Red Hat
Monthly
Sandbox escape in Google Chrome's Navigation component before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Medium by Chromium but carries a 9.6 CVSS due to the scope-changing sandbox breach; EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis, indicating it is realistically a second-stage link in an exploit chain rather than a standalone remote-code path.
Out-of-bounds memory read in the SurfaceCapture component of Google Chrome before 150.0.7871.47 lets a remote attacker leak adjacent heap memory when a victim opens a crafted HTML page. Chromium rated the flaw Medium severity, though the associated CVSS is 8.1; there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.17% (7th percentile), consistent with a browser bug fixed pre-disclosure. Successful exploitation could disclose sensitive in-process data or crash the renderer, and typically serves as one link in a larger sandbox-escape chain rather than standalone compromise.
Heap corruption in the Passwords component of Google Chrome desktop before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and likely code execution in the renderer. Rated CVSS 8.8 (Chromium severity Medium), it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and CISA SSVC records no observed exploitation.
Remote code execution in Google Chrome (Desktop) before 150.0.7871.47 stems from a use-after-free in the Navigation component, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt memory and run arbitrary code in the renderer. Chromium rated it Medium, but the CVSS 8.8 reflects full C/I/A impact requiring only user interaction (visiting a page). There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, with a low EPSS of 0.21%.
Use-after-free in Google Chrome's Omnibox component on Android (versions prior to 150.0.7871.47) lets a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page trigger heap corruption and potentially achieve code execution in the renderer. Rated Medium by Chromium but scored CVSS 8.8 due to network reach and full CIA impact after minimal user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.17%), and SSVC records exploitation status as none.
Navigation restriction bypass in Google Chrome on macOS prior to 150.0.7871.47 lets a remote attacker evade Safe Browsing protections by luring a victim into opening a malicious file, via an integer overflow in the Safe Browsing component. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The practical effect is that a security warning meant to block dangerous navigations can be defeated, not direct code execution.
Arbitrary code execution in Google Chrome's DevTools component (versions prior to 150.0.7871.47) lets a remote attacker run code inside the renderer sandbox after luring a victim into performing specific UI gestures with a malicious file. Rated Medium by Chromium but scored CVSS 7.5, the flaw stems from insufficient validation of untrusted input (CWE-20); no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.24% (15th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting a malicious page) but no authentication, and the flaw carries a CVSS 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.30%, 22nd percentile), indicating no evidence of widespread exploitation despite the high CVSS.
Arbitrary code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in Oilpan, Blink's garbage collector, letting a remote attacker who lures a victim to a crafted HTML page run code within the renderer sandbox. Google rated it Medium severity; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). Google has shipped a fixed Stable-channel build, and exploitation requires user interaction (visiting a malicious page).
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the renderer sandbox by abusing insufficient policy enforcement in the browser's USB (WebUSB) handling, delivered through a crafted HTML page. The flaw is rated Medium by Chromium but carries a high CVSS (8.3) due to the scope change from renderer to browser process; EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis. A vendor patch is available in the June 2026 Stable channel update.
Out-of-bounds memory write in Google Chrome's Fonts component (versions prior to 150.0.7871.47) lets a remote attacker corrupt heap memory when a victim renders a crafted HTML page, creating a path toward renderer-process code execution. The flaw stems from an integer overflow during font handling and requires only that the target open an attacker-controlled page. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Dawn (WebGPU) implementation on Android before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox and reach the host via a crafted HTML page. Reported by Google's own Chrome security team and rated Medium by Chromium despite an NVD CVSS of 9.6, it currently has no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile). It is a second-stage bug that requires a prior renderer compromise, so it is dangerous as part of an exploit chain rather than as a standalone entry point.
Privilege escalation in Google Chrome desktop versions prior to 150.0.7871.47 lets a remote attacker escalate privileges when a victim opens a crafted HTML page, stemming from insufficient input validation in the Enterprise component. Chromium rated the flaw Medium severity, though the assigned CVSS of 8.8 reflects high confidentiality, integrity, and availability impact once triggered. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.21% (11th percentile).
Local privilege escalation in Google Chrome for Android before 150.0.7871.47 stems from insufficient validation of untrusted input in the browser UI, letting a local attacker who convinces a user to open a malicious file gain elevated privileges. Rated Medium by Chromium but scored CVSS 7.8 (total technical impact per SSVC), with no public exploit identified at time of analysis and a low EPSS of 0.13% (3rd percentile). Google has shipped a fixed Stable channel build.
Remote code execution in Google Chrome on Windows before 150.0.7871.47 allows a remote attacker to run arbitrary code after luring a victim to a crafted HTML page and coercing specific UI gestures via an inappropriate implementation in the Downloads component. Rated Medium by Chromium but scored CVSS 7.5 due to full compromise potential; no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile). SSVC lists exploitation as none, so this is a patch-in-normal-cycle item rather than an emergency.
Sandbox escape in Google Chrome on Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that abuses insufficient input validation in the Media component. Google rates the Chromium security severity as Medium and a fix is shipped in the stable channel, but no public exploit has been identified and EPSS exploitation probability is low at 0.21%. The high 9.6 CVSS reflects the total system compromise possible once chained, not standalone exploitability.
Use-after-free memory corruption in Google Chrome for iOS before version 150.0.7871.47 allows a remote attacker to trigger heap corruption when a victim loads a crafted HTML page, potentially leading to code execution within the browser context. The flaw was reported by Google's own security team and carries an NVD CVSS of 8.8, though Chromium rated its severity as Medium, and no public exploit has been identified at time of analysis. EPSS is low (0.21%, 11th percentile) and CISA SSVC records no observed exploitation, indicating this is a patch-on-schedule issue rather than an active threat.
Heap corruption in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who lures a user through specific in-page UI gestures on a crafted HTML page trigger a use-after-free (CWE-416), potentially leading to arbitrary code execution in the renderer. Rated Medium by the Chromium security team but scored CVSS 8.8 due to full confidentiality/integrity/availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.21% (11th percentile), consistent with a freshly patched browser bug that has no known weaponization.
Sandbox escape in Google Chrome DevTools before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, stemming from insufficient policy enforcement (CWE-693). NVD scores this 9.6 with a scope-change vector, though Google rates the Chromium severity only Medium and it is a second-stage bug requiring prior renderer compromise. No public exploit has been identified at time of analysis and EPSS is low (0.21%), consistent with a chained rather than standalone threat.
