Memory Corruption

Remote code execution in Microsoft Edge (Chromium-based) is enabled by a type confusion vulnerability (CWE-843) that can be triggered when a user visits attacker-controlled web content. All versions of Edge (Chromium-based) are affected per the wildcard CPE, with full confidentiality, integrity, and availability impact at a CVSS 8.8. A vendor patch is available via the Microsoft Security Response Center; no active exploitation has been confirmed and no public exploit code has been identified at time of analysis.

Use-after-free (CWE-416) in Microsoft Edge (Chromium-based) allows a remote, unauthenticated attacker to crash the browser through a crafted webpage, resulting in a denial-of-service condition. Critically, the CVE description claims code execution capability, but the CVSS vector (C:N/I:N/A:L, score 4.3) directly contradicts this - a genuine RCE would produce C:H/I:H impact in the 8-9+ range; this discrepancy should be verified against the full MSRC advisory. No active exploitation has been confirmed and no public POC has been reported; a vendor patch is available via the Microsoft Security Response Center.

Stack buffer overflow in Ericsson CodeChecker through 6.28.2 results from an off-by-two error introduced during the CVE-2025-40843 remediation: the safe_strcpy() call at ldlogger-tool-gcc.c:129 receives destination pointer fullPath + 2 but the full PATH_MAX (4096) as its size bound, causing a deterministic 2-byte overwrite past the 4094 bytes that actually remain on every invocation of the GCC logger component. The overflow is unconditional and input-independent; a proof-of-concept is noted via the CVSS 4.0 E:P supplemental metric, though no active exploitation (CISA KEV) has been confirmed.

Use-after-free in the OX Dovecot Pro and Dovecot CE mail-editing code lets an authenticated user who can install a Sieve filter with the editheader extension corrupt memory during mail delivery, leaking out-of-bounds buffer contents into the delivered message and potentially crashing or executing code in the delivery process. The flaw is remotely reachable with low-privilege credentials (CVSS 9.1, scope-changed) and combines information disclosure with a denial-of-service and possible RCE. No public exploit is identified at time of analysis and it is not on CISA KEV, so risk is currently theoretical but severe.

Heap buffer overflow in FFmpeg's TDSC screen-capture codec decoder exposes Red Hat Enterprise Linux AI 3 and OpenShift AI deployments to denial of service or potential arbitrary code execution. The tdsc_load_cursor() function performs erroneous stride-based pointer arithmetic in two locations when rendering cursor data from crafted TDSC video, writing past a heap-allocated buffer boundary. No public exploit or active exploitation has been confirmed at time of analysis, and the upstream fix is available as FFmpeg commit 242ff799c.

Buffer overflow in the WatchGuard Fireware OS Management Web UI allows an authenticated administrator with network access to trigger a denial-of-service condition or potentially execute arbitrary code by submitting specially crafted traffic to the management interface. The root cause is CWE-787 (out-of-bounds write) in the web-based management component, and the CVSS 4.0 vector confirms network reachability with high-privilege authentication as prerequisites. No public exploit code or active exploitation has been identified at time of analysis, though the RCE potential on a network perimeter device elevates the severity beyond what the privilege requirement alone might suggest.

Use-after-free in cpp-httplib's TLS WebSocket client (versions 0.33.0 through 0.50.0) corrupts process memory during ordinary secure WebSocket teardown, causing denial of service in any application that embeds this header-only C++ library with wss:// connections. The SSL/TLS session object is freed in `WebSocketClient::shutdown_and_close` before the WebSocket close frame is transmitted, but the underlying `SSLSocketStream` retains a raw pointer to the freed session and dereferences it during the close handshake. The defect is reachable through three distinct paths - the client destructor, an explicit `shutdown_and_close` call, and the `connect()` reconnect path - meaning routine connection lifecycle events, not crafted adversarial input, reliably trigger the corruption. No KEV listing or standalone public exploit exists at time of analysis; vendor-released patch version 0.50.1 is available.

Out-of-bounds write across all Bendix EC80ESP Brake ECU variants enables an unauthenticated attacker with adjacent vehicle-network access to deliver a crafted payload that establishes an arbitrary write primitive, crashing the safety-critical brake Electronic Control Unit. Reported by ICS-CERT and documented in CISA advisory ICSA-26-237-05, all ten identified EC80ESP hardware configurations are affected with no version constraint specified in the CPE data. No public exploit code or CISA KEV listing has been identified at time of analysis, but the safety implications of a crashed brake ECU demand prioritized attention by fleet operators beyond what the base score alone conveys.

Heap buffer overflow in GNU C Library (glibc) 2.45 and earlier triggers when an effectively empty string is passed via the ,ccs= mode-argument extension to fopen(), enabling limited heap memory corruption in applications that expose this code path to externally controlled input. The vendor-assigned CVSS 3.1 score of 4.9 (Medium) with a local attack vector and high complexity accurately reflects the narrow preconditions required. No public exploit code has been identified at time of analysis, and the glibc advisory itself explicitly notes this vulnerable usage pattern is absent from mainstream GNU/Linux applications.

