very low automated exploitation probability, though Chrome's ubiquitous deployment makes even low-probability credential phishing scenarios broadly impactful.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to misrepresent browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site or legitimate browser chrome. The vulnerability maps to CWE-451 (UI Misrepresentation of Critical Information) and carries a High integrity impact despite no direct confidentiality or availability loss, because successful spoofing can facilitate credential theft or social engineering at scale. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) reflects low current opportunistic exploitation probability.
Domain spoofing in Google Chrome on iOS prior to 151.0.7922.72 allows a remote unauthenticated attacker to misrepresent the displayed origin in the browser's security UI by delivering a crafted HTML page to a victim. The flaw (CWE-451) enables phishing-class attacks where the address bar or site identity indicator shows a trusted domain while content is served from a different origin. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low automated exploitation likelihood, but the integrity impact is high for targeted phishing campaigns against iOS Chrome users.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. No public exploit code or active exploitation has been identified; EPSS sits at 0.17% (7th percentile), indicating low current exploitation interest despite the vendor-confirmed patch.
Cross-origin data leakage in Google Chrome's Passwords component (prior to 151.0.7922.72) allows a remote attacker to read credential or password-related data across origin boundaries by enticing a user to visit a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the Passwords feature, where Chrome fails to properly enforce same-origin constraints. No public exploit code has been identified and SSVC signals no known active exploitation, placing this in the medium-priority tier despite Chrome's ubiquitous deployment footprint.
UI spoofing in Google Chrome's Passwords component prior to version 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to manipulate the browser's password-related interface via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Passwords subsystem, allowing integrity-impacting spoofing of security-sensitive UI elements such as password prompts or save/fill dialogs. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with the elevated prerequisite of a prior renderer compromise.
Cross-origin data leakage in Google Chrome's built-in Passwords component (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to read cross-origin data by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error) within the password management subsystem, meaning the browser fails to correctly validate origin boundaries when the Passwords component processes or exposes credential-related data. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code exists, and this CVE is not listed in the CISA KEV catalog, indicating low observed real-world exploitation pressure despite the ubiquity of the affected product.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to the victim (CWE-451). The CVSS vector assigns high integrity impact (I:H) with no privileges required from the attacker, but mandates user interaction (UI:R), meaning the victim must visit the malicious page. No public exploit identified at time of analysis, and an EPSS score of 0.17% at the 7th percentile indicates very low observed exploitation interest; Chromium's own severity rating of Medium aligns with this assessment.
Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.
UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.
Cross-origin data leakage in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The flaw is rooted in insufficient policy enforcement (CWE-346: Origin Validation Error) within Chrome's Autofill feature, which fails to correctly gate form data access by origin. No public exploit code has been identified and CISA SSVC rates active exploitation as none, placing real-world risk well below what the network-based attack vector alone might suggest.
UI spoofing in Google Chrome's WebAppInstalls component (all versions prior to 151.0.7922.72) allows a remote attacker to misrepresent critical interface elements through a crafted HTML page, deceiving users into interacting with fraudulent Chrome UI. The flaw stems from inappropriate implementation in the Progressive Web App installation flow, rated CVSS 6.5 with high integrity impact reflecting the attacker's ability to manipulate perceived interface state. No public exploit identified at time of analysis, and an EPSS of 0.17% (7th percentile) confirms negligible observed exploitation activity.
Cross-origin data leakage in Google Chrome's ReportingAndNEL subsystem (versions prior to 151.0.7922.72) allows a remote attacker to exfiltrate limited cross-origin information by delivering a crafted HTML page to a victim user. The flaw stems from an origin validation error (CWE-346) in the Network Error Logging and Reporting API implementation. No public exploit code has been identified and SSVC confirms exploitation status as none, but the combination of a network attack vector, no privilege requirement, and ubiquitous browser deployment makes patch application a straightforward priority.
Cross-origin data leak in Google Chrome's GuestView component (all desktop versions prior to 151.0.7922.72) enables remote attackers to read cross-origin content by luring a victim to a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-346, Origin Validation Error) within the GuestView subsystem, which handles embedded guest content such as <webview> elements in Chrome Apps and extensions. No public exploit code has been identified and CISA has not added this to the KEV catalog; an EPSS of 0.21% at the 11th percentile confirms low exploitation probability at time of analysis.
UI spoofing via the DigitalCredentials API in Google Chrome prior to 151.0.7922.72 allows a remote, unauthenticated attacker to deceive users about the legitimacy or origin of credential-related dialogs through a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's handling of the DigitalCredentials web API (CWE-451), enabling misrepresentation of critical UI information. No active exploitation is confirmed (no CISA KEV listing), and with an EPSS score of 0.17% at the 7th percentile, real-world exploitation probability is currently very low.
Cross-origin data leakage in Google Chrome's Dawn WebGPU component (versions prior to 151.0.7922.72) enables remote attackers to read cross-origin data via a crafted HTML page that triggers uninitialized memory use (CWE-457). Exploitation requires the victim to visit an attacker-controlled page but demands no authentication and operates against default Chrome configurations. No public exploit has been identified at time of analysis and the EPSS score of 0.23% (14th percentile) reflects a currently low exploitation likelihood, consistent with Chromium's own Medium severity rating.
Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) enables an attacker who has already achieved renderer-process compromise to break out of Chrome's sandbox via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Extensions subsystem, with a CVSS Scope:Changed rating confirming the impact extends beyond the browser process to the host OS. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with absence from CISA KEV - but the sandbox escape class carries disproportionate risk relative to its 5.8 base score because it enables full host-level code execution when chained with a renderer RCE.
Cross-origin data leakage in Google Chrome's WebGL implementation on Android allows a remote attacker to read memory contents belonging to other origins via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. The vulnerability stems from uninitialized memory use (CWE-457) in the WebGL subsystem, exposing stale memory that may contain sensitive cross-origin data. No public exploit code exists and EPSS sits at 0.23% (14th percentile), indicating low current exploitation probability; this is not listed in CISA KEV.
Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The CVSS Scope:Changed metric confirms this is a true sandbox escape, elevating impact beyond the renderer isolation boundary. No public exploit code exists and EPSS stands at 0.17% (7th percentile), reflecting the chained, high-complexity nature of the attack. Google has released a patched stable channel build (151.0.7922.72).
Side-channel GPU information leakage in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability exploits the GPU rendering pipeline to observe timing or state artifacts that escape the Same-Origin Policy boundary, allowing partial disclosure of data from other origins loaded in the browser. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation probability; a vendor-released patch is available.
Memory disclosure in Google Chrome's MediaRecording subsystem allows remote attackers to read sensitive data from the browser process by enticing a user to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across supported platforms. No public exploit exists and EPSS probability stands at only 0.21% (11th percentile); SSVC also assesses exploitation as none and the attack as non-automatable, making this a patch-track rather than emergency-response priority despite the CVSS 6.5 base score.
Cross-origin data leakage in Google Chrome's Cast feature affects all versions prior to 151.0.7922.72, enabling a remote attacker to read data across origin boundaries by luring a user to a crafted HTML page. The flaw stems from improper origin validation (CWE-346) within the Cast subsystem, violating the Same-Origin Policy. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating limited real-world exploitation pressure at time of analysis.
Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.
Cross-origin data leakage via an inappropriate GetUserMedia implementation in Google Chrome prior to 151.0.7922.72 enables a renderer-level attacker to exfiltrate data across origin boundaries using a crafted HTML page. Exploitation is gated behind a prior renderer process compromise, making this a chained or post-exploitation capability rather than a standalone initial-access vector. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting low real-world exploitation probability despite the broad deployment footprint of Chrome.
Omnibox (URL bar) spoofing in Google Chrome for Android prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to display arbitrary URL content in the address bar via a crafted HTML page. This is explicitly a second-stage chained vulnerability - renderer compromise is a mandatory prerequisite, meaning the flaw functions as an escalation primitive rather than a standalone attack. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) reflects very low opportunistic exploitation probability, though the phishing and credential-theft potential when chained with a renderer exploit is meaningful.
UI spoofing in Google Chrome's Messages component on Android allows remote unauthenticated attackers to misrepresent critical interface information to victims via crafted HTML pages. Affects all Chrome for Android versions prior to 151.0.7922.72; desktop Chrome is not listed as affected. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) signals low current exploitation probability consistent with the mandatory user-interaction requirement.
UI spoofing via Chrome's Credential Management component (versions prior to 151.0.7922.72) enables a remote attacker to misrepresent credential-related browser UI to a user who visits a crafted HTML page. The flaw stems from an inappropriate implementation of the Credential Management API (CWE-451), which can cause the browser to render misleading prompts that mimic legitimate credential dialogs. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS probability is very low at 0.21%, consistent with SSVC's 'Exploitation: none' classification.
UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) can be achieved by a remote attacker who has already compromised the renderer process, enabling deceptive payment interfaces via a crafted HTML page. The CVSS vector scores integrity impact as High (I:H) with no confidentiality or availability impact, reflecting the ability to mislead users through falsified UI elements in a sensitive financial context. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), indicating this vulnerability is not yet being actively targeted at scale.
Uninitialized memory read in ANGLE (Chrome's graphics abstraction layer) on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Affected are all Google Chrome releases on Windows prior to 151.0.7922.72. An attacker who persuades a user to visit a malicious page can trigger the ANGLE component to read and potentially leak uninitialized memory, risking disclosure of in-process data. No public exploit code has been identified and EPSS stands at 0.23% (14th percentile), indicating low observed exploitation probability despite the broad deployment footprint of Chrome.
Cross-origin data leakage in Google Chrome's Blink rendering engine (all versions prior to 151.0.7922.72) enables remote attackers to read data from other origins by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-delivered, requires no authentication, and succeeds with only user interaction - a single page visit. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate low exploitation probability and no confirmed active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to read fragments of sensitive data from other origins by directing a user to a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) in ANGLE, Chrome's cross-platform OpenGL ES abstraction engine, which may expose residual graphics buffer contents from previously rendered cross-origin content. No public exploit code and no active exploitation have been identified at time of analysis; EPSS of 0.23% (14th percentile) reflects low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables a remote attacker to read data from a different web origin by inducing a victim to visit a crafted HTML page. The flaw is rooted in an inappropriate implementation of origin validation (CWE-346) within the resource-loading subsystem, undermining the browser's Same-Origin Policy enforcement. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating low exploitation likelihood at this time; however, the impact class is meaningful for users with active authenticated sessions to sensitive web applications.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about the actual origin of the page they are viewing by serving a crafted HTML page. The flaw is a CWE-451 UI misrepresentation defect, meaning the browser fails to accurately convey security-critical location information to the user, creating a reliable phishing vector. No public exploit code exists and EPSS sits at 0.21% (11th percentile); SSVC confirms exploitation as none and technical impact as partial, placing this firmly in lower-priority remediation tiers despite the phishing relevance.