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the browser's Bluetooth stack, letting a remote attacker who lures a victim to a crafted HTML page bypass client-side security checks (CWE-602). Exploitation requires user interaction (visiting the page) but no authentication (PR:N/UI:R), and NVD scores it 8.8 while Google's own Chromium team rated the severity Medium. There is no public exploit identified at time of analysis, EPSS is low at 0.22%, and CISA SSVC records exploitation status as none.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who already controls a compromised renderer process break out of the browser sandbox through insufficient policy enforcement in the Web Serial API, using a crafted HTML page. Google rated the underlying Chromium bug Medium severity even though NVD assigns a 9.6 CVSS due to the scope-changing impact. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.22%, 12th percentile).
Remote code execution in Google Chrome prior to 150.0.7871.47 stems from a use-after-free (CWE-416) in the browser's HTML handling, letting a remote attacker who lures a victim to a crafted page execute arbitrary code, though execution is confined inside Chrome's renderer sandbox. Chromium rated the issue Medium severity precisely because the code runs within the sandbox rather than escaping it; no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) with SSVC exploitation status 'none'. Google has shipped a fixed Stable-channel build.
Sandboxed remote code execution in Google Chrome's Cast Receiver component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by luring a victim to a crafted HTML page. Google rates the Chromium severity as Medium because the resulting code execution is confined to the browser sandbox, though NVD scores it CVSS 8.8; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.27% (18th percentile).
Privilege escalation in Google Chrome's Chromecast component affects all desktop versions prior to 150.0.7871.47, where insufficient policy enforcement lets a remote attacker who lures a victim to a crafted HTML page escalate privileges within the browser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile). Note a signal conflict: the assigned CVSS is 8.8 (High) while Google/Chromium rated the underlying flaw only Medium severity.
Privilege escalation in Google Chrome's Extensions component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out via a crafted HTML page. Rated Medium by Chromium and CVSS 7.5, it stems from insufficient validation of untrusted input (CWE-20) and requires user interaction plus a pre-existing renderer foothold. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 12th percentile), and it is not on CISA KEV.
Use-after-free in the Extensions component of Google Chrome before 150.0.7871.47 lets a remote attacker execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Chromium rated the security severity Medium, though the associated CVSS score is 8.8 (High) due to network vector and high impact; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.26%. Google has shipped a fixed Stable channel build.
Sandboxed remote code execution in Google Chrome for Android before 150.0.7871.47, stemming from a use-after-free in the Skia graphics library, lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google rated the Chromium security severity as Medium, and no public exploit has been identified at time of analysis; the EPSS score is low (0.26%, 17th percentile), and the bug is not on CISA KEV. Exploitation requires user interaction (visiting the malicious page) but no authentication.
Heap-based integer overflow in Google Chrome's Chromecast component allows an adjacent-network attacker to achieve arbitrary code execution against browsers running versions prior to 150.0.7871.47. The flaw is reachable via crafted malicious network traffic and carries a high CVSS of 8.8; Google has shipped a stable-channel fix, and no public exploit has been identified at time of analysis. Chromium rates the underlying issue as Medium severity despite the high CVSS, reflecting the adjacency and interaction constraints.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) allows a remote attacker to potentially break out of the renderer sandbox when a victim loads a crafted HTML page. The flaw is a CWE-843 type confusion; while NVD scores it CVSS 9.6 (critical), Google's own Chromium team rated the security severity as Medium, and there is no public exploit identified at time of analysis. EPSS is low (0.23%, 13th percentile) and CISA SSVC records no known exploitation, so this is a patch-on-cycle browser bug rather than an emergency.
Sandbox escape in Google Chrome desktop prior to 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox by winning a race condition in the USB subsystem via a crafted HTML page. Chromium rated it Medium severity despite the 9.6 CVSS, reflecting that it is a second-stage bug requiring prior renderer compromise; there is no public exploit identified at time of analysis and it is not in CISA KEV, with EPSS at just 0.21% (11th percentile).
Sandbox escape in Google Chrome's USB subsystem on macOS (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and was reported by Google's own security team; Chromium rated it Medium severity despite the NVD CVSS of 9.6. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 11th percentile), consistent with a chained/second-stage bug rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, letting an attacker who has already compromised the renderer process break out of the sandbox and reach the higher-privileged browser process via a crafted HTML page. This is a second-stage exploitation primitive rather than an initial-access flaw, which is why Google rates the Chromium severity as Medium despite the 9.6 CVSS. No public exploit has been identified, there is no CISA KEV listing, and EPSS exploitation probability is low (0.21%, 11th percentile).
Sandbox escape in Google Chrome for Android before 150.0.7871.47 lets a local attacker break out of the renderer/browser sandbox by feeding a malicious file into the WebAppInstalls component, which insufficiently validates untrusted input (CWE-20). Chromium rates the security severity as Medium, and no public exploit has been identified at time of analysis; EPSS estimates only a 0.13% (3rd percentile) chance of exploitation in the next 30 days. A vendor patch is available in Chrome 150.0.7871.47.
Sandboxed remote code execution in the WebView component of Google Chrome for Android before 150.0.7871.47 lets a remote attacker run arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. Rated CVSS 8.8 (network vector, no privileges, requires user interaction), the flaw is a CWE-416 use-after-free, but code execution is confined to the sandbox and would require a separate escape to reach the host. No public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile), indicating limited near-term mass-exploitation pressure despite the high base score.
Sandbox escape in Google Chrome's Device component on Windows (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416). Google rates the Chromium security severity as Medium, reflecting that it is a second-stage bug requiring prior renderer compromise, though the NVD CVSS of 9.6 is inflated by the sandbox scope change. There is no public exploit identified at time of analysis and EPSS is low (0.21%), indicating no current sign of widespread exploitation.
Privilege escalation in Google Chrome desktop prior to 150.0.7871.47 stems from insufficient policy enforcement in the WebHID subsystem, letting a maliciously crafted extension escape its intended boundaries and gain elevated access to human-interface devices and browser privileges. Exploitation first requires convincing a victim to install the malicious extension, after which a crafted Chrome Extension bypasses WebHID access controls. Chromium rates the issue Medium; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.13%, 3rd percentile).