Remote code execution in Redis affects deployments built with TLS support, where a use-after-free in the tlsProcessPendingData() function lets a remote, unauthenticated attacker corrupt memory and run arbitrary commands with the privileges of the Redis server process. Publicly available exploit code exists (v12-security PoC), and the CVSS 4.0 base score is 9.2, though the vector's Attack Requirements flag (AT:P) indicates exploitation is not fully deterministic. It is fixed in Redis 8.2.9, 8.4.6, 8.6.6, 8.8.2, and 8.10.1.

Out-of-bounds write in gdk-pixbuf's JPEG decoder affects any application on Red Hat Enterprise Linux 6 through 10 that renders JPEG images containing chunked ICC profile markers. When ICC profile parsing encounters an error, stale size metadata persists after the profile buffer is freed; a subsequent allocation within the same decode operation then writes beyond buffer boundaries, crashing the application. No active exploitation has been identified (no CISA KEV listing), and no public exploit code is known at time of analysis, but the availability-only impact and user-interaction requirement make this a realistic denial-of-service risk in desktop and server image-processing contexts.

Out-of-bounds write in Adobe DNG Software Development Kit versions 1.7.1 2502 and earlier allows memory corruption when a victim opens a maliciously crafted DNG file, causing the consuming application to crash or become unresponsive. The flaw (CWE-787) is constrained to a local, user-interaction-dependent attack path, limiting automated exploitation. No public exploit code has been identified at time of analysis and no CISA KEV listing exists.

Improper content-type caching in the Avro component of Spring Cloud Stream can produce incorrect content-type metadata on processed messages, creating a low-severity information-disclosure and data-integrity risk. Affected versions span the 4.2.x, 4.3.x, and 5.0.x release trains. Exploitation requires network access, high privilege level, high attack complexity, and user interaction, making real-world impact minimal; no public exploit code or active exploitation has been identified at time of analysis.

Root code execution in Unitree G1 EDU robot firmware through version 1.5.2 is achievable by proximate unauthenticated attackers via a chained BLE GATT and WiFi provisioning exploit requiring no pairing or credentials. Crafted BLE writes overflow a fixed BSS buffer in the SSID chunk accumulator, corrupting an adjacent mainloop function pointer dispatch entry; the cleanup path subsequently invokes this corrupted pointer, passing attacker-controlled data to system() as uid 0. A public proof-of-concept (UniBLEed) is available, and the CVSS 4.0 score of 7.7 reflects the adjacent attack vector and high complexity of the exploit chain.

Stack buffer overflow in Greenbone's OpenVAS Scanner and Greenbone OS allows a remote attacker holding user-level privileges to achieve full system compromise by supplying a malicious or compromised NASL vulnerability test (VT). Both the Greenbone OS platform and the openvas-scanner engine are confirmed affected, making this a meaningful risk in any multi-user GVM deployment or environment where user accounts may be compromised. No public exploit code has been identified at time of analysis, but the network-accessible, low-complexity attack vector and high-impact outcome place this in the immediate patching tier for production scanner infrastructure.

Out-of-bounds write in the SmiFlash SMM (System Management Mode) module affects ASUS FA507NU and FA507NV laptop BIOS firmware across all versions. A local administrator can dispatch a crafted Software SMI (SW SMI) request with an oversized length value, causing the SmiFlash handler to write beyond its allocated SMRAM buffer boundary, resulting in a system crash (BSOD) or irreversible BIOS flash corruption. The affected models are designated 'unsupported-when-assigned,' meaning these products were already outside active vendor support when this CVE was issued; no public exploit has been identified at time of analysis.

OpenStack Keystone before 29.0.3 allows any authenticated user holding role:reader on any project to enumerate all role assignments across any domain in the cloud by exploiting a type-confusion bug in the GET /v3/role_assignments endpoint. The attack supplies a domain ID as scope.project.id with include_subtree, triggering a null domain_id policy check that passes unconditionally for all callers because domains are internally modeled as projects with domain_id=null. With include_names, the response discloses the names and home-domain IDs of every user, group, project, and role across the targeted domain - and the well-known 'default' domain constant works against every deployment bootstrapped with keystone-manage bootstrap, requiring no prior reconnaissance. No public exploit code has been identified at time of analysis, and the flaw is not listed in CISA KEV.

Denial-of-service (and potential memory corruption) in the Stomper STOMP message broker (commit 5e2741e) lets remote attackers crash the broker process by abusing frame sequencing. By opening a connection that sends multiple CONNECT frames and subscribes a destination, then having another client SEND to that destination, an attacker triggers a heap use-after-free on a freed StompStreamSocket object. A public proof-of-concept write-up exists (no confirmed active exploitation), and because the protocol path requires no authentication by default, exploitation is straightforward against exposed instances.

