Information Disclosure
Monthly
Sensitive information disclosure in Google Chrome's Mobile component on iOS (versions prior to 153.0.8010.36) allows remote unauthenticated attackers to leak confidential browser data by luring victims to a crafted HTML page through social engineering. The flaw is platform-specific - affecting only the iOS Mobile code path, not desktop or Android - and is fixed in the 153.0.8010.36 stable channel release. No active exploitation is confirmed (not in CISA KEV) and EPSS probability is 0.17% (7th percentile), consistent with Chromium's own 'Low' severity rating, which contrasts with the NVD CVSS 6.5 Medium score.
Cross-origin information leakage in Google Chrome's Select element (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to infer sensitive user state by observing behavioral discrepancies in how the `<select>` element renders when a victim browses to a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), a classic browser side-channel class that enables cross-site information inference - for example, whether a user is authenticated to a third-party origin or has visited specific URLs. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with the Chromium team's own 'Low' severity rating despite NVD's CVSS 6.5.
UI spoofing via a confused deputy flaw in Google Chrome's Fullscreen API (all versions prior to 153.0.8010.36) enables a remote attacker who has already compromised the renderer process to impersonate browser-trusted UI elements using a crafted HTML page and social engineering. This is a secondary exploitation step - it does not provide initial access - and becomes relevant only after a separate, higher-severity renderer compromise has been achieved. No public exploit code or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects very low automated exploitation probability consistent with the chained, human-dependent attack path.
Observable SVG discrepancy in Google Chrome prior to 153.0.8010.36 enables remote attackers to infer sensitive cross-origin information by inducing measurable rendering behavioral differences via a crafted HTML page. The root cause is CWE-203, a side-channel class where an attacker observes system behavior variations to deduce protected state. No public exploit code or active exploitation is identified; Chromium's own 'Low' severity designation and an EPSS of 0.17% (7th percentile) together indicate limited real-world exploitation likelihood despite the NVD's C:H confidentiality metric.
Out-of-bounds read in the Tint WGSL shader compiler in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to read limited memory contents within the browser's renderer sandbox by directing a victim to a crafted HTML page. Scope is confined to the sandbox (S:U/C:L), with no integrity or availability impact and no sandbox escape; Chromium rates this 'Low' severity, consistent with the CVSS 4.3 score. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), indicating low exploitation probability; a vendor-released patch is available in Chrome 153.0.8010.36.
Cross-origin data leakage in Google Chrome's Prefetch subsystem (versions prior to 153.0.8010.36) enables a remote attacker to infer information about cross-origin resources via an observable discrepancy side-channel triggered by a crafted HTML page. The vulnerability affects unauthenticated users who visit the malicious page, requiring only passive user interaction (browsing). Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit or active exploitation has been identified at time of analysis.
Observable discrepancy in Chrome's Layout engine prior to version 153.0.8010.36 allows a remote attacker to infer sensitive cross-origin information by measuring rendering differences triggered by a crafted HTML page. The CWE-203 root cause - an attacker-observable behavioral difference that correlates with secret state - places this in the browser side-channel (XSLeak) family, where layout timing or geometry variations can reveal whether a user is authenticated to a third-party origin or whether specific cross-origin resources exist. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest.
Observable DOM discrepancy in Google Chrome prior to 153.0.8010.36 enables cross-origin information leakage via a CWE-203 side-channel, allowing a remote attacker to infer sensitive data from a victim's browser state. Exploitation requires social engineering to lure the target to a crafted HTML page, satisfying the required user interaction. No public exploit code or CISA KEV listing is associated with this vulnerability, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest at time of analysis.
Out-of-bounds read in ANGLE (Chrome's OpenGL ES translation layer) in Google Chrome prior to 153.0.8010.36 enables a remote unauthenticated attacker to read limited memory content outside the renderer sandbox by luring a user to a crafted HTML page. Unlike co-patched ANGLE issues in the same Chrome 153.0.8010.36 release that achieve full sandbox escape and remote code execution, this flaw is bounded to confidentiality impact only with no scope change - the read does not escape the renderer process. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.17% reflects minimal current attacker interest.
Cross-origin data exfiltration in Google Chrome's CORS implementation prior to 153.0.8010.36 is exploitable only as a second-stage technique by an attacker who has already compromised the renderer process, allowing them to read data from foreign origins the victim is authenticated to via a crafted HTML page. With a CVSS of 3.1, EPSS of 0.17% (7th percentile), no CISA KEV listing, and no public exploit code identified, this represents a low standalone risk - its relevance is as a data-harvesting primitive chained after a renderer RCE. Chromium rated it 'Medium,' consistent with the constrained exploitation path.
ControlledFrame in Google Chrome prior to 153.0.8010.36 exposes sensitive information to an attacker who has already achieved renderer process compromise, exploitable via a crafted HTML page (UI:R). This is a chained post-exploitation primitive rather than an initial access vector: it extends the damage of a separate renderer exploit by enabling cross-origin data exfiltration from the victim's session. No public exploit code exists, EPSS stands at 0.29% (21st percentile), and no CISA KEV listing is present, consistent with the high effective exploitation barrier imposed by the renderer pre-compromise requirement.
Cross-origin data disclosure in Google Chrome's Paint rendering component (versions prior to 153.0.8010.36) enables a remote attacker to read data belonging to a different web origin by directing a victim to a crafted HTML page. The root cause is an origin validation error (CWE-346) in the Paint pipeline, which under certain rendering conditions fails to enforce the Same-Origin Policy, leaking partial cross-origin data to the attacker-controlled page. EPSS is 0.14% (3rd percentile), Chromium rates this 'Medium,' and no public exploit or CISA KEV listing exists at time of analysis - placing this squarely in standard patch-cadence rather than emergency response territory.
UI misrepresentation in Google Chrome's Payments component prior to 153.0.8010.36 allows a remote attacker to spoof payment-related interface elements by serving a crafted HTML page. The spoofed UI can deceive users into believing they are interacting with legitimate Chrome payment dialogs, potentially facilitating credential or payment-data disclosure. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), placing real-world exploitation risk as low at this time.
Sensitive information disclosure in the Enterprise component of Google Chrome on Windows allows a remote attacker to obtain protected data by luring a user to a crafted HTML page. All Chrome releases on Windows prior to 153.0.8010.36 are affected. No public exploit has been identified at the time of analysis, and with an EPSS of 0.17% (7th percentile), opportunistic mass exploitation is unlikely in the near term despite the high confidentiality impact rating.
UI misrepresentation in Google Chrome's Geometry component (versions prior to 153.0.8010.36) enables remote attackers to spoof browser interface elements through a crafted HTML page, requiring social engineering to achieve user interaction. The flaw (CWE-451) permits an attacker to visually deceive victims about the true origin or nature of displayed content, creating a pathway for phishing and credential harvesting. No public exploit has been identified at time of analysis; vendor-released patch is available in the September 2026 stable channel update.
Observable discrepancy (CWE-203) in the Safebrowsing component of Google Chrome on iOS prior to 153.0.8010.36 enables a remote attacker with a pre-compromised renderer process to leak sensitive information through behavioral differences when processing a crafted HTML page. The vulnerability is iOS-platform-specific and is chained after renderer compromise rather than exploited standalone. No public exploit exists and EPSS probability is 0.24%, consistent with the multi-stage exploitation requirement.
ServiceWorker information leak in Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to extract sensitive information via a crafted HTML page. This is a chained exploitation technique rather than a standalone attack - requiring prior renderer process control as a hard prerequisite, making it a second-stage capability within a broader browser exploit chain. No public exploit code exists and EPSS sits at 0.29% (21st percentile), indicating low observed exploitation activity; the vulnerability is not listed in CISA KEV.
Uninitialized GPU resource use in Google Chrome on Android (prior to 153.0.8010.36) allows remote attackers to read process memory across the sandbox boundary via a crafted HTML page. The CVSS S:C (scope changed) metric confirms the vulnerability crosses Chrome's GPU sandbox, leaking partial memory contents outside the sandboxed GPU process to a network-positioned attacker. No public exploit or CISA KEV listing exists; EPSS of 0.31% (24th percentile) indicates low observed exploitation probability, consistent with Chromium's 'Medium' severity rating.
Cross-origin data leakage in the Chrome Downloads subsystem exposes sensitive information to attackers who have already established renderer process compromise. Chrome versions prior to 153.0.8010.36 are affected; exploitation requires a renderer-compromised context combined with user interaction via a crafted HTML page. Google rated this 'Medium' internally; the CVSS 3.1 score of 3.1 reflects its role as a second-stage exploitation step rather than a standalone critical flaw. No public exploit code or CISA KEV listing exists at time of analysis.
Navigation component information leak in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass site isolation and exfiltrate cross-origin data via a crafted HTML page. This is a second-stage exploit component: it cannot be chained without a prior renderer compromise, which significantly elevates the effective attack complexity despite the AV:N/AC:L CVSS surface reading. Chromium's own severity rating is 'Medium', consistent with the prerequisite constraint. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) reflects the elevated bar for exploitation.
Cross-origin data exposure in Google Chrome's Scroll component (all versions prior to 153.0.8010.36) enables an attacker who has already achieved renderer process compromise to exfiltrate sensitive data from other web origins via a crafted HTML page. This is a secondary-stage vulnerability - it does not provide initial access but extends an existing renderer compromise into a cross-origin information leak. Chromium rated this Medium severity, consistent with the 4.3 CVSS score; no public exploit exists and EPSS at 0.17% (7th percentile) reflects the narrow, chained exploitation scenario.
Cross-origin data leakage via Google Chrome's ServiceWorker implementation allows remote attackers to obtain information from other origins by serving a crafted HTML page to a victim. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.21% reflects low real-world exploitation activity.
UI element spoofing in Google Chrome's Geometry rendering component (versions prior to 153.0.8010.36) enables a remote attacker to misrepresent browser chrome and UI elements through a crafted HTML page, requiring the victim to visit the malicious page via social engineering. The vulnerability, classified under CWE-451 (User Interface Misrepresentation of Critical Information), allows an attacker to render fake address bars, security dialogs, or browser-level indicators in a way that deceives users into disclosing credentials or taking unintended actions. No public exploit code has been identified and no CISA KEV listing exists; EPSS at 0.21% (11th percentile) reflects negligible observed exploitation activity.