Cross-origin data leakage in Google Chrome's Autofill component (versions prior to 151.0.7922.72) allows remote attackers to read data from a different origin than the page being visited. Exploitation requires the victim to interact with a specially crafted HTML page, placing this firmly in the social-engineering/phishing threat model. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating negligible observed exploitation activity; this is not currently listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Presentation API prior to version 151.0.7922.72 enables remote attackers to exfiltrate sensitive same-browser data by delivering a crafted HTML page to an unsuspecting user. The flaw violates the Same-Origin Policy through an origin validation error (CWE-346) in the PresentationAPI component, potentially exposing session tokens, authentication state, or other sensitive content from co-resident origins. No public exploit has been identified and EPSS sits at the 11th percentile (0.21%), indicating low mass-exploitation risk at time of analysis.
Cross-origin data leakage in Google Chrome's Cast subsystem (all versions prior to 151.0.7922.72) enables a remote unauthenticated attacker to exfiltrate sensitive cross-origin data by luring a victim to a specially crafted HTML page. The vulnerability, rated Medium by the Chromium security team with a CVSS of 4.3, is bounded to a limited confidentiality impact with no code execution risk. No active exploitation is confirmed in CISA KEV, and EPSS at 0.21% (11th percentile) indicates a very low probability of widespread in-the-wild exploitation at time of analysis.
Out-of-bounds memory read in Google Chrome's WebGL implementation (versions prior to 151.0.7922.72) allows a remote attacker to disclose limited browser process memory contents when a victim visits a crafted HTML page. Impact is confined to partial confidentiality - no write primitive exists, ruling out direct code execution. No public exploit has been identified and SSVC confirms no active exploitation, placing this in a lower-priority patch tier despite its network-accessible attack vector.
Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, exploitable by a remote unauthenticated attacker through a crafted HTML page that a victim must visit. The flaw stems from uninitialized memory use in Skia (CWE-457), allowing stale heap or stack data to be read and potentially exfiltrated across origin boundaries, undermining the browser's same-origin policy protections. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.23% (14th percentile), but the patch is confirmed available and the product's ubiquitous deployment makes broad-surface exposure a consideration.
Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.
Cross-origin data leakage in Google Chrome's Cast component exposes sensitive information across origins to remote attackers who can induce a victim to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.21% (11th percentile) reflects low current exploitation probability, consistent with Google's own 'Medium' severity classification.
Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by delivering a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, making it a chained exploit rather than a standalone attack. No active exploitation is confirmed in CISA KEV, and EPSS is 0.21% (11th percentile), consistent with low observed exploitation activity despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) allows a local attacker to read clipboard contents belonging to a different browsing origin by luring a victim to a crafted HTML page. The flaw arises from insufficient input validation in Chrome's Clipboard component on Android, classified under CWE-20. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.13% at the 3rd percentile reflects a minimal real-world exploitation probability at this time.
Cross-origin data leakage in Google Chrome's MHTML parser prior to version 151.0.7922.72 enables remote attackers to read data from origins they should not have access to, violating the Same-Origin Policy. The vulnerability requires user interaction - a victim must open a crafted MHTML page - and produces a limited confidentiality impact with no integrity or availability exposure. No public exploit code exists and no active exploitation has been identified; EPSS of 0.17% (7th percentile) and Chromium's own 'Low' severity rating confirm this is a low-urgency finding despite broad product deployment.
Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.
Memory disclosure in Google Chrome's Dawn WebGPU component (prior to 151.0.7922.72) enables an attacker who has already obtained code execution in the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - not a standalone exploit - requiring a prior, separate renderer compromise before this flaw is reachable. Chromium's own severity rating is Low, consistent with the EPSS score of 0.19% and SSVC classification of no active exploitation and partial technical impact; no public exploit or KEV listing exists.
UI spoofing in Google Chrome's Navigation component prior to version 151.0.7922.72 enables an attacker who has already compromised the renderer process to manipulate browser UI elements via crafted HTML pages. The Chromium team assigned Low internal severity, consistent with a CVSS score of 4.3, EPSS at the 7th percentile (0.17%), and SSVC exploitation status of 'none'. No public exploit code or active exploitation has been identified, and the vulnerability is only meaningful as a second-stage element in a multi-vulnerability attack chain.
Side-channel information leakage in Google Chrome's SVG rendering engine prior to version 151.0.7922.72 allows a remote attacker to infer cross-origin data by luring a user to a crafted HTML page. Rooted in CWE-1300 (Improper Protection of Physical Side Channels), the flaw violates the browser's same-origin policy isolation by exposing measurable signals during SVG processing that reveal data from a separate origin. No public exploit has been identified, SSVC confirms exploitation status of none, and EPSS sits at 0.17% (7th percentile), placing real-world priority firmly in the low tier for most environments.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.