Heap use-after-free in Stomper (commit 5e2741e) allows any unauthenticated network client to reliably crash the broker process by repeatedly issuing SUBSCRIBE commands for the same destination on a single connection and then closing it. The broker's subscription cleanup logic leaves dangling pointers in internal structures that are dereferenced during StompClient destruction, causing a denial of service. A proof-of-concept bug report is publicly available; SSVC classifies exploitation as automatable, though EPSS sits at only 0.15% (5th percentile), consistent with a niche product not yet widely targeted.

Privilege escalation in FreeBSD's kernel audio subsystem allows an unprivileged local user on systems with multiple audio devices to exploit a use-after-free in the sync group ioctl locking path to achieve full kernel compromise. The race condition arises when the ioctl releases the sync group list lock to sleep during a blocking lock attempt, and a concurrent operation frees the sync group structure before the sleeping thread reawakens and dereferences it. Affected releases include FreeBSD 14.4-RELEASE prior to p9, 15.0-RELEASE prior to p13, and 15.1-RELEASE prior to p3; no active exploitation has been confirmed (not in CISA KEV) and EPSS sits at 0.16% (6th percentile), reflecting low current threat activity.

Privilege escalation in FreeBSD 15.x unix socket implementation allows an unprivileged local user to achieve full system compromise via a use-after-free in the SOCK_STREAM receive path. Control messages are not fully detached from the socket buffer before error-path code frees the associated mbufs, leaving dangling references exploitable by a low-privileged attacker. No public exploit has been identified at time of analysis, but the low attack complexity (AC:L) and confirmed patch availability from the FreeBSD project make this a clear and immediate patching priority for affected deployments.

SMM buffer overflow in InsydeH2O's IHISI command handler for FMTS command 0x32 allows a physically-present, highly-privileged attacker to trigger out-of-bounds writes in System Management Mode firmware. The vulnerable function FMTSWriteUseIntelLib performs read and write operations without validating buffer sizes, enabling potential firmware-level memory corruption in Ring -2 execution context. No active exploitation has been identified and no public exploit exists; the combination of physical access, high privilege, high attack complexity, and required user interaction makes real-world risk extremely low despite the sensitive SMM execution environment.

Type confusion in BlueZ's SDP XML parser (sdp-xml.c) allows a low-privileged local caller to crash the bluetoothd daemon by submitting a crafted nested ServiceRecord via the RegisterProfile() D-Bus API. The parser stack is corrupted so scalar union data is misread as a sequence pointer, causing an invalid dereference and process termination - a local denial-of-service with no confidentiality or integrity impact. No public exploit code and no CISA KEV listing have been identified at time of analysis.

Sandbox-escaping remote code execution is possible in Google Chrome for iOS before 152.0.7977.65, where a use-after-free in the Sync component can be triggered by a victim visiting a crafted HTML page, potentially letting a remote attacker run arbitrary code outside the renderer sandbox. Google has shipped a fixed stable build, and there is no public exploit identified at time of analysis; the flaw is not listed in CISA KEV and SSVC records exploitation status as none. Notably, Chromium's own severity rating for this bug is Low, which stands in sharp contrast to the 9.6 CVSS score in the input.

Remote code execution within the Chrome sandbox is achievable in Google Chrome prior to 152.0.7977.65 through a use-after-free vulnerability in V8, Chrome's JavaScript engine, triggered by a crafted HTML page. Any unauthenticated remote attacker who can induce a user to visit a malicious URL can exploit this flaw; however, execution is confined to the Chrome sandbox, meaning a chained sandbox escape would be required for full host-system compromise. No public exploit code or confirmed active exploitation is documented at time of analysis, and SSVC assessment lists exploitation as none, tempering urgency despite the high CVSS base score.

Type confusion in Chrome's V8 JavaScript engine exposes memory contents within the browser sandbox to remote attackers who can socially engineer victims into visiting a crafted HTML page. All Chrome desktop releases prior to 152.0.7977.65 are affected, confirmed by the Chrome Stable Channel advisory linked in references. Despite the vendor-assigned CVSS 8.8, Chromium's own security team rated this 'Low' severity - reflecting the sandboxed scope of the memory disclosure and the required social engineering step - and EPSS probability stands at only 0.26% (18th percentile) with no CISA KEV listing, consistent with SSVC 'Exploitation: none'.

Use-after-free in the Animation component of Google Chrome prior to 152.0.7977.65 enables arbitrary code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw scores 8.8 CVSS HIGH, though Google's own internal Chromium severity rating is Low - a notable discrepancy that reflects the sandboxed containment of the impact. No public exploit code has been identified, SSVC indicates no active exploitation, and a vendor patch is confirmed available in Chrome 152.0.7977.65.

Remote code execution in Google Chrome desktop before 152.0.7977.65 arises from a use-after-free in the ServiceWorker subsystem that a crafted HTML page can trigger to run attacker code outside the renderer sandbox. Any user browsing to a malicious page with a vulnerable build is exposed, and successful exploitation yields full compromise of the host user context. No public exploit identified at time of analysis and the issue is not in CISA KEV; notably, Chromium's own severity rating is Low even though the NVD CVSS base score is 9.6, a discrepancy defenders should weigh.