Google Chrome's browser UI component (all versions prior to 153.0.8010.36) is vulnerable to visual spoofing attacks where an attacker can manipulate how the browser presents security-critical interface elements to users. By serving a specially crafted HTML page combined with social engineering, a remote unauthenticated attacker can make Chrome display misleading UI indicators - such as deceptive origin representations or manipulated security signals - potentially enabling credential theft or unauthorized permission grants. No public exploit code exists and the EPSS score of 0.21% (11th percentile) indicates low near-term exploitation probability, consistent with Chromium's own Medium severity classification.
UI misrepresentation in Google Chrome's FedCM (Federated Credential Management) API prior to 153.0.8010.36 enables remote attackers to spoof identity-provider sign-in dialogs via crafted HTML pages, requiring user interaction. The flaw (CWE-451) allows a malicious page to manipulate how FedCM presents credential prompts, potentially misleading users into authorizing the wrong identity provider or disclosing credential context to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified; EPSS is 0.17%, consistent with Chromium's 'Medium' severity classification.
UI spoofing in Google Chrome's FedCM (Federated Credential Management) implementation allows an attacker who has already compromised the renderer process to inject malformed identity-provider dialog elements via a crafted HTML page, potentially deceiving users into submitting credentials to an attacker-controlled endpoint. All Chrome desktop versions prior to 153.0.8010.36 are affected. The attack is two-stage: an independent renderer-compromise vulnerability must first be exploited, making this a chained post-exploitation capability rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
UI misrepresentation in Google Chrome prior to 153.0.8010.36 allows a remote attacker to spoof browser UI elements - such as the address bar, security indicators, or permission dialogs - via a specially crafted HTML page, requiring social engineering to lure the victim. Exploiting CWE-451, the attacker can deceive users into trusting a malicious or phishing page as legitimate, potentially leading to credential theft or other user-driven disclosures. No public exploit code has been identified and EPSS is 0.24% (15th percentile), consistent with the Chromium team's 'Medium' severity rating and the high-complexity social engineering prerequisite.
UI misrepresentation in Google Chrome's Downloads panel prior to version 153.0.8010.36 allows a remote attacker to spoof download-related UI elements, potentially deceiving users into accepting or running malicious content they believe to be legitimate. The vulnerability is triggered by a crafted HTML page and requires social engineering to lure a victim into visiting the attacker-controlled page. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) places real-world exploitation risk low; however, Chrome's ubiquitous deployment keeps the absolute exposure surface significant.
Improper input validation in Chrome's Interstitials component - the full-page security warning screens shown for SSL errors, Safe Browsing alerts, and download warnings - allows a remote attacker to spoof UI elements by delivering a crafted HTML page to an unsuspecting user. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No public exploit code has been identified and EPSS stands at 0.17% (7th percentile), reflecting low near-term exploitation probability, though successful abuse could undermine user trust in browser security indicators and facilitate phishing or credential harvesting.
Cross-origin data leakage in Google Chrome's Navigation component prior to version 153.0.8010.36 exposes partial information about cross-origin resources through an observable behavioral discrepancy (CWE-203 side-channel). Remote unauthenticated attackers can exploit this by serving a crafted HTML page that a victim visits, allowing inference of cross-origin data that should be protected by the Same-Origin Policy. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS at the 15th percentile confirms limited real-world exploitation pressure. Vendor-released patch is available as Chrome 153.0.8010.36.
UI spoofing in Google Chrome's Passwords component (versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. Classified as CWE-451 (UI Misrepresentation of Critical Information), this flaw could deceive users into believing they are interacting with a legitimate password prompt or credential management interface when they are not, potentially facilitating credential phishing or confusion attacks. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Cross-origin data leakage in Google Chrome's Network component prior to version 153.0.8010.36 allows remote attackers to infer information about cross-origin resources through observable behavioral discrepancies (CWE-203). Exploitation requires a victim to visit a crafted HTML page (UI:R) and involves high attack complexity (AC:H), indicating that reliable exploitation depends on meeting specific preconditions in the victim's browser or network environment. With an EPSS of 0.21% (11th percentile), no CISA KEV listing, and no confirmed public exploit, real-world risk is low despite the network-accessible attack vector.
Cross-origin data disclosure in Chrome's WebMCP component before 153.0.8010.36 enables a renderer-compromised attacker to exfiltrate cross-origin page data via a crafted HTML page. This is a second-stage vulnerability in a multi-step exploit chain - it does not enable initial access but amplifies the impact of a prior renderer compromise by breaking the same-origin boundary through the WebMCP interface. With a CVSS score of 3.1, EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, real-world risk is low except in targeted attack chains pairing this with a separate, more severe renderer exploit.
Uninitialized GPU resource in Google Chrome for Android (prior to 153.0.8010.36) allows a renderer-compromised attacker to read memory outside the browser sandbox via a crafted HTML page. This is a second-stage vulnerability - it requires the renderer process to already be compromised, meaning it operates as a chained exploit component rather than an independent attack path. No public exploit has been identified; EPSS is 0.19% (9th percentile), and the Chromium team rates severity as Medium, consistent with the constrained impact and high prerequisite bar.
Uninitialized memory in the Codecs component of Google Chrome before 153.0.8010.36 leaks sandbox-internal memory to a remote attacker via a crafted HTML page. The vulnerability stems from CWE-908 (use of uninitialized resource) where codec processing exposes arbitrary memory contents that happen to reside in uninitialized buffers - but exploitation is constrained entirely within the Chrome sandbox (S:U). No active exploitation is confirmed and no public exploit code exists; EPSS stands at 0.19% (9th percentile), consistent with a low-priority medium-severity disclosure issue.
Cleartext transmission of sensitive information via the HttpsUpgrades component in Google Chrome on iOS (versions prior to 153.0.8010.36) exposes user data to network-positioned attackers through crafted traffic. The HttpsUpgrades mechanism, which is responsible for automatically promoting HTTP requests to HTTPS, fails under certain conditions on iOS, leaving sensitive request content unencrypted in transit. With no public exploit identified and high attack complexity required (network positioning), the real-world risk is moderate despite the C:H confidentiality impact.
Improper input validation in Chrome's built-in Passwords component (all versions prior to 153.0.8010.36) enables a remote, unauthenticated attacker to potentially leak sensitive stored credential data via crafted network traffic. The flaw is rated CVSS 5.9 (AC:H), with Chromium assigning a 'Medium' severity consistent with the meaningful exploitation complexity required. No public exploits or active exploitation have been identified at time of analysis.
Cross-origin data disclosure in Google Chrome's WebGL subsystem (all versions prior to 153.0.8010.36) enables remote attackers to read residual GPU memory belonging to other origins by serving a crafted HTML page to an unpatched user. The root cause is CWE-908 (use of uninitialized resource): Chrome's WebGL implementation exposed GPU-side buffers to JavaScript before zeroing them, allowing fragments of prior rendering operations from cross-origin contexts to be read back. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.29%, consistent with the Medium Chromium severity rating and the limited, read-only impact.
Race condition in the Payments component of Google Chrome prior to 153.0.8010.36 enables remote attackers to spoof payment UI elements by delivering a crafted HTML page combined with social engineering, requiring user interaction to trigger the vulnerable timing window. The CWE-362 race condition in Chrome's Payment Request handling allows the attacker to substitute or overlay legitimate payment dialogs with fraudulent ones during the race window, potentially tricking victims into submitting payment credentials to attacker-controlled endpoints. No public exploit code exists and EPSS of 0.14% (4th percentile) reflects very low exploitation probability; Chromium rates this Medium severity.
Cross-origin data disclosure in Google Chrome's Extensions subsystem before version 153.0.8010.36 allows a remote attacker to obtain data from origins other than those the victim is currently browsing, contingent on successfully social-engineering the victim into installing a crafted malicious extension. The Chromium security team rated this Medium severity, consistent with the CVSS 4.3 score, and the EPSS probability of 0.23% confirms minimal current exploitation interest. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uninitialized resource use in Chrome's Media component (CVE-2026-87456) enables a renderer-compromised attacker to read memory outside the Chrome sandbox via a crafted HTML page, fixed in version 153.0.8010.36. This is a post-compromise, second-stage information disclosure capability rather than a standalone entry-point vulnerability - successful exploitation requires the attacker to have already achieved code execution within the renderer process through a separate exploit. CVSS 3.4 (Low), Chromium-rated Medium, with EPSS at 0.23% and no public exploit or CISA KEV entry.
Sensitive information disclosure in Google Chrome's BackgroundFetch API allows a remote attacker who has already compromised the renderer process to leverage the BackgroundFetch service worker mechanism as a confused deputy, leaking sensitive data via a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36; Chromium rates this Medium, consistent with the CVSS 5.3 score that reflects the high-complexity prerequisite of a compromised renderer. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS places exploitation probability at 0.20% (10th percentile).
Observable discrepancy in Google Chrome's Autofill subsystem prior to version 153.0.8010.36 enables remote information disclosure through a crafted HTML page. An unauthenticated remote attacker who tricks a user into visiting a malicious page can exploit timing or behavioral side-channel differences (CWE-203) in Autofill's response to form field probes to infer sensitive data stored in Chrome's Autofill database - potentially including names, addresses, and saved form values. No public exploit code or active exploitation has been identified; EPSS stands at 0.29% (21st percentile), indicating low current exploitation pressure.
Out-of-bounds memory read in the WebView component of Google Chrome on Android allows an attacker who has already compromised the renderer process to escape the sandbox and read arbitrary memory via a crafted HTML page. The vulnerability is fixed in Chrome 153.0.8010.36; all prior Android Chrome versions are affected. No public exploit code has been identified and EPSS probability is low at 0.22%, though the scope-changed confidentiality impact is significant if renderer compromise is already achieved.