UI spoofing in Google Chrome's Passwords component before version 151.0.7922.72 allows remote attackers to manipulate credential-related UI elements via malicious network traffic, exploiting insufficient input validation in the password manager subsystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable without authentication but requires user interaction, limiting automated mass exploitation. With an EPSS of 0.16% (6th percentile), no KEV listing, and no known POC, real-world exploitation risk is low despite the ubiquitous deployment footprint of Chrome.
UI spoofing in Google Chrome for Android prior to version 151.0.7922.72 stems from an inappropriate FullScreen API implementation that allows remote attackers to deceive users with a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms this is network-accessible without authentication but requires user interaction with a malicious page. With an EPSS of 0.21% at the 11th percentile, no CISA KEV listing, and Chromium's own 'Low' severity designation, real-world exploitation interest is minimal and no public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's DOMStorage component (versions prior to 151.0.7922.72) permits a remote attacker to read storage data belonging to a different origin by luring a victim to a crafted HTML page. The flaw is rooted in an origin validation error (CWE-346) within the DOMStorage subsystem, violating same-origin policy enforcement. EPSS is very low at 0.17% (7th percentile), no active exploitation is confirmed, and Chromium itself rates this Low severity, placing this in the lower tier of browser security issues despite its network-reachable attack surface.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows remote attackers to read sensitive data from other origins by luring a victim to a crafted HTML page that abuses an inappropriate implementation in the DataTransfer API. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability effects, and Chromium's own security team rated this Low severity. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability of exploitation is very low at 0.17% (7th percentile).
DevTools policy enforcement failure in Google Chrome prior to 151.0.7922.72 enables cross-origin data leakage through a malicious Chrome Extension that a victim is socially engineered into installing. The vulnerability is classified as information disclosure only (C:L/I:N/A:N), requires active user participation to exploit, and carries Chromium's lowest internal severity rating. No public exploit code exists and no active exploitation has been identified; EPSS places this at the 2nd percentile, and SSVC confirms exploitation status as none with non-automatable delivery.
UI spoofing in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker to mislead users about the origin or security context of displayed content via a crafted HTML page. Classified by Chromium as Low severity and rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could be leveraged to facilitate phishing or social engineering by making malicious content visually indistinguishable from trusted interfaces. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating this is a routine patch-cycle issue rather than an active threat.
Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.
UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.
Cross-origin data leakage in Google Chrome versions prior to 151.0.7922.72 stems from insufficient policy enforcement in the SVG rendering engine, allowing remote attackers to read data across origin boundaries by enticing a victim to visit a crafted HTML page. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation but mandates active user interaction, constraining mass exploitation. No public exploit has been identified at time of analysis; EPSS stands at 0.17% (7th percentile) and SSVC signals exploitation status of none, placing this firmly in routine-patch priority.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the browser's Web NFC API, classified under CWE-346 (Origin Validation Error). A remote attacker can serve a crafted HTML page that - when visited by a victim on an Android device - causes Chrome to violate its cross-origin isolation policy via the NFC subsystem, exposing cross-origin data to the attacker-controlled page. No public exploit has been identified at time of analysis; EPSS is 0.17% (7th percentile) and CISA SSVC rates exploitation as none, confirming low real-world urgency despite the network-accessible vector.
Cross-origin data leakage in Google Chrome's Isolated Web Apps (IWA) feature, versions prior to 151.0.7922.72, enables remote attackers to exfiltrate data across origin boundaries via crafted network traffic, contingent on user interaction. With an EPSS of 0.16% (6th percentile), no CISA KEV listing, and Chromium's own 'Low' severity classification, real-world exploitation risk is constrained despite the network-accessible vector. No public exploit has been identified at time of analysis, and impact is limited to partial confidentiality loss with no integrity or availability consequence.
Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.
Side-channel information leakage in Google Chrome's Network component prior to version 151.0.7922.72 enables remote attackers to infer cross-origin data by directing users to a crafted HTML page, violating Same-Origin Policy boundaries at the side-channel layer. The Chromium team rated this Low severity internally; with no public exploit code and no CISA KEV listing, the EPSS score of 0.17% (7th percentile) confirms that near-term mass exploitation is highly unlikely. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequences, making this a low-urgency patch for most environments, though higher priority in privacy-sensitive or intelligence-adjacent deployments.
Sandbox escape in Google Chrome's Bluetooth component (all versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox by sending crafted Bluetooth IPC messages triggered via a malicious HTML page. This is a second-stage, chained exploit - not a standalone remote attack - requiring prior renderer compromise as a hard prerequisite, which is why Chromium rates it Low severity internally despite the sandbox escape classification. No public exploit code or CISA KEV listing has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability consistent with the high attack chain complexity.
SurfaceCapture in Google Chrome prior to 151.0.7922.72 leaks cross-origin data to remote attackers through a crafted HTML page, violating browser same-origin isolation. The flaw is classified as CWE-346 (Origin Validation Error), meaning the SurfaceCapture subsystem fails to properly enforce origin boundaries, allowing data from one origin to be read by another. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the NFC subsystem, enabling a remote attacker to read data across origin boundaries. An unauthenticated attacker (per PR:N in the CVSS vector) can serve a crafted HTML page that, when visited by a target on Android Chrome, bypasses same-origin policy checks tied to NFC API handling, resulting in limited confidentiality disclosure. No active exploitation has been identified at time of analysis, EPSS sits at 0.17% (7th percentile), and Chromium itself rates this Low severity - placing real-world risk well below its nominal network-accessible footprint.
Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.
Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable by remote unauthenticated attackers who can lure a victim to a crafted HTML page that abuses an inappropriate implementation in Chrome's Opaque Response Blocking (ORB) mechanism. ORB is specifically designed to prevent unauthorized cross-origin reads; this flaw undermines that protection, allowing an attacker's page to read data belonging to a different origin in violation of the same-origin policy. EPSS is 0.18% (8th percentile), SSVC classifies exploitation as none, and no active exploitation or public exploit code has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's DataTransfer API implementation (prior to 151.0.7922.72) allows a remote unauthenticated attacker to read sensitive data from a different origin when a victim performs specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. The vulnerability is rated CVSS 4.3 (Medium) with an EPSS probability of just 0.18% (8th percentile), indicating very low observed exploitation activity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but Chrome's widespread deployment makes even medium-severity browser flaws worth prioritizing for rapid patching.
Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.
Memory disclosure in Google Chrome's WebXR implementation allows remote attackers to read sensitive data from process memory by directing a victim to a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on desktop platforms. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current exploitation activity, making this a moderate-priority patching item despite the High confidentiality impact in the CVSS score.
Sandbox escape in Google Chrome DevTools prior to version 151.0.7922.72 requires a pre-compromised renderer process and user interaction with a crafted HTML page to break out of the browser sandbox. The root cause is insufficient input validation (CWE-20) in the DevTools component, where attacker-controlled input from the renderer is not properly sanitized before being processed. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.18%, indicating low observed exploitation pressure despite the meaningful impact of a successful sandbox escape.
Cross-origin data leakage in Google Chrome's WebXR implementation (versions prior to 151.0.7922.72) arises from an uninitialized memory use flaw exploitable by a remote attacker via a crafted HTML page that must be visited by the victim. The flaw allows partial disclosure of cross-origin data, with no integrity or availability impact. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.20% at the 10th percentile confirms this is a low-probability exploitation target in the near term.
Cross-origin data leakage in Google Chrome's Paint subsystem (all versions prior to 151.0.7922.72) allows a remote attacker to read data belonging to other web origins by delivering a crafted HTML page to a victim. The root cause is an origin validation error (CWE-346) in the Paint rendering component, permitting cross-origin information to surface where it should be isolated. No public exploit code exists and EPSS registers 0.18% (8th percentile), confirming low exploitation probability - this is a medium-severity patch-cycle priority, not an emergency.
Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) can be triggered remotely by luring a victim to a crafted HTML page, exposing data that should be isolated under the Same-Origin Policy. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's Autofill implementation fails to properly enforce cross-origin boundaries when processing form data. No public exploit exists and the EPSS score of 0.22% (12th percentile) reflects low near-term exploitation likelihood; the issue is patched in the stable channel release 151.0.7922.72.
Cross-origin data leakage in Google Chrome's Autofill subsystem (versions prior to 151.0.7922.72) enables remote attackers to extract sensitive cross-origin information by directing a user to a specially crafted HTML page. The root cause is an inappropriate implementation within Autofill that fails to enforce proper origin boundaries (CWE-346), allowing page-level interactions to surface data from contexts the page should not be able to read. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.22% (12th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.
Cross-origin data leakage in Google Chrome's Payments component (all versions prior to 151.0.7922.72) enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is an inappropriate implementation in the Payments subsystem (CWE-346: Origin Validation Error), violating the browser's same-origin policy for payment-related data flows. EPSS is 0.18% (8th percentile) and no CISA KEV listing or public exploit has been identified, indicating low exploitation probability despite ubiquitous product deployment.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.
Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.
Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), enabling a remote attacker to exfiltrate limited cross-origin credential-related data via a crafted HTML page. Exploitation requires the target user to perform specific, undisclosed UI gestures - such as interacting with a password field or autofill prompt - on the attacker's page, limiting mass-scale automation. No public exploit code or CISA KEV listing exists; EPSS at 0.18% (8th percentile) confirms low real-world exploitation probability, consistent with the mandatory social-engineering prerequisite.
Cross-origin data leakage in Google Chrome's Cast component allows an unauthenticated attacker positioned on the same local network segment to read data from origins they should not have access to via maliciously crafted network traffic. All Chrome versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA has not listed this in the KEV catalog, placing real-world risk at low-to-moderate despite the unauthenticated attack vector.
Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.
Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.
Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.
Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.
Cross-origin data leakage in Google Chrome prior to version 151.0.7922.72 allows remote attackers to read data across origin boundaries by inducing a user to visit a specially crafted HTML page. The flaw resides in Chrome's network layer and is classified as CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce origin boundaries during certain network operations. No active exploitation has been confirmed (not in CISA KEV), and EPSS places exploitation probability at 0.18% (8th percentile), indicating low current threat activity despite widespread browser deployment.