Type confusion in Chrome's V8 JavaScript engine (versions prior to 152.0.7977.65) enables remote code execution within the browser sandbox when a victim is socially engineered into visiting a crafted HTML page. The vulnerability arises from a CWE-843 type confusion flaw in V8, allowing an attacker to manipulate object type assumptions at runtime to achieve arbitrary code execution. Importantly, execution is constrained to the Chrome sandbox, which Chromium's own severity rating of 'Low' reflects; no public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Google Chrome's PDF rendering subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to execute arbitrary code confined within the Chrome sandbox by delivering a crafted PDF file. The vulnerability is triggered through normal user interaction - opening a malicious PDF - requiring no privileges or authentication. While CVSS scores this 8.8 (High), Chrome's own severity rating is 'Low', reflecting the critical nuance that code execution is sandboxed and does not directly achieve host-level compromise. No public exploit exists and SSVC confirms no known exploitation at time of analysis.

Use-after-free in Google Chrome's DevTools component (all versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code inside the Chrome sandbox by distributing a crafted extension through social engineering. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact within the process scope, though exploitation is constrained by the mandatory user interaction required to install the malicious extension. No public exploit code exists and SSVC rates active exploitation as none at time of analysis, placing real-world urgency below what the raw score implies.

Type confusion in Google Chrome's DevTools component prior to version 152.0.7977.65 enables remote code execution within the browser sandbox when a victim is social-engineered into visiting a crafted HTML page. The flaw affects all Chrome platforms where DevTools is accessible and results in high confidentiality, integrity, and availability impact to the sandboxed process. No public exploit code has been identified at time of analysis, and SSVC assessment confirms no observed active exploitation, though the technical impact rating is classified as total.

Use-after-free in V8, Google Chrome's JavaScript engine, prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code within the Chrome sandbox by luring a user to a crafted HTML page. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms low-complexity, unauthenticated network delivery requiring only a single user visit, with high confidentiality, integrity, and availability impact scoped to the renderer process. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as none with a non-automatable attack path, though technical impact is assessed as total within the sandbox.

Use-after-free in Chrome's Chromoting (remote desktop) component allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox via crafted network traffic, affecting all Chrome versions prior to 152.0.7977.65. The sandbox-escape dimension elevates this beyond a typical renderer vulnerability, as successful exploitation could yield code execution in a broader process context. No public exploit identified at time of analysis and SSVC indicates no observed exploitation, but the technical impact is rated total.

Sandbox-escaping remote code execution affects Google Chrome on macOS before 152.0.7977.65 through a use-after-free in the browser's Bluetooth component (CVE-2026-79091). A remote attacker who lures a victim into opening a crafted HTML page can trigger the freed-memory reuse to run arbitrary code outside the renderer sandbox, giving control of the host process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the sandbox-escape scope change drives a 9.6 CVSS base score despite Chromium's own Medium severity rating.

Sandbox-escaping remote code execution affects Google Chrome desktop before 152.0.7977.65, where a use-after-free in the ServiceWorker component lets a remote attacker run arbitrary code outside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 score of 9.6 reflects the scope change (sandbox escape) and full CIA impact, though Google rated the Chromium severity only Medium and CISA's SSVC framework marks exploitation as none. No public exploit or CISA KEV listing exists at time of analysis, so risk is currently theoretical but high-impact.

Sandbox-escaping remote code execution affects Google Chrome on macOS prior to 152.0.7977.65, where a use-after-free in the Network component lets a remote attacker who convinces a victim to install a crafted extension run arbitrary code outside the renderer sandbox. Google rates the Chromium severity Medium, but the CVSS 9.6 reflects the scope-changing sandbox escape. No public exploit is identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.24%.

Use-after-free in Chrome's UI layer allows a local attacker who has already achieved code execution inside the renderer process to escape the Chrome sandbox and execute arbitrary code on the underlying host system. All Google Chrome desktop releases prior to 152.0.7977.65 are affected per CPE cpe:2.3:a:google:chrome. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with a sophisticated chained exploit rather than mass exploitation; however, the Scope:Changed CVSS vector confirms this is a full sandbox escape with critical C/I/A impact once the preconditions are met.

Use-after-free in Google Chrome's DevTools component (all versions prior to 152.0.7977.65) allows a remote attacker to execute arbitrary code within the browser's renderer sandbox. Exploitation requires the victim to be socially engineered into installing and activating a crafted Chrome extension, making this a user-interaction-dependent attack rather than a passive drive-by. No active exploitation has been confirmed via CISA KEV, and SSVC classifies the exploitation status as none; however, SSVC also rates technical impact as total, meaning successful exploitation fully compromises confidentiality, integrity, and availability within the sandbox boundary.