Type confusion in V8, Chrome's JavaScript engine, enables remote attackers to read memory within the Chrome sandbox by directing a user to a crafted HTML page. All Chrome desktop builds prior to 153.0.8010.36 are affected. The demonstrated impact is limited to partial in-sandbox memory disclosure - no integrity loss, no availability impact, and no sandbox escape is described. No public exploit is identified at time of analysis, and EPSS sits at 0.23%, reflecting low current real-world exploitation pressure.
Memory read outside the renderer sandbox in Google Chrome's GPU component affects all desktop versions prior to 153.0.8010.36. An uninitialized GPU resource (CWE-908) enables an attacker who has already gained code execution inside the renderer process to read stale memory contents from outside the sandbox boundary via a crafted HTML page, exposing browser process memory or heap addresses. No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, consistent with the high-complexity, two-stage attack prerequisite.
Out-of-bounds read in ANGLE (Chrome's graphics translation layer) affects Google Chrome prior to 153.0.8010.36, enabling a remote attacker to read memory from the renderer process when a victim visits a crafted HTML page. The impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence, and the vulnerability is contained within the renderer sandbox (S:U). No public exploit code and no CISA KEV entry have been identified at time of analysis; vendor-released patch 153.0.8010.36 is available.
Out-of-bounds memory read in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows prior to 153.0.8010.36 allows a local attacker to read memory beyond the Chrome sandbox boundary via a crafted local program. The vulnerability carries a CVSS score of only 2.7 (Low), reflecting significant exploitation constraints: local access, high attack complexity, required user interaction, and a partial confidentiality-only impact with no integrity or availability consequence. No public exploit has been identified, EPSS sits at the 4th percentile (0.15%), and SSVC classifies exploitation status as none with non-automatable, partial technical impact.
Out-of-bounds read in GPAC's HTTP chunked-transfer downloader (src/utils/downloader.c) crashes the application when processing a server-supplied chunked HTTP response whose declared chunk size exceeds safe bounds. Affected versions include GPAC v26.07.0; the upstream fix introduces a 1 GB chunk-size ceiling and a pre-allocation integer-overflow guard in gf_dm_data_received. No public exploit has been identified at time of analysis, and CVSS UI:R confirms that exploitation requires a user to initiate a connection to an attacker-controlled media source.
Out-of-bounds read in GPAC v26.07.0's HTTP download subsystem (gf_dm_data_received in downloader.c) enables remote denial of service when a victim user processes a crafted HTTP response containing a malformed or pathologically large chunk-size value. The upstream fix commit confirms two root causes: absence of an upper-bound cap on parsed chunk sizes and an unchecked integer overflow in the nbBytes + hdr_size computation that causes accounting to wrap around before the out-of-bounds read occurs. Impact is limited to application crash with no confidentiality or integrity consequences; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in stb_truetype's stbtt_GetGlyphShape function enables denial of service against any application that parses attacker-supplied TrueType font files using the nothings/stb library at commit 31c1ad3. The affected function reads glyph outline data from a crafted TTF without sufficient bounds validation, causing an abnormal read that crashes the host application. No public exploit code or CISA KEV listing was identified at time of analysis; CVSS 4.3 with UI:R reflects the realistic, user-triggered exposure.
Out-of-bounds memory read in the stb library's stbsp_vsnprintf function (stb_sprintf.h) at commit 31c1ad3 enables a denial-of-service condition when a consuming application passes attacker-controlled input to the function. The nothings/stb project is Sean Barrett's widely-vendored, public-domain, single-file C library suite embedded across game engines, imaging tools, and embedded systems. No public exploit code and no CISA KEV listing exist at time of analysis; the local attack vector and high attack complexity in the CVSS vector further limit practical exploitability.
Heap out-of-bounds read in gdk-pixbuf's ICNS decompression routine allows an attacker to crash GNOME applications or disclose adjacent heap memory by supplying a crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS data, lacks bounds validation on the source buffer during decompression. Exploitation requires user interaction - the target must open or preview the malicious file - but thumbnail-rendering paths in file managers such as Nautilus may reduce that barrier. No public exploit or KEV listing has been identified at the time of analysis.
Side-channel route enumeration in Maravel PHP framework (versions prior to 10.73.1) allows unauthenticated remote attackers to map internal API route structures and controller parameter schemas by exploiting a differential HTTP response. The router's static route checklist incorrectly stores raw dynamic placeholder strings (e.g., `{id}`), so passing literal brace syntax in a request URL bypasses the dynamic tree engine, triggers a PHP 8+ `ArgumentCountError`, and returns a 500 Internal Server Error rather than the expected 404. An adversary can systematically fuzz endpoints with template-syntax paths, distinguish 500 from 404 responses, and reconstruct the application's routing schema without any authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Token cache isolation failure in react-native-auth0's web platform implementation exposes authentication tokens across user sessions when the SDK is deployed in server-side rendering (SSR) environments. Versions 5.0.0 through 5.11.0 cache OAuth/OIDC tokens at module scope - a singleton that persists across all HTTP requests handled by the same Node.js server process - meaning a token obtained during one user's request can be returned to a subsequent, unrelated request processed by the same runtime. The flaw is classified as CWE-488 (Exposure of Data Element to Wrong Session) and carries CVSS 6.5 with high confidentiality impact; no public exploit code or CISA KEV listing has been identified.
Prototype Pollution in Adobe Acrobat and Acrobat Reader (versions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows an attacker who can deliver a crafted PDF to break out of the Reader's JavaScript sandbox and read arbitrary files from the victim's filesystem. The flaw abuses CWE-1321 to modify built-in JavaScript object prototypes inside Acrobat's scripting engine, subverting sandbox boundaries in a scope-changed exploit chain (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity once a victim opens the file elevates operational urgency for organizations reliant on Acrobat in document-heavy workflows.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader exposes sensitive process memory to attackers who can deliver malicious PDF files. Affected versions include Acrobat Reader and Acrobat 2024 up to 26.002.21900 and 24.001.30383 respectively. Exploitation requires a victim to open a crafted file, but no system privileges are needed - the barrier is solely user interaction, making phishing and email-borne delivery effective vectors.
Out-of-bounds read in Adobe Acrobat Reader (≤26.002.21900) and Acrobat 2024 (≤24.001.30383) exposes sensitive process memory when a victim opens a specially crafted PDF file. The vulnerability stems from CWE-125, an out-of-bounds read, allowing an attacker who delivers a malicious document to obtain memory contents that could facilitate ASLR bypass or exfiltrate in-memory data such as document content or credentials. No public exploit has been identified at time of analysis; exploitation requires user interaction via file opening.
Out-of-bounds read in Adobe Acrobat Reader and Adobe Acrobat (all editions through version 26.002.21900, and Acrobat 2024 through 24.001.30383) enables sensitive process memory disclosure when a victim opens a specially crafted document. Rooted in CWE-125 improper bounds enforcement during file parsing, the flaw leaks adjacent memory contents including potential pointers or cached sensitive data. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Integer underflow (CWE-191) in Adobe Acrobat Reader allows an attacker to disclose sensitive process memory contents by tricking a victim into opening a crafted PDF or Acrobat file. Affected across all current Acrobat 2024 (≤24.001.30383) and Acrobat/Acrobat Reader continuous-track (≤26.002.21900) releases. No active exploitation confirmed in CISA KEV; no public exploit code identified at time of analysis, though Adobe-class memory disclosure flaws are frequently chained with code execution primitives.
Out-of-bounds read (CWE-125) in Adobe Acrobat and Acrobat Reader - versions up to 26.002.21900 and Acrobat 2024 up to 24.001.30383 - allows disclosure of sensitive process memory when a victim opens a specially crafted document file. The confidentiality impact is rated high (C:H), meaning leaked memory contents could include pointers, session data, or other in-process secrets, though there is no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-141 addressing the issue.
Out-of-bounds read in Adobe Acrobat Reader and Acrobat (Continuous Track ≤26.002.21900; Classic 2024 Track ≤24.001.30383) allows an attacker to disclose sensitive memory contents from a victim's process by delivering a crafted PDF file that the victim must open. The flaw is rooted in CWE-125 and carries a CVSS 5.5 score reflecting its local, user-interaction-dependent attack vector with high confidentiality impact but no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext transmission of administration credentials over HTTP in U-speed WIFI4 N300 T1 Pro v1.0.0 exposes router admin passwords to passive eavesdroppers on the same network segment. Any attacker with adjacent network access - including a co-located wireless client - can capture HTTP session traffic containing unencrypted credentials without any authentication or interaction. No public exploit code has been confirmed and EPSS is minimal (0.15%), but the attack is trivially executable with standard packet capture tools once adjacent network access is established.
Argument injection in the Okta Privileged Access Client's scaleft:// URL protocol handler allows an unauthenticated remote attacker to manipulate SSH client behavior by supplying hyphen-prefixed values in a crafted link. Versions 1.18.0 through 1.112.x omit the option terminator (--) before appending URL-derived values to SSH command-line arguments, causing the underlying SSH binary to interpret attacker-controlled strings as CLI flags rather than literal targets. A vendor patch is available in version 1.113.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exposure in Okta Hyperdrive Agent versions 1.4.0 through 1.5.1 allows any local user with log file read access to obtain live SAML bearer assertions logged in cleartext on every successful MFA completion. Because SAML bearer assertions function as authentication credentials, a local attacker can replay them to authenticate as the victim user to any service provider trusting the Okta identity provider. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable once log file access is obtained.
Improper authorization in seakee CPA-Manager-Plus 1.11.0-1.11.10 allows unauthenticated remote attackers to have GET and HEAD requests forwarded to the backend CPA service using the application's saved management key, granting read-level access to resources that should require admin credentials. The flaw resides in the CPAResource HTTP proxy handler (`apps/manager-server/internal/http/controller/proxy/handler.go`), where `useSavedManagementKey` was hardcoded to `true` for all read-method requests without invoking `AdminAuthService.VerifyHeader`, a check that was only performed for mutating methods. No public exploit code has been identified at time of analysis, and the vendor-released patch in v1.11.11 resolves the issue.