Privilege escalation in Google Chrome for Android (CustomTabs) prior to 150.0.7871.47 allows a local attacker to escalate privileges by supplying a malicious file that CustomTabs fails to validate properly. Google rates the Chromium severity as Medium, and the requirement for user interaction plus local access limits remote mass exploitation. No public exploit has been identified at time of analysis and the EPSS score is very low (0.13%, 3rd percentile), so opportunistic exploitation appears unlikely.
Sandbox escape in Google Chrome before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page, exploiting a use-after-free (CWE-416) in the Core component. Google-assigned Chromium severity is Medium, though the NVD CVSS is 9.6 due to the cross-boundary scope change. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), indicating it is not yet a mass-exploitation target.
Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 150.0.7871.47) allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox, a critical trust-boundary bypass affecting the Windows/macOS/Linux desktop browser. The NVD scores this 9.6 (scope-changed) though Google rates the underlying Chromium issue as Medium severity, and there is no public exploit identified at time of analysis. EPSS is low (0.21%) and CISA SSVC records exploitation status as none, indicating no observed active abuse.
Privilege escalation in Google Chrome for Android before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out further by feeding a crafted HTML page into the Speech component, which fails to validate untrusted input (CWE-20). Google rated it Medium severity; a fix has shipped in the Stable channel, EPSS is low (0.21%, 11th percentile), and there is no public exploit identified at time of analysis. This is a sandbox-escape-class chaining bug rather than a standalone remote drive-by, since it presupposes a prior renderer compromise.
Remote code execution in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in the Ozone platform layer, allowing a remote attacker who lures a victim into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser context. Rated High by Chromium and CVSS 7.5, exploitation is gated by required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.26% (17th percentile).
Sandbox escape in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in Ozone, Chrome's platform abstraction layer for windowing and graphics. An attacker who has already compromised the renderer process can leverage a crafted HTML page to break out of the browser sandbox and gain code execution at the higher-privileged browser-process level. There is no public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a second-stage bug that requires a prior renderer compromise rather than a directly weaponizable single-shot flaw.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Journeys (browsing history) component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader code execution on the host via a crafted HTML page. Rated High severity by Chromium and CVSS 9.6, a fix is available from vendor; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Exploitation is meaningful only as the second stage of a chain, since it presupposes prior renderer compromise.
Discretionary access control bypass in Google Chrome for Android before 150.0.7871.47 lets a local attacker abuse the WebAppInstalls component through a crafted HTML page, undermining the platform's integrity and availability boundaries. Google rates the Chromium severity High and has shipped a fix in the Stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Access-control bypass in Google Chrome for Android before 150.0.7871.47 allows an attacker to subvert discretionary access controls through the WebAppInstalls component by serving a crafted HTML page, stemming from insufficient validation of untrusted input. Rated High by Chromium and scored CVSS 9.1, the flaw carries high integrity and availability impact but no confidentiality loss; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Sandboxed arbitrary code execution in Google Chrome for iOS before 150.0.7871.47 lets an attacker who convinces a user to open a malicious file run code inside the browser's sandbox due to insufficient validation of untrusted input. Google rates the Chromium severity High and ships the fix in 150.0.7871.47; EPSS is low (0.15%, 4th percentile) and there is no public exploit identified at time of analysis. The flaw requires user interaction (opening the file) and, per the description, the resulting execution is confined to the sandbox rather than the underlying OS.
Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows versions prior to 150.0.7871.47 allows a local attacker to break out of the browser sandbox by getting a victim to open a malicious file. Google rates the Chromium severity as High, and while a vendor patch is available, EPSS is low (0.13%) and CISA SSVC records no known exploitation, so this is no public exploit identified at time of analysis. The scope-changing, high-impact nature (full confidentiality, integrity and availability loss beyond the sandbox boundary) makes it a meaningful patch priority for Windows Chrome fleets despite requiring user interaction.
Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Forms component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser's renderer sandbox. Chromium rates the flaw High severity, CVSS 8.8, requiring only that the user visit a malicious page; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). A vendor patch is available in the June 2026 Stable channel release.
Sandbox escape in Google Chrome for macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a use-after-free in the USB subsystem via a crafted HTML page. Rated High by Chromium and CVSS 9.6, it functions as a second-stage escalation primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Arbitrary code execution in Google Chrome's DOM implementation lets a remote attacker run code within the renderer sandbox by luring a victim to a crafted HTML page. All desktop Chrome builds before 150.0.7871.47 are affected; Chromium rates the flaw High severity. No public exploit has been identified and EPSS probability is low (0.26%), but the vendor patch is already available and should be applied promptly.
Local OS-level privilege escalation in Google Chrome on Windows (versions prior to 150.0.7871.47) arises from a use-after-free in the Chrome Updater component, letting a local attacker who can plant a malicious file on the system elevate to higher OS privileges. Google rates the Chromium severity as High and has released a fixed Stable channel build; there is no public exploit identified and it is not listed in CISA KEV. EPSS is low at 0.13% (3rd percentile), consistent with a bug that requires local access and user interaction rather than mass remote exploitation.
Sandbox escape in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to the scope change and full compromise potential, though it is a second-stage bug requiring a prior renderer exploit. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.22% (12th percentile); Google has shipped a fixed version.
Sandbox escape in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the sandbox and execute code in the more privileged browser context via a crafted HTML page. Google rates the Chromium severity as High, and a fixed stable-channel build is available. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and SSVC records exploitation status as none.
Heap corruption in Google Chrome's XML implementation on all desktop platforms prior to 150.0.7871.47 allows a remote attacker to potentially achieve code execution when a victim visits a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8 (network vector, user interaction required), this is a memory-safety flaw (CWE-122 heap-based buffer overflow) reported through Google's internal CVE process. There is no public exploit identified at time of analysis, and SSVC assessment shows exploitation status of none with a low EPSS of 0.21%.
Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating from renderer-level code execution to the more privileged GPU/browser context. Google rates the Chromium severity as High and a vendor patch is available; there is no public exploit identified and it is not listed in CISA KEV, with EPSS exploitation probability low at 0.21%.
Sandbox escape in Google Chrome's Headless component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a CWE-416 use-after-free with no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records no known exploitation.