Use-after-free in Chrome's Views UI component enables sandbox escape to arbitrary code execution outside the browser sandbox, affecting all Google Chrome versions prior to 152.0.7977.65. Exploitation requires an attacker who has already achieved renderer process compromise - making this a chained, second-stage attack rather than a direct initial access vector. No public exploit code has been identified and SSVC assessment confirms no active exploitation at time of analysis, though the technical impact is rated total due to the scope change across the sandbox boundary.

Type confusion in Chrome's ANGLE graphics abstraction layer (all versions prior to 152.0.7977.65) enables remote attackers to potentially execute arbitrary code outside the browser sandbox by directing a user to a specially crafted HTML page. The CVSS 8.8 score reflects network-accessible delivery with no privilege requirements, full confidentiality, integrity, and availability impact, though user interaction is necessary. No public exploit identified at time of analysis; SSVC rates exploitation as 'none', yet technical impact is rated 'total' given the sandbox-escape language in the description.

Out-of-bounds write in ANGLE (Chrome's graphics abstraction layer) prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox by serving a crafted HTML page. The vulnerability carries a CVSS score of 8.8 and targets Chrome's Almost Native Graphics Layer Engine, a critical rendering subsystem, making exploitation viable against any unpatched Chrome user who visits a malicious page. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is low at 0.30%, and SSVC assesses exploitation as 'none', suggesting real-world exploitation remains limited despite the high theoretical severity.

Sandbox-escaping remote code execution in Google Chrome on macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Views UI component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code outside the browser sandbox. Google has shipped a fixed Stable channel build, and there is no public exploit identified at time of analysis. Despite a 9.6 CVSS, real-world signals are muted: EPSS is 0.33% (25th percentile), CISA SSVC lists exploitation as none, and Chromium rated the bug Medium severity.

Sandbox-escaping remote code execution affects Google Chrome for macOS before 152.0.7977.65 through a use-after-free in the Views UI component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code outside the renderer sandbox. Google has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and CISA has not listed it in KEV. Despite an NVD CVSS of 9.6 driven by the scope change, Chromium's own team rated the security severity Medium, and EPSS exploitation probability is low at 0.41%.

Remote code execution in Google Chrome desktop before 152.0.7977.65 lets a remote attacker escape the browser sandbox by luring a victim to a crafted HTML page, exploiting a use-after-free in the Views UI framework to run arbitrary code with the browser process's privileges. The CVSS 9.6 score reflects a scope-changing sandbox escape (S:C), though Google rated the Chromium security severity only Medium and requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis, EPSS is low (0.46%), and CISA SSVC records exploitation status as none.

Use-after-free in Google Chrome's Compositing engine (all versions prior to 152.0.7977.65) enables remote code execution within the Chrome renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact, but execution is sandbox-confined and Chromium's own severity rating is Medium, suggesting real-world exploitation complexity is non-trivial. No public exploit has been identified and CISA SSVC records exploitation status as none; a vendor patch is available in Chrome 152.0.7977.65.

Sandbox-escaping remote code execution in Google Chrome for Android (Search component) affects all builds prior to 152.0.7977.65, where a use-after-free (CWE-416) lets a remote attacker who lures a victim into opening a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Google rated the Chromium severity Medium, yet the CVSS 3.1 base score is 9.6 due to the scope change and full CIA impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.33% (25th percentile).

Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.65 stems from a use-after-free in the Sessions component (CVE-2026-79129, CWE-416). A remote attacker who lures a victim into a specific UI interaction (social engineering) can corrupt freed memory to run arbitrary code outside the renderer sandbox. Google has shipped a fixed build; no public exploit identified at time of analysis, EPSS is low (0.23%, 14th percentile), and CISA SSVC lists exploitation status as none.

Use-after-free in the Audio component of Google Chrome on Android (versions prior to 152.0.7977.65) enables sandbox escape and arbitrary code execution outside the Chrome renderer sandbox. Exploitation requires an attacker to have already compromised the renderer process and then deliver a crafted HTML page to trigger the memory corruption. No public exploit code or CISA KEV listing exists at time of analysis; SSVC confirms no active exploitation observed and the attack is not automatable.

Sandbox-escaping remote code execution in Google Chrome (desktop) before 152.0.7977.65 stems from a use-after-free in the Views UI framework, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The flaw carries a CVSS 9.6 with scope change, though Google rated the Chromium security severity only Medium; there is no public exploit identified at time of analysis and SSVC lists exploitation as none. A vendor patch is available in the 152.0.7977.65 Stable channel release.

Type confusion in Chrome's Animation component allows remote unauthenticated attackers to potentially execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this at the 19th percentile (0.27%), suggesting limited immediate exploitation pressure despite the high CVSS score.

Sandbox-escaping remote code execution in Google Chrome's FedCM (Federated Credential Management) component affects all desktop builds prior to 152.0.7977.65. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and execute arbitrary code outside the renderer sandbox, giving full control of the browser process. Google rates the Chromium severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS base score is Critical (9.6) because of the scope change.