Session fixation (CWE-384) in ningzichun Student Management System allows a remote attacker to pre-set a victim's session identifier via login.php, then hijack the authenticated session after the victim logs in. The login.php file's use of session_start fails to regenerate the session ID upon successful authentication, making any pre-supplied session ID persist into the authenticated state. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental vector), though no active exploitation has been confirmed in CISA KEV.
Sensitive information disclosure via verbose error messages in Microsoft Skype for Business Server allows unauthenticated network attackers to capture confidential application data when a victim user triggers an error condition. Three on-premises server product lines are affected - the 2015, 2019, and Subscription Edition branches - with Microsoft-released patches available for all three. No public exploit code or active exploitation has been identified; SSVC assessment rates the attack as non-automatable with partial technical impact.
Out-of-bounds heap read in Android's ResourceTypes.cpp `setTo` function exposes local heap memory to low-privileged processes across Android 14 through 17. The missing bounds check requires only standard user-level execution - no elevated privileges and no user interaction - to trigger partial disclosure of heap contents. No active exploitation has been identified; EPSS probability is 0.12% (2nd percentile), consistent with a low-severity local disclosure in a narrow attack surface.
Out-of-bounds read in Android's 802.11be (WiFi 7 / EHT) parsing code exposes kernel or userspace memory to adjacent attackers across all currently supported Android releases (14, 15, 16, 16-QPR2, and 17). The flaw resides in get_eht_operation_channel_width() within ieee802_11_common.c, where an incorrect bounds check allows a crafted EHT Operation element - delivered via a rogue access point - to read past the end of a buffer, leaking memory contents to the attacker. With EPSS at 0.12% and no KEV listing, real-world exploitation is not currently observed, but the adjacency-only prerequisite makes this relevant to targeted or physical-proximity attacks.
Local information disclosure affects Android 14 through 17, including the Android 16-QPR2 branch, due to a logic error causing improper data sanitization across multiple code locations. An unprivileged local application can exploit this flaw without any user interaction to read data it should not have access to. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects very low observed exploitation interest.
Local information disclosure in Android's AppFuseBridge framework component allows any installed app to read files or data it lacks permission to access. The vulnerability exists in the openFile() method of AppFuseBridge.java, where a missing permission check (CWE-693) permits a low-privileged local process to bypass access controls without user interaction. Affected versions span Android 14 through 17, including the QPR2 interim release, giving this issue a broad footprint across current Android deployments. No public exploit or active exploitation has been identified; EPSS is 0.12% (2nd percentile), consistent with the local-only, low-impact nature of the flaw.
Local information disclosure in Android 15 through 17 exploits a confused deputy flaw in `screenArgsForPermissionCheckIfAny`, allowing a low-privileged local app to bypass permission validation and access data it should not be authorized to read. The flaw stems from a privileged component incorrectly acting on behalf of a less-privileged caller without adequate permission verification, resulting in unauthorized local data exposure. No public exploit has been identified at time of analysis, and with an EPSS of 0.12% this is assessed as low-priority despite Android's broad deployment footprint.
Local information disclosure in Android's MediaProvider component affects Android 14 through 17 via a race condition in `updateInternal` of `MediaProvider.java`. An unprivileged local application can exploit a time-of-check-time-of-use (TOCTOU) window during a media record update operation to read file contents that should not be accessible, without requiring elevated privileges. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects the low probability of widespread automated exploitation.
Local information disclosure in Android's `getAllSessions` function across multiple files allows a low-privileged application to obtain session data it is not authorized to access, exploiting a confused-deputy logic error in the code. Affected versions span Android 15, 16, 16-qpr2, and 17, as documented in the September 2026 Android Security Bulletin. No public exploit or active exploitation has been identified; EPSS sits at 0.12%, reflecting the low real-world threat level consistent with the CVSS 3.3 rating.
Missing permission check in multiple functions of RangingServiceImpl.java on Android enables a man-in-the-middle attacker to intercept ranging service communications and disclose sensitive information without requiring additional execution privileges. Affected versions span Android 16, Android 16-QPR2, and Android 17, covering current and near-future Android releases. No public exploit has been identified at time of analysis, and EPSS is very low at 0.14%, but the network-reachable attack surface and absence of user interaction required warrant attention in environments handling proximity or location-sensitive data.
Local information disclosure in Android 14 through 17 stems from a logic error across multiple functions in XmpDataParser.java that causes improper sanitization of XMP metadata during media file parsing. A local attacker with standard user-level privileges can trigger the flaw without any user interaction, leaking restricted information from the parsing context. No public exploit code or active exploitation has been identified, and the September 2026 Android Security Bulletin provides the authoritative patch.
Tapjacking via malicious UI overlay in Android 17's ContactsPickerActivity allows a locally installed application to present misleading UI over the contacts picker, resulting in local information disclosure of contact data. The attack requires only low-privilege access (a sideloaded or installed app) and no user interaction once the overlay is active. No public exploit code is identified, and EPSS at the 2nd percentile reflects negligible opportunistic exploitation probability.
Bluetooth encryption downgrade in Android's `btm_sec_encrypt_change` function (btm_sec.cc) exposes information on Android 17 and Android 16-QPR2 devices by allowing a logic error in encryption change handling to be exploited without user interaction. A Bluetooth-adjacent attacker with a low-privilege connection can trigger the downgrade, reducing encryption strength and enabling passive interception of Bluetooth traffic. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.16%, indicating very low observed exploitation probability.
Local information disclosure in Android 16 and 17 exposes the device Bluetooth MAC address through a missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java. Any low-privileged local application can invoke this code path without holding the required Bluetooth permission, silently retrieving a hardware identifier that can be used to track a device across networks. No public exploit has been identified at time of analysis, and CISA SSVC assessment places exploitation at none.
Location metadata disclosure in Android 17's MediaProvider component allows a low-privileged local app to bypass permission enforcement in getQueryBuilderInternal of MediaProvider.java and retrieve GPS coordinates embedded as EXIF metadata in media files without holding the ACCESS_MEDIA_LOCATION permission. The root cause is CWE-862 (Missing Authorization) in the query builder logic - the authorization gate that should block location-tagged media queries from unpermissioned callers is absent or incorrectly applied. No public exploit has been identified, and the CVSS 3.3 score reflects both the constrained local attack surface and the limited disclosure scope.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Local information disclosure in Android 14-16 allows any installed app with basic privileges to read wallet contextual location data by calling WalletContextualLocationsService without a working authorization gate. The root cause is a missing permission check in the isCallerAllowed method of WalletContextualLocationsService.kt (CWE-862): the service fails to verify that the caller holds the required wallet-access permission before returning location context. Impact is limited to confidentiality of wallet location data; no code execution, integrity modification, or privilege escalation is possible. No public exploit code has been identified and EPSS is 0.11% (2nd percentile), reflecting negligible current exploitation interest.
Unauthenticated remote access to a backup archive file (`example.7z`) in ningzichun's Student Management System exposes sensitive application data to any network attacker. The Backup Handler component stores or serves this archive at a predictable location without access control, enabling direct retrieval of backup contents that may include database dumps, student records, or application credentials. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the project maintainer has not responded; no patched release exists.
Weak password hashing in aircheng-org iWebShop-5 (all documented versions 5.0-5.15) enables an attacker who separately obtains the application's credential store to crack administrator passwords with significantly reduced effort, due to insufficient computational complexity in the Authentication Storage component's hashing routine within controllers/admin.php. A proof-of-concept exploit has been published (CVSS 4.0 E:P, SSVC Exploitation:poc), and the vendor has not responded to coordinated disclosure via GitHub issue #7, leaving all v5.x branch installations unpatched. No CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis.
Out-of-bounds read in Microsoft Office Excel's file parser allows a local attacker to disclose process memory contents when a victim opens a specially crafted Excel document. Affected across all major release channels including Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac variants. No public exploit has been identified at time of analysis, and SSVC classifies exploitation as none with non-automatable delivery.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Uninitialized resource use (CWE-908) in Microsoft Excel allows a local attacker to disclose process memory contents when a user opens a specially crafted workbook. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS, with vendor patches released across all Windows builds. No public exploit has been identified and SSVC rates exploitation as none with partial technical impact, placing real-world risk firmly in the moderate range despite the C:H CVSS metric.
Unauthenticated network access to read-only PIMBoards endpoints in AVEVA Pipeline Integrity Monitor exposes operational data intended exclusively for authenticated PIMBoards users. The root cause is CWE-862 Missing Authorization - read paths lack access control enforcement, allowing any network-reachable attacker to retrieve restricted information without credentials. Write operations are explicitly unaffected, bounding the impact to confidentiality. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation as none and technical impact as partial.
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.
Sensitive information disclosure in Google Chrome's Mobile component on iOS (versions prior to 153.0.8010.36) allows remote unauthenticated attackers to leak confidential browser data by luring victims to a crafted HTML page through social engineering. The flaw is platform-specific - affecting only the iOS Mobile code path, not desktop or Android - and is fixed in the 153.0.8010.36 stable channel release. No active exploitation is confirmed (not in CISA KEV) and EPSS probability is 0.17% (7th percentile), consistent with Chromium's own 'Low' severity rating, which contrasts with the NVD CVSS 6.5 Medium score.
Cross-origin information leakage in Google Chrome's Select element (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to infer sensitive user state by observing behavioral discrepancies in how the `<select>` element renders when a victim browses to a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), a classic browser side-channel class that enables cross-site information inference - for example, whether a user is authenticated to a third-party origin or has visited specific URLs. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with the Chromium team's own 'Low' severity rating despite NVD's CVSS 6.5.
UI spoofing via a confused deputy flaw in Google Chrome's Fullscreen API (all versions prior to 153.0.8010.36) enables a remote attacker who has already compromised the renderer process to impersonate browser-trusted UI elements using a crafted HTML page and social engineering. This is a secondary exploitation step - it does not provide initial access - and becomes relevant only after a separate, higher-severity renderer compromise has been achieved. No public exploit code or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects very low automated exploitation probability consistent with the chained, human-dependent attack path.