Side-channel information leakage in Chrome's Autofill component exposes cross-origin data to remote attackers who have already achieved renderer process compromise. All Chrome versions prior to 151.0.7922.72 are affected across all platforms. With an EPSS of 0.22% (12th percentile), no CISA KEV listing, and a mandatory renderer-compromise prerequisite, real-world exploitation risk is substantially lower than the CVSS base score implies - this is a chained second-stage disclosure, not a standalone attack. No public exploit identified at time of analysis.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to manipulate the displayed URL via malicious network traffic, deceiving users about the true origin of page content. The flaw is iOS-platform-specific and classified under CWE-451 (UI Misrepresentation of Critical Information), making it a phishing-enablement vulnerability rather than a code execution or data-exfiltration primitive. No public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.20% (10th percentile).
Cross-origin data leakage in Google Chrome's Cast subsystem (versions prior to 151.0.7922.72) allows unauthenticated attackers on the same local network segment to extract sensitive cross-origin browser data via crafted network traffic. The insufficient input validation in the Cast component bypasses browser isolation boundaries, exposing data from origins the victim is actively browsing. No public exploit code or active exploitation (CISA KEV) has been identified, and an EPSS of 0.12% (2nd percentile) reflects very low near-term exploitation probability.
Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a user to a crafted HTML page exploiting an origin validation flaw in the CSS engine. The vulnerability is classified under CWE-346 (Origin Validation Error) and is confirmed patched in the 151.0.7922.72 stable channel release. No public exploit code has been identified, SSVC rates exploitation as none, and EPSS sits at 0.18% - all consistent with low near-term exploitation likelihood.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.
Domain spoofing via incorrect security UI in Google Chrome's built-in Passwords feature affects all Chrome versions prior to 151.0.7922.72. Remote unauthenticated attackers can serve a crafted HTML page that causes Chrome to misrepresent the origin domain within the password management UI, enabling deception of users into associating saved credentials with an attacker-controlled domain. No public exploit code has been identified at time of analysis, and EPSS at 0.18% (8th percentile) signals very low automated exploitation probability, though Chrome's ubiquitous deployment makes even low-probability credential phishing scenarios broadly impactful.
UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to misrepresent browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site or legitimate browser chrome. The vulnerability maps to CWE-451 (UI Misrepresentation of Critical Information) and carries a High integrity impact despite no direct confidentiality or availability loss, because successful spoofing can facilitate credential theft or social engineering at scale. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) reflects low current opportunistic exploitation probability.
Domain spoofing in Google Chrome on iOS prior to 151.0.7922.72 allows a remote unauthenticated attacker to misrepresent the displayed origin in the browser's security UI by delivering a crafted HTML page to a victim. The flaw (CWE-451) enables phishing-class attacks where the address bar or site identity indicator shows a trusted domain while content is served from a different origin. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low automated exploitation likelihood, but the integrity impact is high for targeted phishing campaigns against iOS Chrome users.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. No public exploit code or active exploitation has been identified; EPSS sits at 0.17% (7th percentile), indicating low current exploitation interest despite the vendor-confirmed patch.
Cross-origin data leakage in Google Chrome's Passwords component (prior to 151.0.7922.72) allows a remote attacker to read credential or password-related data across origin boundaries by enticing a user to visit a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the Passwords feature, where Chrome fails to properly enforce same-origin constraints. No public exploit code has been identified and SSVC signals no known active exploitation, placing this in the medium-priority tier despite Chrome's ubiquitous deployment footprint.
UI spoofing in Google Chrome's Passwords component prior to version 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to manipulate the browser's password-related interface via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Passwords subsystem, allowing integrity-impacting spoofing of security-sensitive UI elements such as password prompts or save/fill dialogs. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with the elevated prerequisite of a prior renderer compromise.
Cross-origin data leakage in Google Chrome's built-in Passwords component (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to read cross-origin data by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error) within the password management subsystem, meaning the browser fails to correctly validate origin boundaries when the Passwords component processes or exposes credential-related data. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code exists, and this CVE is not listed in the CISA KEV catalog, indicating low observed real-world exploitation pressure despite the ubiquity of the affected product.
UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to the victim (CWE-451). The CVSS vector assigns high integrity impact (I:H) with no privileges required from the attacker, but mandates user interaction (UI:R), meaning the victim must visit the malicious page. No public exploit identified at time of analysis, and an EPSS score of 0.17% at the 7th percentile indicates very low observed exploitation interest; Chromium's own severity rating of Medium aligns with this assessment.
Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.
UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.
Cross-origin data leakage in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The flaw is rooted in insufficient policy enforcement (CWE-346: Origin Validation Error) within Chrome's Autofill feature, which fails to correctly gate form data access by origin. No public exploit code has been identified and CISA SSVC rates active exploitation as none, placing real-world risk well below what the network-based attack vector alone might suggest.
UI spoofing in Google Chrome's WebAppInstalls component (all versions prior to 151.0.7922.72) allows a remote attacker to misrepresent critical interface elements through a crafted HTML page, deceiving users into interacting with fraudulent Chrome UI. The flaw stems from inappropriate implementation in the Progressive Web App installation flow, rated CVSS 6.5 with high integrity impact reflecting the attacker's ability to manipulate perceived interface state. No public exploit identified at time of analysis, and an EPSS of 0.17% (7th percentile) confirms negligible observed exploitation activity.