Type confusion in V8, Chrome's JavaScript engine, allows remote unauthenticated attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. All Google Chrome desktop versions prior to 152.0.7977.65 are affected across Windows, macOS, and Linux. No public exploit has been identified at time of analysis, and the EPSS score of 0.33% (25th percentile) reflects limited current exploitation probability; the vendor patch is available and should be applied promptly.

Out-of-bounds write in Chrome's Crashpad crash-reporting library on Windows, versions prior to 152.0.7977.65, enables sandbox escape and arbitrary code execution when chained with a separate renderer compromise. The flaw (CWE-787) is the second stage of a two-stage exploit: an attacker who has already gained code execution inside the sandboxed renderer can trigger the memory corruption in Crashpad to break the sandbox boundary and execute arbitrary code at Chrome process privilege on the host. No public exploit has been identified at time of analysis and SSVC rates current exploitation as none, though the total technical impact and Windows-wide scope make this a high-priority patch item.

Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the sandboxed renderer process in all Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker can trigger arbitrary code execution by luring a user to a crafted HTML page, with full high-impact across confidentiality, integrity, and availability within the sandbox boundary. No active exploitation is confirmed in CISA KEV, and EPSS sits at a low 0.27% (19th percentile), though vendor and SSVC both rate technical impact as total, warranting prompt patching as part of routine browser update cadence.

Use-after-free in Google Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the browser renderer sandbox on all Chrome versions prior to 152.0.7977.65. Exploitation requires only a single user interaction - visiting a crafted HTML page - with no authentication or special privileges needed (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Despite full C/I/A impact within the sandbox, EPSS probability is low at 0.46% (38th percentile), SSVC exploitation status is 'none', and no public exploit or CISA KEV listing exists at time of analysis; a vendor patch has been released at version 152.0.7977.65.

Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) allows a remote attacker to potentially escape the browser sandbox by luring a victim to a crafted HTML page. The flaw is a CWE-843 type confusion carrying a 9.6 CVSS score with a scope change, reflecting the sandbox-escape potential. No public exploit has been identified at time of analysis, and CISA SSVC currently rates exploitation status as none.

Remote code execution inside the Chrome sandbox is achievable via a use-after-free in the WebRTC component of Google Chrome prior to 152.0.7977.65, exploitable by an unauthenticated remote attacker through crafted network traffic. The flaw requires high attack complexity (AC:H), constraining opportunistic mass exploitation, and code execution is limited to within the Chrome renderer sandbox, reducing but not eliminating post-exploitation impact. No public exploit code and no active exploitation have been identified at time of analysis, consistent with SSVC Exploitation: none and an EPSS of 0.66%.

Sandbox-escaping remote code execution affects Google Chrome desktop versions prior to 152.0.7977.65, where a use-after-free flaw in the Extensions component lets a remote attacker who convinces a victim to install a crafted extension execute arbitrary code outside the renderer sandbox. Chromium rates the severity High and CVSS scores it 9.6 due to the scope change (sandbox escape) and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS estimates near-term exploitation probability at only 0.28% (20th percentile).

Sandbox-escaping remote code execution in Google Chrome on Windows (versions before 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Rated High by Chromium with a CVSS of 9.6; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.25%, 16th percentile).

Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) lets a remote attacker escape the browser sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated 9.6/Critical with a scope change, meaning exploitation impacts the host beyond the compromised renderer. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the EPSS score of 0.41% reflects only near-term probability, not the true severity of a sandbox-escaping RCE.

Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) lets a remote attacker escape the renderer sandbox and run arbitrary code on the host after a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free rated CVSS 9.6 with scope change, reflecting the sandbox escape. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.41%, but the sandbox-escaping RCE impact makes it a high-priority browser patch.

Sandbox-escaping remote code execution in Google Chrome (desktop, versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/Direct3D graphics translation layer. A remote attacker who lures a user to a crafted HTML page can execute arbitrary code outside the renderer sandbox, giving native code execution on the host. Rated CVSS 9.6 with a scope change; no public exploit is identified at time of analysis and EPSS is low (0.30%, 22nd percentile), though ANGLE/GPU bugs are historically attractive to attackers.

Remote code execution inside the Chrome sandbox affects Google Chrome prior to version 152.0.7977.65 through a use-after-free vulnerability in the Platform component, triggered when a user visits a specially crafted HTML page. An unauthenticated remote attacker can exploit this to execute arbitrary code within the browser sandbox, with full high-impact ratings on confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.

Out-of-bounds write in Chrome's ANGLE graphics layer on Windows allows remote attackers to execute arbitrary code inside the browser's renderer sandbox by directing a user to a crafted HTML page. All Google Chrome releases on Windows prior to 152.0.7977.65 are affected. No public exploit code has been identified at time of analysis, and the EPSS probability of 0.25% (16th percentile) indicates limited current exploitation activity despite the high CVSS score of 8.8.