Observable SVG discrepancy in Google Chrome prior to 153.0.8010.36 enables remote attackers to infer sensitive cross-origin information by inducing measurable rendering behavioral differences via a crafted HTML page. The root cause is CWE-203, a side-channel class where an attacker observes system behavior variations to deduce protected state. No public exploit code or active exploitation is identified; Chromium's own 'Low' severity designation and an EPSS of 0.17% (7th percentile) together indicate limited real-world exploitation likelihood despite the NVD's C:H confidentiality metric.
Out-of-bounds read in the Tint WGSL shader compiler in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to read limited memory contents within the browser's renderer sandbox by directing a victim to a crafted HTML page. Scope is confined to the sandbox (S:U/C:L), with no integrity or availability impact and no sandbox escape; Chromium rates this 'Low' severity, consistent with the CVSS 4.3 score. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), indicating low exploitation probability; a vendor-released patch is available in Chrome 153.0.8010.36.
Cross-origin data leakage in Google Chrome's Prefetch subsystem (versions prior to 153.0.8010.36) enables a remote attacker to infer information about cross-origin resources via an observable discrepancy side-channel triggered by a crafted HTML page. The vulnerability affects unauthenticated users who visit the malicious page, requiring only passive user interaction (browsing). Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit or active exploitation has been identified at time of analysis.
Observable discrepancy in Chrome's Layout engine prior to version 153.0.8010.36 allows a remote attacker to infer sensitive cross-origin information by measuring rendering differences triggered by a crafted HTML page. The CWE-203 root cause - an attacker-observable behavioral difference that correlates with secret state - places this in the browser side-channel (XSLeak) family, where layout timing or geometry variations can reveal whether a user is authenticated to a third-party origin or whether specific cross-origin resources exist. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest.
Observable DOM discrepancy in Google Chrome prior to 153.0.8010.36 enables cross-origin information leakage via a CWE-203 side-channel, allowing a remote attacker to infer sensitive data from a victim's browser state. Exploitation requires social engineering to lure the target to a crafted HTML page, satisfying the required user interaction. No public exploit code or CISA KEV listing is associated with this vulnerability, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest at time of analysis.
Out-of-bounds read in ANGLE (Chrome's OpenGL ES translation layer) in Google Chrome prior to 153.0.8010.36 enables a remote unauthenticated attacker to read limited memory content outside the renderer sandbox by luring a user to a crafted HTML page. Unlike co-patched ANGLE issues in the same Chrome 153.0.8010.36 release that achieve full sandbox escape and remote code execution, this flaw is bounded to confidentiality impact only with no scope change - the read does not escape the renderer process. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.17% reflects minimal current attacker interest.
Cross-origin data exfiltration in Google Chrome's CORS implementation prior to 153.0.8010.36 is exploitable only as a second-stage technique by an attacker who has already compromised the renderer process, allowing them to read data from foreign origins the victim is authenticated to via a crafted HTML page. With a CVSS of 3.1, EPSS of 0.17% (7th percentile), no CISA KEV listing, and no public exploit code identified, this represents a low standalone risk - its relevance is as a data-harvesting primitive chained after a renderer RCE. Chromium rated it 'Medium,' consistent with the constrained exploitation path.
ControlledFrame in Google Chrome prior to 153.0.8010.36 exposes sensitive information to an attacker who has already achieved renderer process compromise, exploitable via a crafted HTML page (UI:R). This is a chained post-exploitation primitive rather than an initial access vector: it extends the damage of a separate renderer exploit by enabling cross-origin data exfiltration from the victim's session. No public exploit code exists, EPSS stands at 0.29% (21st percentile), and no CISA KEV listing is present, consistent with the high effective exploitation barrier imposed by the renderer pre-compromise requirement.
Cross-origin data disclosure in Google Chrome's Paint rendering component (versions prior to 153.0.8010.36) enables a remote attacker to read data belonging to a different web origin by directing a victim to a crafted HTML page. The root cause is an origin validation error (CWE-346) in the Paint pipeline, which under certain rendering conditions fails to enforce the Same-Origin Policy, leaking partial cross-origin data to the attacker-controlled page. EPSS is 0.14% (3rd percentile), Chromium rates this 'Medium,' and no public exploit or CISA KEV listing exists at time of analysis - placing this squarely in standard patch-cadence rather than emergency response territory.
UI misrepresentation in Google Chrome's Payments component prior to 153.0.8010.36 allows a remote attacker to spoof payment-related interface elements by serving a crafted HTML page. The spoofed UI can deceive users into believing they are interacting with legitimate Chrome payment dialogs, potentially facilitating credential or payment-data disclosure. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), placing real-world exploitation risk as low at this time.
Sensitive information disclosure in the Enterprise component of Google Chrome on Windows allows a remote attacker to obtain protected data by luring a user to a crafted HTML page. All Chrome releases on Windows prior to 153.0.8010.36 are affected. No public exploit has been identified at the time of analysis, and with an EPSS of 0.17% (7th percentile), opportunistic mass exploitation is unlikely in the near term despite the high confidentiality impact rating.
UI misrepresentation in Google Chrome's Geometry component (versions prior to 153.0.8010.36) enables remote attackers to spoof browser interface elements through a crafted HTML page, requiring social engineering to achieve user interaction. The flaw (CWE-451) permits an attacker to visually deceive victims about the true origin or nature of displayed content, creating a pathway for phishing and credential harvesting. No public exploit has been identified at time of analysis; vendor-released patch is available in the September 2026 stable channel update.
Observable discrepancy (CWE-203) in the Safebrowsing component of Google Chrome on iOS prior to 153.0.8010.36 enables a remote attacker with a pre-compromised renderer process to leak sensitive information through behavioral differences when processing a crafted HTML page. The vulnerability is iOS-platform-specific and is chained after renderer compromise rather than exploited standalone. No public exploit exists and EPSS probability is 0.24%, consistent with the multi-stage exploitation requirement.
ServiceWorker information leak in Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to extract sensitive information via a crafted HTML page. This is a chained exploitation technique rather than a standalone attack - requiring prior renderer process control as a hard prerequisite, making it a second-stage capability within a broader browser exploit chain. No public exploit code exists and EPSS sits at 0.29% (21st percentile), indicating low observed exploitation activity; the vulnerability is not listed in CISA KEV.
Uninitialized GPU resource use in Google Chrome on Android (prior to 153.0.8010.36) allows remote attackers to read process memory across the sandbox boundary via a crafted HTML page. The CVSS S:C (scope changed) metric confirms the vulnerability crosses Chrome's GPU sandbox, leaking partial memory contents outside the sandboxed GPU process to a network-positioned attacker. No public exploit or CISA KEV listing exists; EPSS of 0.31% (24th percentile) indicates low observed exploitation probability, consistent with Chromium's 'Medium' severity rating.
Cross-origin data leakage in the Chrome Downloads subsystem exposes sensitive information to attackers who have already established renderer process compromise. Chrome versions prior to 153.0.8010.36 are affected; exploitation requires a renderer-compromised context combined with user interaction via a crafted HTML page. Google rated this 'Medium' internally; the CVSS 3.1 score of 3.1 reflects its role as a second-stage exploitation step rather than a standalone critical flaw. No public exploit code or CISA KEV listing exists at time of analysis.
Navigation component information leak in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass site isolation and exfiltrate cross-origin data via a crafted HTML page. This is a second-stage exploit component: it cannot be chained without a prior renderer compromise, which significantly elevates the effective attack complexity despite the AV:N/AC:L CVSS surface reading. Chromium's own severity rating is 'Medium', consistent with the prerequisite constraint. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) reflects the elevated bar for exploitation.
Cross-origin data exposure in Google Chrome's Scroll component (all versions prior to 153.0.8010.36) enables an attacker who has already achieved renderer process compromise to exfiltrate sensitive data from other web origins via a crafted HTML page. This is a secondary-stage vulnerability - it does not provide initial access but extends an existing renderer compromise into a cross-origin information leak. Chromium rated this Medium severity, consistent with the 4.3 CVSS score; no public exploit exists and EPSS at 0.17% (7th percentile) reflects the narrow, chained exploitation scenario.
Cross-origin data leakage via Google Chrome's ServiceWorker implementation allows remote attackers to obtain information from other origins by serving a crafted HTML page to a victim. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.21% reflects low real-world exploitation activity.
UI element spoofing in Google Chrome's Geometry rendering component (versions prior to 153.0.8010.36) enables a remote attacker to misrepresent browser chrome and UI elements through a crafted HTML page, requiring the victim to visit the malicious page via social engineering. The vulnerability, classified under CWE-451 (User Interface Misrepresentation of Critical Information), allows an attacker to render fake address bars, security dialogs, or browser-level indicators in a way that deceives users into disclosing credentials or taking unintended actions. No public exploit code has been identified and no CISA KEV listing exists; EPSS at 0.21% (11th percentile) reflects negligible observed exploitation activity.
Google Chrome's browser UI component (all versions prior to 153.0.8010.36) is vulnerable to visual spoofing attacks where an attacker can manipulate how the browser presents security-critical interface elements to users. By serving a specially crafted HTML page combined with social engineering, a remote unauthenticated attacker can make Chrome display misleading UI indicators - such as deceptive origin representations or manipulated security signals - potentially enabling credential theft or unauthorized permission grants. No public exploit code exists and the EPSS score of 0.21% (11th percentile) indicates low near-term exploitation probability, consistent with Chromium's own Medium severity classification.
UI misrepresentation in Google Chrome's FedCM (Federated Credential Management) API prior to 153.0.8010.36 enables remote attackers to spoof identity-provider sign-in dialogs via crafted HTML pages, requiring user interaction. The flaw (CWE-451) allows a malicious page to manipulate how FedCM presents credential prompts, potentially misleading users into authorizing the wrong identity provider or disclosing credential context to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified; EPSS is 0.17%, consistent with Chromium's 'Medium' severity classification.