Out-of-bounds read/write (use-after-free) in Google Chrome's GPU component lets a remote attacker who has already compromised the renderer process run arbitrary code - though still confined inside the sandbox - by serving a crafted HTML page to a Chrome build prior to 150.0.7871.47. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and EPSS puts near-term exploitation probability at just 0.26%.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux allows an adjacent-network attacker to run arbitrary code by sending malicious network traffic to a vulnerable client before version 150.0.7871.47. The flaw is a use-after-free memory-corruption issue rated High by Chromium and carries a CVSS 8.8. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.24%, 15th percentile), indicating no observed exploitation activity yet.
Sandbox escape in Google Chrome on Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating from renderer code execution to the more privileged browser process. Rated High severity by Chromium with a CVSS of 8.3 (scope-changing), it stems from insufficient validation of untrusted input in the Settings component. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and CISA SSVC lists exploitation as none, indicating no observed in-the-wild use despite the total technical impact.
Local privilege escalation in Google Chrome's Updater component on macOS versions prior to 150.0.7871.47 lets an attacker abuse a use-after-free (CWE-416) via a malicious file to gain the elevated privileges under which the updater runs. Google rates the Chromium severity as High, and the CVSS 3.1 base score is 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.13% (3rd percentile), consistent with the SSVC exploitation status of 'none'.
Heap corruption in Google Chrome's Dawn WebGPU implementation lets a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and code execution in all versions prior to 150.0.7871.47. The flaw stems from use of uninitialized memory (CWE-457) and carries a High Chromium severity with a CVSS 8.8; no public exploit has been identified and EPSS is low (0.23%), and SSVC currently rates exploitation as none. A vendor patch is available in the June 2026 Stable channel update.
Privilege escalation in Google Chrome's Extensions subsystem before version 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of that context and gain elevated privileges by delivering a crafted HTML page. Google rates the Chromium severity as High, and the assigned CVSS is 7.5 (AV:N/AC:H). There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and CISA's SSVC framework records exploitation status as none, indicating this is currently a patch-and-move-on issue rather than an active threat.
Sandbox escape in Google Chrome's Glic component before version 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Rated High by Chromium with a CVSS of 8.3 and a scope-changing vector; there is no public exploit identified at time of analysis, and EPSS is low at 0.21%. SSVC shows no known exploitation and Google has released a patched Stable channel build.
Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in the Canvas component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a malicious page), but no authentication. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).
Out-of-bounds memory read in the ANGLE graphics component of Google Chrome on macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process read memory outside intended bounds via a crafted HTML page. Rated High by Chromium and CVSS 8.1, it functions as a chained post-exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome versions prior to 150.0.7871.47 stems from insufficient input validation in the Glic component, allowing a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a malicious page); there is no public exploit identified at time of analysis and EPSS estimates only a 0.21% exploitation probability. A vendor patch is available and the issue is not listed in CISA KEV.
Remote code execution in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and 8.8 (CVSS 3.1); it requires user interaction (visiting a malicious page) and no privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.26% (17th percentile).
Heap corruption via a use-after-free in the Views UI component of Google Chrome allows a remote attacker who serves a crafted HTML page and lures a user into performing specific UI gestures to potentially execute code in the browser process. All desktop Chrome builds prior to 150.0.7871.47 are affected; Google rates the Chromium severity as High and has shipped a fix. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Sandbox escape in Google Chrome for iOS prior to 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating from renderer-level code execution to broader access on the device. The flaw stems from insufficient policy enforcement (CWE-20) and carries a High Chromium severity rating with a CVSS 8.3 (scope-changed) score. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS probability is low at 0.21% (11th percentile).
Renderer-process remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Input Method Editor (IME) component, letting a remote attacker run arbitrary code within the browser's sandbox when a victim visits a crafted HTML page. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication. No public exploit identified at time of analysis, and the EPSS score is low (0.26%, 17th percentile), indicating no evidence of widespread exploitation yet.
Remote code execution in Google Chrome on iOS prior to 150.0.7871.47 stems from a use-after-free in the browser's Import component, allowing a remote attacker who lures a victim into opening a malicious file and performing specific UI gestures to execute arbitrary code. Rated High by Chromium and CVSS 7.5, the flaw has no public exploit identified at time of analysis and a low EPSS of 0.24% (15th percentile), consistent with its high attack complexity and required user interaction. A vendor patch is available in the June 2026 Stable channel update.
Site-isolation bypass in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process escape cross-origin protections through insufficient input validation in the Accessibility component via a crafted HTML page. Rated High by Chromium and CVSS 8.1, it is a second-stage primitive rather than an initial-access flaw; no public exploit has been identified and EPSS exploitation probability is low (0.22%). It requires an existing renderer compromise plus a user visiting a malicious page, so it is realistically a chained-exploit component.
Remote code execution in Google Chrome for macOS prior to 150.0.7871.47 stems from a use-after-free in the GFX (graphics) component, allowing a remote attacker to run arbitrary code after a victim opens a crafted HTML page. Chromium rates the severity High and the CVSS is 8.8, but exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and EPSS is low (0.26%, 17th percentile), indicating no observed weaponization yet.
Sandbox escape in Google Chrome's Chromecast component (versions before 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page. Rooted in a use-after-free (CWE-416) memory-corruption bug rated High by Chromium, it carries a CVSS 8.3 driven by a scope change and full CIA impact, but requires a pre-existing renderer compromise, high attack complexity, and user interaction. No public exploit identified at time of analysis, and the low EPSS (0.21%) plus SSVC 'exploitation: none' indicate it is not currently being exploited.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process escalate out of the sandbox via a crafted HTML page that triggers a type-confusion bug (CWE-843) in the Tabs component. Exploitation is gated behind prior renderer compromise and user interaction, and the flaw is rated High by Chromium with a CVSS 8.3 due to scope change and total impact. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and CISA SSVC lists exploitation as none.
Remote code execution in Google Chrome (Views UI component) prior to 150.0.7871.47 allows a remote attacker to execute arbitrary code by luring a victim to a crafted HTML page and inducing specific UI gestures that trigger a use-after-free. Rated High by Chromium and CVSS 7.5, the flaw is elevated in complexity by its requirement for user interaction, and no public exploit has been identified at time of analysis; EPSS probability is low at 0.26%.
Sandbox escape in Google Chrome's Chromecast component allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Affects Chrome desktop versions prior to 150.0.7871.47, rated High by Chromium with a CVSS of 8.3. There is no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records exploitation as none.
Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 150.0.7871.47) allows a local attacker to gain OS-level privileges by planting a malicious file that the Updater component mishandles. Rated High by Chromium and CVSS 7.8, exploitation requires local access plus user interaction; there is no public exploit identified at time of analysis, and EPSS is low at 0.13% (3rd percentile). A vendor patch is available in the June 2026 Stable Channel release.
Heap corruption in Google Chrome's QUIC networking stack (versions prior to 150.0.7871.47) stems from a use-after-free that a remote attacker can trigger through crafted network traffic, potentially leading to arbitrary code execution in the affected browser process. Google rated the Chromium security severity as High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as 'none'. EPSS is low (0.19%, 9th percentile), indicating no observed weaponization despite a total technical-impact rating.
Sandbox escape in Google Chrome desktop versions prior to 150.0.7871.47 stems from a heap buffer overflow in the Chromecast component, letting an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6, but it is a second-stage bug requiring prior renderer control, and there is no public exploit identified at time of analysis (SSVC exploitation: none, EPSS 0.22%). No CISA KEV listing exists, indicating no confirmed active exploitation.
Sandbox escape in Google Chrome's Chromecast component (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS of 9.6 due to scope change and full CIA impact, this is a second-stage bug typically chained after an initial renderer exploit. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21%.
Sandbox escape in Google Chrome's Chromecast component before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating from renderer-level code execution to the more privileged browser process. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change; however, EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. A vendor patch is available.
Remote code execution in Google Chrome on Windows before version 150.0.7871.47 allows an attacker to run arbitrary code by luring a victim to a crafted HTML page and getting them to perform specific UI gestures against the WebAppInstalls component. Chromium rates the flaw High severity; no public exploit identified at time of analysis, and the EPSS probability is low (0.26%, 17th percentile), indicating the attack is not yet broadly commoditized despite the serious impact.
Sandbox escape in Google Chrome for macOS versions prior to 150.0.7871.47 stems from a use-after-free in the Touchbar component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Reported through Google's internal Chrome security process and rated High by Chromium, it carries a CVSS 9.6 due to scope change and full CIA impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.21%. SSVC assesses current exploitation as none, indicating this is a patch-now-but-not-panic item.
Arbitrary code execution in Google Chrome desktop before 150.0.7871.47 arises from insufficient input validation in the Downloads component, letting a crafted Chrome extension break out of its intended sandbox constraints. An attacker who first convinces a victim to install a malicious extension can leverage the flaw to run arbitrary code, which Chromium rates High severity. No public exploit has been identified at time of analysis and EPSS is low (0.15%, 5th percentile), indicating no observed widespread exploitation.
Sandbox escape in Google Chrome's GPU process (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to a scope-changing (S:C) full-impact outcome, this is a use-after-free (CWE-416) memory-corruption bug. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and CISA SSVC lists exploitation as none, so it is a serious-but-not-yet-exploited patch priority.
Remote code execution in Google Chrome for Android before 150.0.7871.47 stems from a use-after-free in the Fullscreen component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code in the renderer. Chromium rates the flaw Critical, though CVSS scores it 8.8 because exploitation requires the victim to open the malicious page. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.26%, 17th percentile), with CISA SSVC showing no known exploitation.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) lets a remote attacker corrupt memory via malicious network traffic. Google rates the Chromium severity Critical, and a vendor patch is available, but there is no public exploit identified at time of analysis and EPSS is low at 0.24%. High attack complexity (AC:H) means the memory-corruption race is non-trivial to win reliably, tempering the CVSS 8.1 score.
Remote code execution in Google Chrome's Ozone platform-abstraction layer prior to 150.0.7871.47 lets a remote attacker execute arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated Critical by Chromium and CVSS 8.8, requiring the victim to visit a malicious page (UI:R) but no privileges. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%), but the memory-corruption class and 'total' technical impact make it a high-priority browser patch.
Sandbox escape in Google Chrome on macOS before 150.0.7871.47 stems from a use-after-free in the browser's Bluetooth component, letting a remote attacker who lures a user into specific UI gestures on a crafted HTML page corrupt memory and break out of the renderer sandbox. Rated Critical by Chromium and CVSS 9.6, though no public exploit has been identified and EPSS is low (0.22%, 13th percentile). A vendor fix is available and CISA SSVC currently marks exploitation as 'none'.
Sandbox escape in Google Chrome's Navigation component before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated Medium by Chromium but carries a 9.6 CVSS due to the scope-changing sandbox breach; EPSS is low (0.17%, 7th percentile) and there is no public exploit identified at time of analysis, indicating it is realistically a second-stage link in an exploit chain rather than a standalone remote-code path.
Out-of-bounds memory read in the SurfaceCapture component of Google Chrome before 150.0.7871.47 lets a remote attacker leak adjacent heap memory when a victim opens a crafted HTML page. Chromium rated the flaw Medium severity, though the associated CVSS is 8.1; there is no public exploit identified at time of analysis and EPSS estimates exploitation probability at just 0.17% (7th percentile), consistent with a browser bug fixed pre-disclosure. Successful exploitation could disclose sensitive in-process data or crash the renderer, and typically serves as one link in a larger sandbox-escape chain rather than standalone compromise.
Heap corruption in the Passwords component of Google Chrome desktop before 150.0.7871.47 lets a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and likely code execution in the renderer. Rated CVSS 8.8 (Chromium severity Medium), it requires user interaction (visiting a malicious page) but no authentication. No public exploit identified at time of analysis; EPSS is low at 0.17% (7th percentile) and CISA SSVC records no observed exploitation.
Remote code execution in Google Chrome (Desktop) before 150.0.7871.47 stems from a use-after-free in the Navigation component, allowing a remote attacker who lures a victim to a crafted HTML page to corrupt memory and run arbitrary code in the renderer. Chromium rated it Medium, but the CVSS 8.8 reflects full C/I/A impact requiring only user interaction (visiting a page). There is no public exploit identified at time of analysis, and SSVC lists exploitation as none, with a low EPSS of 0.21%.
Use-after-free in Google Chrome's Omnibox component on Android (versions prior to 150.0.7871.47) lets a remote attacker who lures a user into performing specific UI gestures on a crafted HTML page trigger heap corruption and potentially achieve code execution in the renderer. Rated Medium by Chromium but scored CVSS 8.8 due to network reach and full CIA impact after minimal user interaction. There is no public exploit identified at time of analysis and EPSS is low (0.17%), and SSVC records exploitation status as none.