Out-of-bounds write in ANGLE, Chrome's GPU abstraction layer, affects Google Chrome on Windows prior to 152.0.7977.65 and can be triggered by a remote, unauthenticated attacker via a crafted HTML page, potentially achieving arbitrary code execution within the Chrome sandbox. The CVSS score of 8.8 reflects high theoretical severity, though sandbox containment (S:U) limits immediate blast radius to the GPU process. No public exploit code or CISA KEV listing exists at time of analysis, and the low EPSS of 0.42% (35th percentile) signals limited near-term exploitation probability despite the high CVSS rating.

Out-of-bounds write in Google Chrome's ANGLE graphics layer allows a remote attacker who lures a victim to a crafted HTML page to potentially execute arbitrary code outside the browser sandbox, affecting all Chrome builds prior to 152.0.7977.65. The CVSS:3.1 score of 9.6 reflects a scope-changing sandbox escape requiring only user interaction (visiting a page). No public exploit is identified at time of analysis and the EPSS probability is low (0.25%, 16th percentile), and it is not on CISA KEV.

Sandbox-escaping remote code execution in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 152.0.7977.65. A remote attacker who lures a victim to a crafted HTML page can trigger an out-of-bounds write and potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.30%, 22th percentile).

Sandbox-escaping remote code execution in Google Chrome (Aura component) affects all desktop builds prior to 152.0.7977.65, where a use-after-free lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape, though exploitation requires the victim to load attacker-controlled content. No public exploit identified at time of analysis, and CISA SSVC currently marks exploitation status as none.

Sandbox-escaping remote code execution in Google Chrome's WebGL component affects all desktop builds prior to 152.0.7977.65. A crafted HTML page can trigger a use-after-free (CWE-416) whose exploitation, per the description, yields code execution outside the browser renderer sandbox - a notably severe outcome that Chrome typically confines. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.33% (25th percentile), consistent with SSVC marking exploitation as 'none' despite total technical impact.

Out-of-bounds write in Chrome's ANGLE graphics layer (versions before 152.0.7977.65) lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates it High severity; the CVSS 9.6 reflects a scope-changing sandbox escape whose only gating factor is that the user opens a malicious page. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), but the memory-corruption-to-sandbox-escape impact makes it a priority patch for desktop fleets.

Use-after-free in the WebRTC component of Google Chrome before version 152.0.7977.65 enables remote code execution confined within the browser sandbox. Exploitation requires a victim to visit a specially crafted HTML page, placing UI:R as a meaningful friction point. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog; SSVC also indicates no current exploitation activity. Despite a CVSS score of 8.8 and tags indicating RCE and memory corruption potential, the EPSS score of 0.33% at the 25th percentile reflects low observed exploitation probability relative to the broader vulnerability population.

Remote code execution in Google Chrome on Windows (versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES abstraction layer used for GPU rendering. A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU process and potentially execute arbitrary code outside the browser sandbox, giving control of the underlying host. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape; there is no public exploit identified and EPSS is low (0.30%), indicating no confirmed active exploitation yet.

Use-after-free in Google Chrome's Accessibility component (versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code outside the browser's renderer sandbox through social engineering. Exploitation requires user interaction with a malicious webpage or crafted UI element, making phishing or malvertising the likely delivery mechanism. A vendor patch is available in stable channel version 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.23% (14th percentile), suggesting opportunistic exploitation is not currently observed.

Remote code execution in Google Chrome's Chromecast component (versions prior to 152.0.7977.65) stems from a use-after-free memory corruption flaw that enables remote attackers to execute arbitrary code within Chrome's renderer sandbox. Exploitation requires a victim to visit a crafted HTML page, making it network-reachable but not fully automated. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, with EPSS indicating low observed exploitation probability despite the high CVSS score.

Remote code execution in Google Chrome desktop before 152.0.7977.65 lets an unauthenticated attacker escape the renderer sandbox and run arbitrary code on the host when a victim opens a crafted web page. The bug is a use-after-free in the Views UI framework, rated High by Chromium and carrying a CVSS 9.6 due to a scope change (sandbox escape). No public exploit has been identified at time of analysis, and the EPSS probability is low (0.33%, 25th percentile).

Use-after-free in the Mobile component of Google Chrome on iOS prior to 152.0.7977.65 enables remote code execution outside the browser sandbox via crafted network traffic, requiring no user interaction. The sandbox escape elevates the severity beyond a typical renderer bug, as successful exploitation grants attacker-controlled code execution in a context beyond Chrome's sandboxed process. No public exploit identified at time of analysis, and the low EPSS score (0.28%, 20th percentile) suggests exploitation has not yet been observed in the wild despite the high CVSS rating.

Sandbox-escaping remote code execution in Google Chrome (Views UI component) before 152.0.7977.65 allows a remote attacker to run arbitrary code on the host after luring a victim to a crafted HTML page. The flaw is a CWE-416 use-after-free rated High by Chromium and CVSS 9.6 due to the scope change (sandbox escape), but requires user interaction (visiting an attacker-controlled page) and has no public exploit identified at time of analysis. EPSS is modest (0.46%, 38th percentile) and CISA SSVC reports no known exploitation.