UI spoofing in Google Chrome's FedCM (Federated Credential Management) implementation allows an attacker who has already compromised the renderer process to inject malformed identity-provider dialog elements via a crafted HTML page, potentially deceiving users into submitting credentials to an attacker-controlled endpoint. All Chrome desktop versions prior to 153.0.8010.36 are affected. The attack is two-stage: an independent renderer-compromise vulnerability must first be exploited, making this a chained post-exploitation capability rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
UI misrepresentation in Google Chrome prior to 153.0.8010.36 allows a remote attacker to spoof browser UI elements - such as the address bar, security indicators, or permission dialogs - via a specially crafted HTML page, requiring social engineering to lure the victim. Exploiting CWE-451, the attacker can deceive users into trusting a malicious or phishing page as legitimate, potentially leading to credential theft or other user-driven disclosures. No public exploit code has been identified and EPSS is 0.24% (15th percentile), consistent with the Chromium team's 'Medium' severity rating and the high-complexity social engineering prerequisite.
UI misrepresentation in Google Chrome's Downloads panel prior to version 153.0.8010.36 allows a remote attacker to spoof download-related UI elements, potentially deceiving users into accepting or running malicious content they believe to be legitimate. The vulnerability is triggered by a crafted HTML page and requires social engineering to lure a victim into visiting the attacker-controlled page. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) places real-world exploitation risk low; however, Chrome's ubiquitous deployment keeps the absolute exposure surface significant.
Improper input validation in Chrome's Interstitials component - the full-page security warning screens shown for SSL errors, Safe Browsing alerts, and download warnings - allows a remote attacker to spoof UI elements by delivering a crafted HTML page to an unsuspecting user. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No public exploit code has been identified and EPSS stands at 0.17% (7th percentile), reflecting low near-term exploitation probability, though successful abuse could undermine user trust in browser security indicators and facilitate phishing or credential harvesting.
Cross-origin data leakage in Google Chrome's Navigation component prior to version 153.0.8010.36 exposes partial information about cross-origin resources through an observable behavioral discrepancy (CWE-203 side-channel). Remote unauthenticated attackers can exploit this by serving a crafted HTML page that a victim visits, allowing inference of cross-origin data that should be protected by the Same-Origin Policy. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS at the 15th percentile confirms limited real-world exploitation pressure. Vendor-released patch is available as Chrome 153.0.8010.36.
UI spoofing in Google Chrome's Passwords component (versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. Classified as CWE-451 (UI Misrepresentation of Critical Information), this flaw could deceive users into believing they are interacting with a legitimate password prompt or credential management interface when they are not, potentially facilitating credential phishing or confusion attacks. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Cross-origin data leakage in Google Chrome's Network component prior to version 153.0.8010.36 allows remote attackers to infer information about cross-origin resources through observable behavioral discrepancies (CWE-203). Exploitation requires a victim to visit a crafted HTML page (UI:R) and involves high attack complexity (AC:H), indicating that reliable exploitation depends on meeting specific preconditions in the victim's browser or network environment. With an EPSS of 0.21% (11th percentile), no CISA KEV listing, and no confirmed public exploit, real-world risk is low despite the network-accessible attack vector.
Cross-origin data disclosure in Chrome's WebMCP component before 153.0.8010.36 enables a renderer-compromised attacker to exfiltrate cross-origin page data via a crafted HTML page. This is a second-stage vulnerability in a multi-step exploit chain - it does not enable initial access but amplifies the impact of a prior renderer compromise by breaking the same-origin boundary through the WebMCP interface. With a CVSS score of 3.1, EPSS at 0.24% (15th percentile), no KEV listing, and no public exploit identified, real-world risk is low except in targeted attack chains pairing this with a separate, more severe renderer exploit.
Uninitialized GPU resource in Google Chrome for Android (prior to 153.0.8010.36) allows a renderer-compromised attacker to read memory outside the browser sandbox via a crafted HTML page. This is a second-stage vulnerability - it requires the renderer process to already be compromised, meaning it operates as a chained exploit component rather than an independent attack path. No public exploit has been identified; EPSS is 0.19% (9th percentile), and the Chromium team rates severity as Medium, consistent with the constrained impact and high prerequisite bar.
Uninitialized memory in the Codecs component of Google Chrome before 153.0.8010.36 leaks sandbox-internal memory to a remote attacker via a crafted HTML page. The vulnerability stems from CWE-908 (use of uninitialized resource) where codec processing exposes arbitrary memory contents that happen to reside in uninitialized buffers - but exploitation is constrained entirely within the Chrome sandbox (S:U). No active exploitation is confirmed and no public exploit code exists; EPSS stands at 0.19% (9th percentile), consistent with a low-priority medium-severity disclosure issue.
Cleartext transmission of sensitive information via the HttpsUpgrades component in Google Chrome on iOS (versions prior to 153.0.8010.36) exposes user data to network-positioned attackers through crafted traffic. The HttpsUpgrades mechanism, which is responsible for automatically promoting HTTP requests to HTTPS, fails under certain conditions on iOS, leaving sensitive request content unencrypted in transit. With no public exploit identified and high attack complexity required (network positioning), the real-world risk is moderate despite the C:H confidentiality impact.
Improper input validation in Chrome's built-in Passwords component (all versions prior to 153.0.8010.36) enables a remote, unauthenticated attacker to potentially leak sensitive stored credential data via crafted network traffic. The flaw is rated CVSS 5.9 (AC:H), with Chromium assigning a 'Medium' severity consistent with the meaningful exploitation complexity required. No public exploits or active exploitation have been identified at time of analysis.
Cross-origin data disclosure in Google Chrome's WebGL subsystem (all versions prior to 153.0.8010.36) enables remote attackers to read residual GPU memory belonging to other origins by serving a crafted HTML page to an unpatched user. The root cause is CWE-908 (use of uninitialized resource): Chrome's WebGL implementation exposed GPU-side buffers to JavaScript before zeroing them, allowing fragments of prior rendering operations from cross-origin contexts to be read back. No active exploitation is confirmed (not in CISA KEV) and EPSS is low at 0.29%, consistent with the Medium Chromium severity rating and the limited, read-only impact.
Race condition in the Payments component of Google Chrome prior to 153.0.8010.36 enables remote attackers to spoof payment UI elements by delivering a crafted HTML page combined with social engineering, requiring user interaction to trigger the vulnerable timing window. The CWE-362 race condition in Chrome's Payment Request handling allows the attacker to substitute or overlay legitimate payment dialogs with fraudulent ones during the race window, potentially tricking victims into submitting payment credentials to attacker-controlled endpoints. No public exploit code exists and EPSS of 0.14% (4th percentile) reflects very low exploitation probability; Chromium rates this Medium severity.
Cross-origin data disclosure in Google Chrome's Extensions subsystem before version 153.0.8010.36 allows a remote attacker to obtain data from origins other than those the victim is currently browsing, contingent on successfully social-engineering the victim into installing a crafted malicious extension. The Chromium security team rated this Medium severity, consistent with the CVSS 4.3 score, and the EPSS probability of 0.23% confirms minimal current exploitation interest. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Uninitialized resource use in Chrome's Media component (CVE-2026-87456) enables a renderer-compromised attacker to read memory outside the Chrome sandbox via a crafted HTML page, fixed in version 153.0.8010.36. This is a post-compromise, second-stage information disclosure capability rather than a standalone entry-point vulnerability - successful exploitation requires the attacker to have already achieved code execution within the renderer process through a separate exploit. CVSS 3.4 (Low), Chromium-rated Medium, with EPSS at 0.23% and no public exploit or CISA KEV entry.
Sensitive information disclosure in Google Chrome's BackgroundFetch API allows a remote attacker who has already compromised the renderer process to leverage the BackgroundFetch service worker mechanism as a confused deputy, leaking sensitive data via a crafted HTML page. Affected versions are all Chrome releases prior to 153.0.8010.36; Chromium rates this Medium, consistent with the CVSS 5.3 score that reflects the high-complexity prerequisite of a compromised renderer. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS places exploitation probability at 0.20% (10th percentile).
Observable discrepancy in Google Chrome's Autofill subsystem prior to version 153.0.8010.36 enables remote information disclosure through a crafted HTML page. An unauthenticated remote attacker who tricks a user into visiting a malicious page can exploit timing or behavioral side-channel differences (CWE-203) in Autofill's response to form field probes to infer sensitive data stored in Chrome's Autofill database - potentially including names, addresses, and saved form values. No public exploit code or active exploitation has been identified; EPSS stands at 0.29% (21st percentile), indicating low current exploitation pressure.
Out-of-bounds memory read in the WebView component of Google Chrome on Android allows an attacker who has already compromised the renderer process to escape the sandbox and read arbitrary memory via a crafted HTML page. The vulnerability is fixed in Chrome 153.0.8010.36; all prior Android Chrome versions are affected. No public exploit code has been identified and EPSS probability is low at 0.22%, though the scope-changed confidentiality impact is significant if renderer compromise is already achieved.
Type confusion in V8, Chrome's JavaScript engine, enables remote attackers to read memory within the Chrome sandbox by directing a user to a crafted HTML page. All Chrome desktop builds prior to 153.0.8010.36 are affected. The demonstrated impact is limited to partial in-sandbox memory disclosure - no integrity loss, no availability impact, and no sandbox escape is described. No public exploit is identified at time of analysis, and EPSS sits at 0.23%, reflecting low current real-world exploitation pressure.
Memory read outside the renderer sandbox in Google Chrome's GPU component affects all desktop versions prior to 153.0.8010.36. An uninitialized GPU resource (CWE-908) enables an attacker who has already gained code execution inside the renderer process to read stale memory contents from outside the sandbox boundary via a crafted HTML page, exposing browser process memory or heap addresses. No active exploitation has been confirmed (not in CISA KEV) and EPSS is 0.24% at the 16th percentile, consistent with the high-complexity, two-stage attack prerequisite.
Out-of-bounds read in ANGLE (Chrome's graphics translation layer) affects Google Chrome prior to 153.0.8010.36, enabling a remote attacker to read memory from the renderer process when a victim visits a crafted HTML page. The impact is limited to partial confidentiality disclosure (C:L) with no integrity or availability consequence, and the vulnerability is contained within the renderer sandbox (S:U). No public exploit code and no CISA KEV entry have been identified at time of analysis; vendor-released patch 153.0.8010.36 is available.