Navigation restriction bypass in Google Chrome on macOS prior to 150.0.7871.47 lets a remote attacker evade Safe Browsing protections by luring a victim into opening a malicious file, via an integer overflow in the Safe Browsing component. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, EPSS is low (0.20%, 10th percentile), and it is not listed in CISA KEV. The practical effect is that a security warning meant to block dangerous navigations can be defeated, not direct code execution.
Arbitrary code execution in Google Chrome's DevTools component (versions prior to 150.0.7871.47) lets a remote attacker run code inside the renderer sandbox after luring a victim into performing specific UI gestures with a malicious file. Rated Medium by Chromium but scored CVSS 7.5, the flaw stems from insufficient validation of untrusted input (CWE-20); no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.24% (15th percentile).
Remote code execution in Google Chrome's V8 JavaScript engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. Exploitation requires user interaction (visiting a malicious page) but no authentication, and the flaw carries a CVSS 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and EPSS is low (0.30%, 22nd percentile), indicating no evidence of widespread exploitation despite the high CVSS.
Arbitrary code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in Oilpan, Blink's garbage collector, letting a remote attacker who lures a victim to a crafted HTML page run code within the renderer sandbox. Google rated it Medium severity; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). Google has shipped a fixed Stable-channel build, and exploitation requires user interaction (visiting a malicious page).
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the renderer sandbox by abusing insufficient policy enforcement in the browser's USB (WebUSB) handling, delivered through a crafted HTML page. The flaw is rated Medium by Chromium but carries a high CVSS (8.3) due to the scope change from renderer to browser process; EPSS is low (0.21%, 11th percentile) and there is no public exploit identified at time of analysis. A vendor patch is available in the June 2026 Stable channel update.
Out-of-bounds memory write in Google Chrome's Fonts component (versions prior to 150.0.7871.47) lets a remote attacker corrupt heap memory when a victim renders a crafted HTML page, creating a path toward renderer-process code execution. The flaw stems from an integer overflow during font handling and requires only that the target open an attacker-controlled page. Chromium rates it Medium severity; there is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome's Dawn (WebGPU) implementation on Android before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox and reach the host via a crafted HTML page. Reported by Google's own Chrome security team and rated Medium by Chromium despite an NVD CVSS of 9.6, it currently has no public exploit identified at time of analysis and a low EPSS score (0.21%, 11th percentile). It is a second-stage bug that requires a prior renderer compromise, so it is dangerous as part of an exploit chain rather than as a standalone entry point.
Privilege escalation in Google Chrome desktop versions prior to 150.0.7871.47 lets a remote attacker escalate privileges when a victim opens a crafted HTML page, stemming from insufficient input validation in the Enterprise component. Chromium rated the flaw Medium severity, though the assigned CVSS of 8.8 reflects high confidentiality, integrity, and availability impact once triggered. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.21% (11th percentile).
Local privilege escalation in Google Chrome for Android before 150.0.7871.47 stems from insufficient validation of untrusted input in the browser UI, letting a local attacker who convinces a user to open a malicious file gain elevated privileges. Rated Medium by Chromium but scored CVSS 7.8 (total technical impact per SSVC), with no public exploit identified at time of analysis and a low EPSS of 0.13% (3rd percentile). Google has shipped a fixed Stable channel build.
Remote code execution in Google Chrome on Windows before 150.0.7871.47 allows a remote attacker to run arbitrary code after luring a victim to a crafted HTML page and coercing specific UI gestures via an inappropriate implementation in the Downloads component. Rated Medium by Chromium but scored CVSS 7.5 due to full compromise potential; no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile). SSVC lists exploitation as none, so this is a patch-in-normal-cycle item rather than an emergency.
Sandbox escape in Google Chrome on Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that abuses insufficient input validation in the Media component. Google rates the Chromium security severity as Medium and a fix is shipped in the stable channel, but no public exploit has been identified and EPSS exploitation probability is low at 0.21%. The high 9.6 CVSS reflects the total system compromise possible once chained, not standalone exploitability.
Use-after-free memory corruption in Google Chrome for iOS before version 150.0.7871.47 allows a remote attacker to trigger heap corruption when a victim loads a crafted HTML page, potentially leading to code execution within the browser context. The flaw was reported by Google's own security team and carries an NVD CVSS of 8.8, though Chromium rated its severity as Medium, and no public exploit has been identified at time of analysis. EPSS is low (0.21%, 11th percentile) and CISA SSVC records no observed exploitation, indicating this is a patch-on-schedule issue rather than an active threat.
Heap corruption in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who lures a user through specific in-page UI gestures on a crafted HTML page trigger a use-after-free (CWE-416), potentially leading to arbitrary code execution in the renderer. Rated Medium by the Chromium security team but scored CVSS 8.8 due to full confidentiality/integrity/availability impact; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.21% (11th percentile), consistent with a freshly patched browser bug that has no known weaponization.
Sandbox escape in Google Chrome DevTools before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, stemming from insufficient policy enforcement (CWE-693). NVD scores this 9.6 with a scope-change vector, though Google rates the Chromium severity only Medium and it is a second-stage bug requiring prior renderer compromise. No public exploit has been identified at time of analysis and EPSS is low (0.21%), consistent with a chained rather than standalone threat.
Privilege escalation in Google Chrome desktop before 150.0.7871.47 stems from insufficient policy enforcement in the browser's Bluetooth stack, letting a remote attacker who lures a victim to a crafted HTML page bypass client-side security checks (CWE-602). Exploitation requires user interaction (visiting the page) but no authentication (PR:N/UI:R), and NVD scores it 8.8 while Google's own Chromium team rated the severity Medium. There is no public exploit identified at time of analysis, EPSS is low at 0.22%, and CISA SSVC records exploitation status as none.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets an attacker who already controls a compromised renderer process break out of the browser sandbox through insufficient policy enforcement in the Web Serial API, using a crafted HTML page. Google rated the underlying Chromium bug Medium severity even though NVD assigns a 9.6 CVSS due to the scope-changing impact. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.22%, 12th percentile).
Remote code execution in Google Chrome prior to 150.0.7871.47 stems from a use-after-free (CWE-416) in the browser's HTML handling, letting a remote attacker who lures a victim to a crafted page execute arbitrary code, though execution is confined inside Chrome's renderer sandbox. Chromium rated the issue Medium severity precisely because the code runs within the sandbox rather than escaping it; no public exploit identified at time of analysis, and EPSS is low at 0.27% (18th percentile) with SSVC exploitation status 'none'. Google has shipped a fixed Stable-channel build.