Cross-origin data leakage in Google Chrome's ReportingAndNEL subsystem (versions prior to 151.0.7922.72) allows a remote attacker to exfiltrate limited cross-origin information by delivering a crafted HTML page to a victim user. The flaw stems from an origin validation error (CWE-346) in the Network Error Logging and Reporting API implementation. No public exploit code has been identified and SSVC confirms exploitation status as none, but the combination of a network attack vector, no privilege requirement, and ubiquitous browser deployment makes patch application a straightforward priority.
Cross-origin data leak in Google Chrome's GuestView component (all desktop versions prior to 151.0.7922.72) enables remote attackers to read cross-origin content by luring a victim to a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-346, Origin Validation Error) within the GuestView subsystem, which handles embedded guest content such as <webview> elements in Chrome Apps and extensions. No public exploit code has been identified and CISA has not added this to the KEV catalog; an EPSS of 0.21% at the 11th percentile confirms low exploitation probability at time of analysis.
UI spoofing via the DigitalCredentials API in Google Chrome prior to 151.0.7922.72 allows a remote, unauthenticated attacker to deceive users about the legitimacy or origin of credential-related dialogs through a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's handling of the DigitalCredentials web API (CWE-451), enabling misrepresentation of critical UI information. No active exploitation is confirmed (no CISA KEV listing), and with an EPSS score of 0.17% at the 7th percentile, real-world exploitation probability is currently very low.
Cross-origin data leakage in Google Chrome's Dawn WebGPU component (versions prior to 151.0.7922.72) enables remote attackers to read cross-origin data via a crafted HTML page that triggers uninitialized memory use (CWE-457). Exploitation requires the victim to visit an attacker-controlled page but demands no authentication and operates against default Chrome configurations. No public exploit has been identified at time of analysis and the EPSS score of 0.23% (14th percentile) reflects a currently low exploitation likelihood, consistent with Chromium's own Medium severity rating.
Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) enables an attacker who has already achieved renderer-process compromise to break out of Chrome's sandbox via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Extensions subsystem, with a CVSS Scope:Changed rating confirming the impact extends beyond the browser process to the host OS. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with absence from CISA KEV - but the sandbox escape class carries disproportionate risk relative to its 5.8 base score because it enables full host-level code execution when chained with a renderer RCE.
Cross-origin data leakage in Google Chrome's WebGL implementation on Android allows a remote attacker to read memory contents belonging to other origins via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. The vulnerability stems from uninitialized memory use (CWE-457) in the WebGL subsystem, exposing stale memory that may contain sensitive cross-origin data. No public exploit code exists and EPSS sits at 0.23% (14th percentile), indicating low current exploitation probability; this is not listed in CISA KEV.
Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The CVSS Scope:Changed metric confirms this is a true sandbox escape, elevating impact beyond the renderer isolation boundary. No public exploit code exists and EPSS stands at 0.17% (7th percentile), reflecting the chained, high-complexity nature of the attack. Google has released a patched stable channel build (151.0.7922.72).
Side-channel GPU information leakage in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability exploits the GPU rendering pipeline to observe timing or state artifacts that escape the Same-Origin Policy boundary, allowing partial disclosure of data from other origins loaded in the browser. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation probability; a vendor-released patch is available.
Memory disclosure in Google Chrome's MediaRecording subsystem allows remote attackers to read sensitive data from the browser process by enticing a user to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across supported platforms. No public exploit exists and EPSS probability stands at only 0.21% (11th percentile); SSVC also assesses exploitation as none and the attack as non-automatable, making this a patch-track rather than emergency-response priority despite the CVSS 6.5 base score.
Cross-origin data leakage in Google Chrome's Cast feature affects all versions prior to 151.0.7922.72, enabling a remote attacker to read data across origin boundaries by luring a user to a crafted HTML page. The flaw stems from improper origin validation (CWE-346) within the Cast subsystem, violating the Same-Origin Policy. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating limited real-world exploitation pressure at time of analysis.
Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.
Cross-origin data leakage via an inappropriate GetUserMedia implementation in Google Chrome prior to 151.0.7922.72 enables a renderer-level attacker to exfiltrate data across origin boundaries using a crafted HTML page. Exploitation is gated behind a prior renderer process compromise, making this a chained or post-exploitation capability rather than a standalone initial-access vector. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting low real-world exploitation probability despite the broad deployment footprint of Chrome.
Omnibox (URL bar) spoofing in Google Chrome for Android prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to display arbitrary URL content in the address bar via a crafted HTML page. This is explicitly a second-stage chained vulnerability - renderer compromise is a mandatory prerequisite, meaning the flaw functions as an escalation primitive rather than a standalone attack. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) reflects very low opportunistic exploitation probability, though the phishing and credential-theft potential when chained with a renderer exploit is meaningful.
UI spoofing in Google Chrome's Messages component on Android allows remote unauthenticated attackers to misrepresent critical interface information to victims via crafted HTML pages. Affects all Chrome for Android versions prior to 151.0.7922.72; desktop Chrome is not listed as affected. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) signals low current exploitation probability consistent with the mandatory user-interaction requirement.
UI spoofing via Chrome's Credential Management component (versions prior to 151.0.7922.72) enables a remote attacker to misrepresent credential-related browser UI to a user who visits a crafted HTML page. The flaw stems from an inappropriate implementation of the Credential Management API (CWE-451), which can cause the browser to render misleading prompts that mimic legitimate credential dialogs. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS probability is very low at 0.21%, consistent with SSVC's 'Exploitation: none' classification.
UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) can be achieved by a remote attacker who has already compromised the renderer process, enabling deceptive payment interfaces via a crafted HTML page. The CVSS vector scores integrity impact as High (I:H) with no confidentiality or availability impact, reflecting the ability to mislead users through falsified UI elements in a sensitive financial context. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), indicating this vulnerability is not yet being actively targeted at scale.
Uninitialized memory read in ANGLE (Chrome's graphics abstraction layer) on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Affected are all Google Chrome releases on Windows prior to 151.0.7922.72. An attacker who persuades a user to visit a malicious page can trigger the ANGLE component to read and potentially leak uninitialized memory, risking disclosure of in-process data. No public exploit code has been identified and EPSS stands at 0.23% (14th percentile), indicating low observed exploitation probability despite the broad deployment footprint of Chrome.
Cross-origin data leakage in Google Chrome's Blink rendering engine (all versions prior to 151.0.7922.72) enables remote attackers to read data from other origins by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-delivered, requires no authentication, and succeeds with only user interaction - a single page visit. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate low exploitation probability and no confirmed active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to read fragments of sensitive data from other origins by directing a user to a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) in ANGLE, Chrome's cross-platform OpenGL ES abstraction engine, which may expose residual graphics buffer contents from previously rendered cross-origin content. No public exploit code and no active exploitation have been identified at time of analysis; EPSS of 0.23% (14th percentile) reflects low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables a remote attacker to read data from a different web origin by inducing a victim to visit a crafted HTML page. The flaw is rooted in an inappropriate implementation of origin validation (CWE-346) within the resource-loading subsystem, undermining the browser's Same-Origin Policy enforcement. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating low exploitation likelihood at this time; however, the impact class is meaningful for users with active authenticated sessions to sensitive web applications.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about the actual origin of the page they are viewing by serving a crafted HTML page. The flaw is a CWE-451 UI misrepresentation defect, meaning the browser fails to accurately convey security-critical location information to the user, creating a reliable phishing vector. No public exploit code exists and EPSS sits at 0.21% (11th percentile); SSVC confirms exploitation as none and technical impact as partial, placing this firmly in lower-priority remediation tiers despite the phishing relevance.
Cross-origin data leakage in Google Chrome's Autofill component (versions prior to 151.0.7922.72) allows remote attackers to read data from a different origin than the page being visited. Exploitation requires the victim to interact with a specially crafted HTML page, placing this firmly in the social-engineering/phishing threat model. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating negligible observed exploitation activity; this is not currently listed in CISA KEV.
Cross-origin data leakage in Google Chrome's Presentation API prior to version 151.0.7922.72 enables remote attackers to exfiltrate sensitive same-browser data by delivering a crafted HTML page to an unsuspecting user. The flaw violates the Same-Origin Policy through an origin validation error (CWE-346) in the PresentationAPI component, potentially exposing session tokens, authentication state, or other sensitive content from co-resident origins. No public exploit has been identified and EPSS sits at the 11th percentile (0.21%), indicating low mass-exploitation risk at time of analysis.
Cross-origin data leakage in Google Chrome's Cast subsystem (all versions prior to 151.0.7922.72) enables a remote unauthenticated attacker to exfiltrate sensitive cross-origin data by luring a victim to a specially crafted HTML page. The vulnerability, rated Medium by the Chromium security team with a CVSS of 4.3, is bounded to a limited confidentiality impact with no code execution risk. No active exploitation is confirmed in CISA KEV, and EPSS at 0.21% (11th percentile) indicates a very low probability of widespread in-the-wild exploitation at time of analysis.
Out-of-bounds memory read in Google Chrome's WebGL implementation (versions prior to 151.0.7922.72) allows a remote attacker to disclose limited browser process memory contents when a victim visits a crafted HTML page. Impact is confined to partial confidentiality - no write primitive exists, ruling out direct code execution. No public exploit has been identified and SSVC confirms no active exploitation, placing this in a lower-priority patch tier despite its network-accessible attack vector.
Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, exploitable by a remote unauthenticated attacker through a crafted HTML page that a victim must visit. The flaw stems from uninitialized memory use in Skia (CWE-457), allowing stale heap or stack data to be read and potentially exfiltrated across origin boundaries, undermining the browser's same-origin policy protections. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.23% (14th percentile), but the patch is confirmed available and the product's ubiquitous deployment makes broad-surface exposure a consideration.
Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.
Cross-origin data leakage in Google Chrome's Cast component exposes sensitive information across origins to remote attackers who can induce a victim to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.21% (11th percentile) reflects low current exploitation probability, consistent with Google's own 'Medium' severity classification.
Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by delivering a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, making it a chained exploit rather than a standalone attack. No active exploitation is confirmed in CISA KEV, and EPSS is 0.21% (11th percentile), consistent with low observed exploitation activity despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) allows a local attacker to read clipboard contents belonging to a different browsing origin by luring a victim to a crafted HTML page. The flaw arises from insufficient input validation in Chrome's Clipboard component on Android, classified under CWE-20. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.13% at the 3rd percentile reflects a minimal real-world exploitation probability at this time.