Out-of-bounds memory read in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows prior to 153.0.8010.36 allows a local attacker to read memory beyond the Chrome sandbox boundary via a crafted local program. The vulnerability carries a CVSS score of only 2.7 (Low), reflecting significant exploitation constraints: local access, high attack complexity, required user interaction, and a partial confidentiality-only impact with no integrity or availability consequence. No public exploit has been identified, EPSS sits at the 4th percentile (0.15%), and SSVC classifies exploitation status as none with non-automatable, partial technical impact.
Out-of-bounds read in GPAC's HTTP chunked-transfer downloader (src/utils/downloader.c) crashes the application when processing a server-supplied chunked HTTP response whose declared chunk size exceeds safe bounds. Affected versions include GPAC v26.07.0; the upstream fix introduces a 1 GB chunk-size ceiling and a pre-allocation integer-overflow guard in gf_dm_data_received. No public exploit has been identified at time of analysis, and CVSS UI:R confirms that exploitation requires a user to initiate a connection to an attacker-controlled media source.
Out-of-bounds read in GPAC v26.07.0's HTTP download subsystem (gf_dm_data_received in downloader.c) enables remote denial of service when a victim user processes a crafted HTTP response containing a malformed or pathologically large chunk-size value. The upstream fix commit confirms two root causes: absence of an upper-bound cap on parsed chunk sizes and an unchecked integer overflow in the nbBytes + hdr_size computation that causes accounting to wrap around before the out-of-bounds read occurs. Impact is limited to application crash with no confidentiality or integrity consequences; no public exploit code has been identified at time of analysis and the vulnerability is not listed in CISA KEV.
Out-of-bounds read in stb_truetype's stbtt_GetGlyphShape function enables denial of service against any application that parses attacker-supplied TrueType font files using the nothings/stb library at commit 31c1ad3. The affected function reads glyph outline data from a crafted TTF without sufficient bounds validation, causing an abnormal read that crashes the host application. No public exploit code or CISA KEV listing was identified at time of analysis; CVSS 4.3 with UI:R reflects the realistic, user-triggered exposure.
Out-of-bounds memory read in the stb library's stbsp_vsnprintf function (stb_sprintf.h) at commit 31c1ad3 enables a denial-of-service condition when a consuming application passes attacker-controlled input to the function. The nothings/stb project is Sean Barrett's widely-vendored, public-domain, single-file C library suite embedded across game engines, imaging tools, and embedded systems. No public exploit code and no CISA KEV listing exist at time of analysis; the local attack vector and high attack complexity in the CVSS vector further limit practical exploitability.
Heap out-of-bounds read in gdk-pixbuf's ICNS decompression routine allows an attacker to crash GNOME applications or disclose adjacent heap memory by supplying a crafted Apple Icon Image (.icns) file. The uncompress() function, which handles RLE-encoded ICNS data, lacks bounds validation on the source buffer during decompression. Exploitation requires user interaction - the target must open or preview the malicious file - but thumbnail-rendering paths in file managers such as Nautilus may reduce that barrier. No public exploit or KEV listing has been identified at the time of analysis.
Side-channel route enumeration in Maravel PHP framework (versions prior to 10.73.1) allows unauthenticated remote attackers to map internal API route structures and controller parameter schemas by exploiting a differential HTTP response. The router's static route checklist incorrectly stores raw dynamic placeholder strings (e.g., `{id}`), so passing literal brace syntax in a request URL bypasses the dynamic tree engine, triggers a PHP 8+ `ArgumentCountError`, and returns a 500 Internal Server Error rather than the expected 404. An adversary can systematically fuzz endpoints with template-syntax paths, distinguish 500 from 404 responses, and reconstruct the application's routing schema without any authentication. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Token cache isolation failure in react-native-auth0's web platform implementation exposes authentication tokens across user sessions when the SDK is deployed in server-side rendering (SSR) environments. Versions 5.0.0 through 5.11.0 cache OAuth/OIDC tokens at module scope - a singleton that persists across all HTTP requests handled by the same Node.js server process - meaning a token obtained during one user's request can be returned to a subsequent, unrelated request processed by the same runtime. The flaw is classified as CWE-488 (Exposure of Data Element to Wrong Session) and carries CVSS 6.5 with high confidentiality impact; no public exploit code or CISA KEV listing has been identified.
Prototype Pollution in Adobe Acrobat and Acrobat Reader (versions through 26.002.21900 and Acrobat 2024 through 24.001.30383) allows an attacker who can deliver a crafted PDF to break out of the Reader's JavaScript sandbox and read arbitrary files from the victim's filesystem. The flaw abuses CWE-1321 to modify built-in JavaScript object prototypes inside Acrobat's scripting engine, subverting sandbox boundaries in a scope-changed exploit chain (S:C). No public exploit code or CISA KEV listing has been identified at time of analysis, but the low attack complexity once a victim opens the file elevates operational urgency for organizations reliant on Acrobat in document-heavy workflows.
Out-of-bounds read in Adobe Acrobat and Acrobat Reader exposes sensitive process memory to attackers who can deliver malicious PDF files. Affected versions include Acrobat Reader and Acrobat 2024 up to 26.002.21900 and 24.001.30383 respectively. Exploitation requires a victim to open a crafted file, but no system privileges are needed - the barrier is solely user interaction, making phishing and email-borne delivery effective vectors.
Out-of-bounds read in Adobe Acrobat Reader (≤26.002.21900) and Acrobat 2024 (≤24.001.30383) exposes sensitive process memory when a victim opens a specially crafted PDF file. The vulnerability stems from CWE-125, an out-of-bounds read, allowing an attacker who delivers a malicious document to obtain memory contents that could facilitate ASLR bypass or exfiltrate in-memory data such as document content or credentials. No public exploit has been identified at time of analysis; exploitation requires user interaction via file opening.
Out-of-bounds read in Adobe Acrobat Reader and Adobe Acrobat (all editions through version 26.002.21900, and Acrobat 2024 through 24.001.30383) enables sensitive process memory disclosure when a victim opens a specially crafted document. Rooted in CWE-125 improper bounds enforcement during file parsing, the flaw leaks adjacent memory contents including potential pointers or cached sensitive data. No active exploitation has been confirmed and no public proof-of-concept is known at time of analysis.
Integer underflow (CWE-191) in Adobe Acrobat Reader allows an attacker to disclose sensitive process memory contents by tricking a victim into opening a crafted PDF or Acrobat file. Affected across all current Acrobat 2024 (≤24.001.30383) and Acrobat/Acrobat Reader continuous-track (≤26.002.21900) releases. No active exploitation confirmed in CISA KEV; no public exploit code identified at time of analysis, though Adobe-class memory disclosure flaws are frequently chained with code execution primitives.
Out-of-bounds read (CWE-125) in Adobe Acrobat and Acrobat Reader - versions up to 26.002.21900 and Acrobat 2024 up to 24.001.30383 - allows disclosure of sensitive process memory when a victim opens a specially crafted document file. The confidentiality impact is rated high (C:H), meaning leaked memory contents could include pointers, session data, or other in-process secrets, though there is no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis; Adobe has published advisory APSB26-141 addressing the issue.
Out-of-bounds read in Adobe Acrobat Reader and Acrobat (Continuous Track ≤26.002.21900; Classic 2024 Track ≤24.001.30383) allows an attacker to disclose sensitive memory contents from a victim's process by delivering a crafted PDF file that the victim must open. The flaw is rooted in CWE-125 and carries a CVSS 5.5 score reflecting its local, user-interaction-dependent attack vector with high confidentiality impact but no integrity or availability loss. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cleartext transmission of administration credentials over HTTP in U-speed WIFI4 N300 T1 Pro v1.0.0 exposes router admin passwords to passive eavesdroppers on the same network segment. Any attacker with adjacent network access - including a co-located wireless client - can capture HTTP session traffic containing unencrypted credentials without any authentication or interaction. No public exploit code has been confirmed and EPSS is minimal (0.15%), but the attack is trivially executable with standard packet capture tools once adjacent network access is established.
Argument injection in the Okta Privileged Access Client's scaleft:// URL protocol handler allows an unauthenticated remote attacker to manipulate SSH client behavior by supplying hyphen-prefixed values in a crafted link. Versions 1.18.0 through 1.112.x omit the option terminator (--) before appending URL-derived values to SSH command-line arguments, causing the underlying SSH binary to interpret attacker-controlled strings as CLI flags rather than literal targets. A vendor patch is available in version 1.113.0; no public exploit code or CISA KEV listing has been identified at time of analysis.
Credential exposure in Okta Hyperdrive Agent versions 1.4.0 through 1.5.1 allows any local user with log file read access to obtain live SAML bearer assertions logged in cleartext on every successful MFA completion. Because SAML bearer assertions function as authentication credentials, a local attacker can replay them to authenticate as the victim user to any service provider trusting the Okta identity provider. No public exploit has been identified at time of analysis, but the vulnerability is trivially exploitable once log file access is obtained.
Improper authorization in seakee CPA-Manager-Plus 1.11.0-1.11.10 allows unauthenticated remote attackers to have GET and HEAD requests forwarded to the backend CPA service using the application's saved management key, granting read-level access to resources that should require admin credentials. The flaw resides in the CPAResource HTTP proxy handler (`apps/manager-server/internal/http/controller/proxy/handler.go`), where `useSavedManagementKey` was hardcoded to `true` for all read-method requests without invoking `AdminAuthService.VerifyHeader`, a check that was only performed for mutating methods. No public exploit code has been identified at time of analysis, and the vendor-released patch in v1.11.11 resolves the issue.
Session fixation (CWE-384) in ningzichun Student Management System allows a remote attacker to pre-set a victim's session identifier via login.php, then hijack the authenticated session after the victim logs in. The login.php file's use of session_start fails to regenerate the session ID upon successful authentication, making any pre-supplied session ID persist into the authenticated state. Publicly available exploit code exists (E:P per CVSS 4.0 supplemental vector), though no active exploitation has been confirmed in CISA KEV.