Sandboxed remote code execution in Google Chrome's Cast Receiver component affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) can be triggered by luring a victim to a crafted HTML page. Google rates the Chromium severity as Medium because the resulting code execution is confined to the browser sandbox, though NVD scores it CVSS 8.8; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.27% (18th percentile).
Privilege escalation in Google Chrome's Chromecast component affects all desktop versions prior to 150.0.7871.47, where insufficient policy enforcement lets a remote attacker who lures a victim to a crafted HTML page escalate privileges within the browser. There is no public exploit identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21% (11th percentile). Note a signal conflict: the assigned CVSS is 8.8 (High) while Google/Chromium rated the underlying flaw only Medium severity.
Privilege escalation in Google Chrome's Extensions component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out via a crafted HTML page. Rated Medium by Chromium and CVSS 7.5, it stems from insufficient validation of untrusted input (CWE-20) and requires user interaction plus a pre-existing renderer foothold. There is no public exploit identified at time of analysis, EPSS is low (0.22%, 12th percentile), and it is not on CISA KEV.
Use-after-free in the Extensions component of Google Chrome before 150.0.7871.47 lets a remote attacker execute arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. Chromium rated the security severity Medium, though the associated CVSS score is 8.8 (High) due to network vector and high impact; there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.26%. Google has shipped a fixed Stable channel build.
Sandboxed remote code execution in Google Chrome for Android before 150.0.7871.47, stemming from a use-after-free in the Skia graphics library, lets a remote attacker run arbitrary code within the renderer sandbox by luring a victim to a crafted HTML page. Google rated the Chromium security severity as Medium, and no public exploit has been identified at time of analysis; the EPSS score is low (0.26%, 17th percentile), and the bug is not on CISA KEV. Exploitation requires user interaction (visiting the malicious page) but no authentication.
Heap-based integer overflow in Google Chrome's Chromecast component allows an adjacent-network attacker to achieve arbitrary code execution against browsers running versions prior to 150.0.7871.47. The flaw is reachable via crafted malicious network traffic and carries a high CVSS of 8.8; Google has shipped a stable-channel fix, and no public exploit has been identified at time of analysis. Chromium rates the underlying issue as Medium severity despite the high CVSS, reflecting the adjacency and interaction constraints.
Sandbox escape in Google Chrome's ANGLE graphics layer (versions prior to 150.0.7871.47) allows a remote attacker to potentially break out of the renderer sandbox when a victim loads a crafted HTML page. The flaw is a CWE-843 type confusion; while NVD scores it CVSS 9.6 (critical), Google's own Chromium team rated the security severity as Medium, and there is no public exploit identified at time of analysis. EPSS is low (0.23%, 13th percentile) and CISA SSVC records no known exploitation, so this is a patch-on-cycle browser bug rather than an emergency.
Sandbox escape in Google Chrome desktop prior to 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox by winning a race condition in the USB subsystem via a crafted HTML page. Chromium rated it Medium severity despite the 9.6 CVSS, reflecting that it is a second-stage bug requiring prior renderer compromise; there is no public exploit identified at time of analysis and it is not in CISA KEV, with EPSS at just 0.21% (11th percentile).
Sandbox escape in Google Chrome's USB subsystem on macOS (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The flaw is a use-after-free (CWE-416) and was reported by Google's own security team; Chromium rated it Medium severity despite the NVD CVSS of 9.6. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.21%, 11th percentile), consistent with a chained/second-stage bug rather than a directly weaponizable entry point.
Sandbox escape in Google Chrome on macOS (versions prior to 150.0.7871.47) arises from a use-after-free in the browser's Bluetooth component, letting an attacker who has already compromised the renderer process break out of the sandbox and reach the higher-privileged browser process via a crafted HTML page. This is a second-stage exploitation primitive rather than an initial-access flaw, which is why Google rates the Chromium severity as Medium despite the 9.6 CVSS. No public exploit has been identified, there is no CISA KEV listing, and EPSS exploitation probability is low (0.21%, 11th percentile).
Sandbox escape in Google Chrome for Android before 150.0.7871.47 lets a local attacker break out of the renderer/browser sandbox by feeding a malicious file into the WebAppInstalls component, which insufficiently validates untrusted input (CWE-20). Chromium rates the security severity as Medium, and no public exploit has been identified at time of analysis; EPSS estimates only a 0.13% (3rd percentile) chance of exploitation in the next 30 days. A vendor patch is available in Chrome 150.0.7871.47.
Sandboxed remote code execution in the WebView component of Google Chrome for Android before 150.0.7871.47 lets a remote attacker run arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. Rated CVSS 8.8 (network vector, no privileges, requires user interaction), the flaw is a CWE-416 use-after-free, but code execution is confined to the sandbox and would require a separate escape to reach the host. No public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile), indicating limited near-term mass-exploitation pressure despite the high base score.
Sandbox escape in Google Chrome's Device component on Windows (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, exploiting a use-after-free (CWE-416). Google rates the Chromium security severity as Medium, reflecting that it is a second-stage bug requiring prior renderer compromise, though the NVD CVSS of 9.6 is inflated by the sandbox scope change. There is no public exploit identified at time of analysis and EPSS is low (0.21%), indicating no current sign of widespread exploitation.
Privilege escalation in Google Chrome desktop prior to 150.0.7871.47 stems from insufficient policy enforcement in the WebHID subsystem, letting a maliciously crafted extension escape its intended boundaries and gain elevated access to human-interface devices and browser privileges. Exploitation first requires convincing a victim to install the malicious extension, after which a crafted Chrome Extension bypasses WebHID access controls. Chromium rates the issue Medium; no public exploit is identified at time of analysis and EPSS exploitation probability is low (0.13%, 3rd percentile).
Privilege escalation in Google Chrome for Android (CustomTabs) prior to 150.0.7871.47 allows a local attacker to escalate privileges by supplying a malicious file that CustomTabs fails to validate properly. Google rates the Chromium severity as Medium, and the requirement for user interaction plus local access limits remote mass exploitation. No public exploit has been identified at time of analysis and the EPSS score is very low (0.13%, 3rd percentile), so opportunistic exploitation appears unlikely.