Use-after-free in the Bluetooth component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox. Exploitation requires the attacker to socially engineer a victim into installing or triggering a crafted Chrome extension, after which the memory corruption in the Bluetooth subsystem is leveraged to escape Chrome's sandbox and achieve code execution at the OS level. No public exploit identified at time of analysis, and EPSS places this in the 20th percentile, suggesting limited active exploitation despite the high CVSS severity.

Use-after-free in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows enables a remote attacker who has already compromised the renderer process to escape Chrome's sandbox and execute arbitrary code at the browser or OS level via crafted network traffic. All Chrome versions prior to 152.0.7977.65 on Windows are affected. No public exploit code or CISA KEV listing exists; EPSS is low at 0.28% (20th percentile), but the scope-changing, full-CIA-impact sandbox escape warrants rapid deployment of the available patch.

Use-after-free in the Chromoting (Chrome Remote Desktop) component of Google Chrome on Windows prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside Chrome's sandbox via crafted network traffic. The sandbox-escape outcome is the most critical aspect, elevating the real-world impact beyond a typical renderer flaw to full host-level code execution. No public exploit code has been identified at time of analysis; EPSS places exploitation probability at 0.28% (20th percentile), though the network vector and no-auth-required CVSS signal warrant prompt patching.

Sandbox escape via use-after-free in Google Chrome's Chromecast component lets a remote attacker who has already compromised the renderer process execute arbitrary code in the higher-privileged browser process, breaking out of the site-isolation sandbox. It affects Chrome desktop before 152.0.7977.65 and is triggered by luring a victim to a crafted HTML page (UI:R). No public exploit identified at time of analysis; EPSS is low at 0.33% (25th percentile) and CISA SSVC records exploitation status 'none'.

Use-after-free in Google Chrome's Script engine allows remote code execution confined to the renderer sandbox on all desktop platforms running versions prior to 152.0.7977.65. Exploitation requires only that a user visit a crafted HTML page - no authentication or special configuration is needed - making the attack surface broad wherever Chrome remains unpatched. No public exploit has been identified at time of analysis and CISA has not added this to KEV, but the CVSS 8.8 rating and SSVC 'total' technical impact designation warrant prompt patching across managed fleets.

Sandbox escape via type confusion in Google Chrome's Accessibility component on Windows enables arbitrary code execution outside the browser sandbox. Affecting all Chrome versions prior to 152.0.7977.65 on Windows, the flaw requires an attacker to have already compromised the renderer process - making this a critical second-stage exploit in a multi-step attack chain. No public exploit identified at time of analysis, and EPSS sits at 0.27% (19th percentile), consistent with the high technical bar required for exploitation despite the 8.3 CVSS score.

Sandbox-escaping remote code execution in Google Chrome (desktop, versions before 152.0.7977.65) stems from a use-after-free in Aura, Chromium's UI/windowing framework. A remote attacker who lures a victim to a crafted HTML page can execute arbitrary code outside the browser sandbox, giving full control of the host process rather than just the renderer. Google rates the Chromium severity Critical; there is no public exploit identified at time of analysis, and EPSS exploitation probability is currently low (0.33%, 25th percentile).

Remote code execution in Google Chrome on macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Safe Browsing component that lets a remote attacker escape the renderer sandbox and run arbitrary code on the host. Exploitation requires luring a victim to a crafted HTML page (social engineering / user interaction), and Chromium rates the flaw Critical. There is no public exploit identified and the EPSS probability is low (0.57%), but a vendor patch is already available.

Sandbox-escaping remote code execution in Google Chrome for macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Views UI framework, letting a remote attacker run arbitrary code outside the renderer sandbox when a victim loads a crafted HTML page. Google rates the Chromium severity Critical and CVSS is 9.6, but there is no public exploit identified at time of analysis and EPSS is a low 0.41%. A vendor patch is available in the Stable channel update.

Remote code execution in Google Chrome desktop before 152.0.7977.65 lets a remote attacker escape the renderer sandbox and run arbitrary code on the host after a victim opens a crafted HTML page. The flaw is a use-after-free in Aura, Chromium's UI/windowing layer, and Google rates its Chromium security severity as Critical (CVSS 9.6, scope-changed). There is no public exploit identified at time of analysis and EPSS is low (0.46%, 38th percentile), but the sandbox-escape impact makes it a high-priority patch.

Sandbox escape via use-after-free in Chrome's Chromecast component allows remote code execution outside the browser sandbox on all platforms running Chrome prior to 152.0.7977.65. This is a chained exploit: an attacker must first compromise the renderer process, then leverage the Chromecast UAF to pivot into the browser process and escape Chrome's sandbox via a crafted HTML page. No public exploit code has been identified at time of analysis; Google has released a confirmed fix in version 152.0.7977.65.

Use-after-free in Google Chrome's Chromecast component allows a remote attacker who has already compromised the renderer process to escape the sandbox and execute arbitrary code on the underlying system via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at a low 0.46%, but SSVC rates technical impact as total given the sandbox-escape outcome.