Sensitive information disclosure via verbose error messages in Microsoft Skype for Business Server allows unauthenticated network attackers to capture confidential application data when a victim user triggers an error condition. Three on-premises server product lines are affected - the 2015, 2019, and Subscription Edition branches - with Microsoft-released patches available for all three. No public exploit code or active exploitation has been identified; SSVC assessment rates the attack as non-automatable with partial technical impact.
Out-of-bounds heap read in Android's ResourceTypes.cpp `setTo` function exposes local heap memory to low-privileged processes across Android 14 through 17. The missing bounds check requires only standard user-level execution - no elevated privileges and no user interaction - to trigger partial disclosure of heap contents. No active exploitation has been identified; EPSS probability is 0.12% (2nd percentile), consistent with a low-severity local disclosure in a narrow attack surface.
Out-of-bounds read in Android's 802.11be (WiFi 7 / EHT) parsing code exposes kernel or userspace memory to adjacent attackers across all currently supported Android releases (14, 15, 16, 16-QPR2, and 17). The flaw resides in get_eht_operation_channel_width() within ieee802_11_common.c, where an incorrect bounds check allows a crafted EHT Operation element - delivered via a rogue access point - to read past the end of a buffer, leaking memory contents to the attacker. With EPSS at 0.12% and no KEV listing, real-world exploitation is not currently observed, but the adjacency-only prerequisite makes this relevant to targeted or physical-proximity attacks.
Local information disclosure affects Android 14 through 17, including the Android 16-QPR2 branch, due to a logic error causing improper data sanitization across multiple code locations. An unprivileged local application can exploit this flaw without any user interaction to read data it should not have access to. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects very low observed exploitation interest.
Local information disclosure in Android's AppFuseBridge framework component allows any installed app to read files or data it lacks permission to access. The vulnerability exists in the openFile() method of AppFuseBridge.java, where a missing permission check (CWE-693) permits a low-privileged local process to bypass access controls without user interaction. Affected versions span Android 14 through 17, including the QPR2 interim release, giving this issue a broad footprint across current Android deployments. No public exploit or active exploitation has been identified; EPSS is 0.12% (2nd percentile), consistent with the local-only, low-impact nature of the flaw.
Local information disclosure in Android 15 through 17 exploits a confused deputy flaw in `screenArgsForPermissionCheckIfAny`, allowing a low-privileged local app to bypass permission validation and access data it should not be authorized to read. The flaw stems from a privileged component incorrectly acting on behalf of a less-privileged caller without adequate permission verification, resulting in unauthorized local data exposure. No public exploit has been identified at time of analysis, and with an EPSS of 0.12% this is assessed as low-priority despite Android's broad deployment footprint.
Local information disclosure in Android's MediaProvider component affects Android 14 through 17 via a race condition in `updateInternal` of `MediaProvider.java`. An unprivileged local application can exploit a time-of-check-time-of-use (TOCTOU) window during a media record update operation to read file contents that should not be accessible, without requiring elevated privileges. No public exploit has been identified at time of analysis, and EPSS at 0.12% (2nd percentile) reflects the low probability of widespread automated exploitation.
Local information disclosure in Android's `getAllSessions` function across multiple files allows a low-privileged application to obtain session data it is not authorized to access, exploiting a confused-deputy logic error in the code. Affected versions span Android 15, 16, 16-qpr2, and 17, as documented in the September 2026 Android Security Bulletin. No public exploit or active exploitation has been identified; EPSS sits at 0.12%, reflecting the low real-world threat level consistent with the CVSS 3.3 rating.
Missing permission check in multiple functions of RangingServiceImpl.java on Android enables a man-in-the-middle attacker to intercept ranging service communications and disclose sensitive information without requiring additional execution privileges. Affected versions span Android 16, Android 16-QPR2, and Android 17, covering current and near-future Android releases. No public exploit has been identified at time of analysis, and EPSS is very low at 0.14%, but the network-reachable attack surface and absence of user interaction required warrant attention in environments handling proximity or location-sensitive data.
Local information disclosure in Android 14 through 17 stems from a logic error across multiple functions in XmpDataParser.java that causes improper sanitization of XMP metadata during media file parsing. A local attacker with standard user-level privileges can trigger the flaw without any user interaction, leaking restricted information from the parsing context. No public exploit code or active exploitation has been identified, and the September 2026 Android Security Bulletin provides the authoritative patch.
Tapjacking via malicious UI overlay in Android 17's ContactsPickerActivity allows a locally installed application to present misleading UI over the contacts picker, resulting in local information disclosure of contact data. The attack requires only low-privilege access (a sideloaded or installed app) and no user interaction once the overlay is active. No public exploit code is identified, and EPSS at the 2nd percentile reflects negligible opportunistic exploitation probability.
Bluetooth encryption downgrade in Android's `btm_sec_encrypt_change` function (btm_sec.cc) exposes information on Android 17 and Android 16-QPR2 devices by allowing a logic error in encryption change handling to be exploited without user interaction. A Bluetooth-adjacent attacker with a low-privilege connection can trigger the downgrade, reducing encryption strength and enabling passive interception of Bluetooth traffic. No public exploit or CISA KEV listing exists at time of analysis; EPSS is 0.16%, indicating very low observed exploitation probability.
Local information disclosure in Android 16 and 17 exposes the device Bluetooth MAC address through a missing permission check in the writeToParcel method of BleRssiRangingCapabilities.java. Any low-privileged local application can invoke this code path without holding the required Bluetooth permission, silently retrieving a hardware identifier that can be used to track a device across networks. No public exploit has been identified at time of analysis, and CISA SSVC assessment places exploitation at none.
Location metadata disclosure in Android 17's MediaProvider component allows a low-privileged local app to bypass permission enforcement in getQueryBuilderInternal of MediaProvider.java and retrieve GPS coordinates embedded as EXIF metadata in media files without holding the ACCESS_MEDIA_LOCATION permission. The root cause is CWE-862 (Missing Authorization) in the query builder logic - the authorization gate that should block location-tagged media queries from unpermissioned callers is absent or incorrectly applied. No public exploit has been identified, and the CVSS 3.3 score reflects both the constrained local attack surface and the limited disclosure scope.
Unauthorized access to and modification of device credentials is possible in Android 14 through 17 due to a missing permission check in the `onCreate` method of `ConfirmDeviceCredentialActivity.java`. Any locally installed application running with standard user-level privileges can trigger this flaw without requiring user interaction, gaining read access to - and potentially altering - stored device credential state. No public exploit code exists and EPSS sits at 0.11% (2nd percentile), placing current real-world exploitation risk very low despite the breadth of affected Android versions.
Local information disclosure in Android 14-16 allows any installed app with basic privileges to read wallet contextual location data by calling WalletContextualLocationsService without a working authorization gate. The root cause is a missing permission check in the isCallerAllowed method of WalletContextualLocationsService.kt (CWE-862): the service fails to verify that the caller holds the required wallet-access permission before returning location context. Impact is limited to confidentiality of wallet location data; no code execution, integrity modification, or privilege escalation is possible. No public exploit code has been identified and EPSS is 0.11% (2nd percentile), reflecting negligible current exploitation interest.
Unauthenticated remote access to a backup archive file (`example.7z`) in ningzichun's Student Management System exposes sensitive application data to any network attacker. The Backup Handler component stores or serves this archive at a predictable location without access control, enabling direct retrieval of backup contents that may include database dumps, student records, or application credentials. A proof-of-concept exploit has been publicly disclosed via a GitHub issue report, and the project maintainer has not responded; no patched release exists.
Weak password hashing in aircheng-org iWebShop-5 (all documented versions 5.0-5.15) enables an attacker who separately obtains the application's credential store to crack administrator passwords with significantly reduced effort, due to insufficient computational complexity in the Authentication Storage component's hashing routine within controllers/admin.php. A proof-of-concept exploit has been published (CVSS 4.0 E:P, SSVC Exploitation:poc), and the vendor has not responded to coordinated disclosure via GitHub issue #7, leaving all v5.x branch installations unpatched. No CISA KEV listing exists, indicating no confirmed widespread active exploitation at time of analysis.
Out-of-bounds read in Microsoft Office Excel's file parser allows a local attacker to disclose process memory contents when a victim opens a specially crafted Excel document. Affected across all major release channels including Excel 2016, Office 2019, LTSC 2021, LTSC 2024, Microsoft 365 Apps for Enterprise, and Mac variants. No public exploit has been identified at time of analysis, and SSVC classifies exploitation as none with non-automatable delivery.
Out-of-bounds memory read in Windows Virtualization-Based Security (VBS) Enclave allows a locally authorized attacker to disclose protected enclave memory contents. Affected systems span Windows 11 versions 23H2 through 26H1 and Windows Server 2025; Microsoft has issued patched builds addressing the flaw. SSVC assessment places current exploitation at none with partial technical impact, consistent with the strictly local, non-automatable attack surface.
Uninitialized resource use (CWE-908) in Microsoft Excel allows a local attacker to disclose process memory contents when a user opens a specially crafted workbook. Affected products span Excel 2016 through Microsoft 365 Apps for Enterprise on both Windows and macOS, with vendor patches released across all Windows builds. No public exploit has been identified and SSVC rates exploitation as none with partial technical impact, placing real-world risk firmly in the moderate range despite the C:H CVSS metric.
Unauthenticated network access to read-only PIMBoards endpoints in AVEVA Pipeline Integrity Monitor exposes operational data intended exclusively for authenticated PIMBoards users. The root cause is CWE-862 Missing Authorization - read paths lack access control enforcement, allowing any network-reachable attacker to retrieve restricted information without credentials. Write operations are explicitly unaffected, bounding the impact to confidentiality. No public exploit code or active exploitation has been identified at time of analysis; CISA SSVC rates exploitation as none and technical impact as partial.
Type confusion (CWE-843) in Microsoft Office Excel enables local information disclosure when a victim opens a specially crafted Excel file. Affected products span Excel 2016, Office 2019, Office LTSC 2021/2024, Microsoft 365 Apps for Enterprise, Office Online Server, and multiple Mac Office variants. The vulnerability carries a CVSS 5.5 with High confidentiality impact but no integrity or availability impact; no public exploit or active exploitation has been identified at time of analysis.