Sandbox escape in Google Chrome before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page, exploiting a use-after-free (CWE-416) in the Core component. Google-assigned Chromium severity is Medium, though the NVD CVSS is 9.6 due to the cross-boundary scope change. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile), indicating it is not yet a mass-exploitation target.
Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 150.0.7871.47) allows a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox, a critical trust-boundary bypass affecting the Windows/macOS/Linux desktop browser. The NVD scores this 9.6 (scope-changed) though Google rates the underlying Chromium issue as Medium severity, and there is no public exploit identified at time of analysis. EPSS is low (0.21%) and CISA SSVC records exploitation status as none, indicating no observed active abuse.
Privilege escalation in Google Chrome for Android before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out further by feeding a crafted HTML page into the Speech component, which fails to validate untrusted input (CWE-20). Google rated it Medium severity; a fix has shipped in the Stable channel, EPSS is low (0.21%, 11th percentile), and there is no public exploit identified at time of analysis. This is a sandbox-escape-class chaining bug rather than a standalone remote drive-by, since it presupposes a prior renderer compromise.
Remote code execution in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in the Ozone platform layer, allowing a remote attacker who lures a victim into performing specific UI gestures on a crafted HTML page to execute arbitrary code in the browser context. Rated High by Chromium and CVSS 7.5, exploitation is gated by required user interaction and high attack complexity. There is no public exploit identified at time of analysis, and the EPSS probability is low at 0.26% (17th percentile).
Sandbox escape in Google Chrome on Linux (versions prior to 150.0.7871.47) stems from a use-after-free in Ozone, Chrome's platform abstraction layer for windowing and graphics. An attacker who has already compromised the renderer process can leverage a crafted HTML page to break out of the browser sandbox and gain code execution at the higher-privileged browser-process level. There is no public exploit identified at time of analysis, and the EPSS score is low (0.21%, 11th percentile), consistent with a second-stage bug that requires a prior renderer compromise rather than a directly weaponizable single-shot flaw.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Journeys (browsing history) component, allowing a remote attacker who has already compromised the renderer process to break out of the sandbox and gain broader code execution on the host via a crafted HTML page. Rated High severity by Chromium and CVSS 9.6, a fix is available from vendor; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.21%, 11th percentile). Exploitation is meaningful only as the second stage of a chain, since it presupposes prior renderer compromise.
Discretionary access control bypass in Google Chrome for Android before 150.0.7871.47 lets a local attacker abuse the WebAppInstalls component through a crafted HTML page, undermining the platform's integrity and availability boundaries. Google rates the Chromium severity High and has shipped a fix in the Stable channel; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Access-control bypass in Google Chrome for Android before 150.0.7871.47 allows an attacker to subvert discretionary access controls through the WebAppInstalls component by serving a crafted HTML page, stemming from insufficient validation of untrusted input. Rated High by Chromium and scored CVSS 9.1, the flaw carries high integrity and availability impact but no confidentiality loss; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.14%, 4th percentile).
Sandboxed arbitrary code execution in Google Chrome for iOS before 150.0.7871.47 lets an attacker who convinces a user to open a malicious file run code inside the browser's sandbox due to insufficient validation of untrusted input. Google rates the Chromium severity High and ships the fix in 150.0.7871.47; EPSS is low (0.15%, 4th percentile) and there is no public exploit identified at time of analysis. The flaw requires user interaction (opening the file) and, per the description, the resulting execution is confined to the sandbox rather than the underlying OS.
Sandbox escape in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows versions prior to 150.0.7871.47 allows a local attacker to break out of the browser sandbox by getting a victim to open a malicious file. Google rates the Chromium severity as High, and while a vendor patch is available, EPSS is low (0.13%) and CISA SSVC records no known exploitation, so this is no public exploit identified at time of analysis. The scope-changing, high-impact nature (full confidentiality, integrity and availability loss beyond the sandbox boundary) makes it a meaningful patch priority for Windows Chrome fleets despite requiring user interaction.
Remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Forms component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and execute arbitrary code within the browser's renderer sandbox. Chromium rates the flaw High severity, CVSS 8.8, requiring only that the user visit a malicious page; there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.26%, 17th percentile). A vendor patch is available in the June 2026 Stable channel release.
Sandbox escape in Google Chrome for macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox by exploiting a use-after-free in the USB subsystem via a crafted HTML page. Rated High by Chromium and CVSS 9.6, it functions as a second-stage escalation primitive rather than a standalone entry point. There is no public exploit identified at time of analysis, and EPSS is low at 0.21% (11th percentile).
Arbitrary code execution in Google Chrome's DOM implementation lets a remote attacker run code within the renderer sandbox by luring a victim to a crafted HTML page. All desktop Chrome builds before 150.0.7871.47 are affected; Chromium rates the flaw High severity. No public exploit has been identified and EPSS probability is low (0.26%), but the vendor patch is already available and should be applied promptly.
Local OS-level privilege escalation in Google Chrome on Windows (versions prior to 150.0.7871.47) arises from a use-after-free in the Chrome Updater component, letting a local attacker who can plant a malicious file on the system elevate to higher OS privileges. Google rates the Chromium severity as High and has released a fixed Stable channel build; there is no public exploit identified and it is not listed in CISA KEV. EPSS is low at 0.13% (3rd percentile), consistent with a bug that requires local access and user interaction rather than mass remote exploitation.
Sandbox escape in Google Chrome for iOS before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to the scope change and full compromise potential, though it is a second-stage bug requiring a prior renderer exploit. There is no public exploit identified at time of analysis, and EPSS exploitation probability is low at 0.22% (12th percentile); Google has shipped a fixed version.
Sandbox escape in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the sandbox and execute code in the more privileged browser context via a crafted HTML page. Google rates the Chromium severity as High, and a fixed stable-channel build is available. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and SSVC records exploitation status as none.
Heap corruption in Google Chrome's XML implementation on all desktop platforms prior to 150.0.7871.47 allows a remote attacker to potentially achieve code execution when a victim visits a crafted HTML page. Rated High severity by Chromium with a CVSS of 8.8 (network vector, user interaction required), this is a memory-safety flaw (CWE-122 heap-based buffer overflow) reported through Google's internal CVE process. There is no public exploit identified at time of analysis, and SSVC assessment shows exploitation status of none with a low EPSS of 0.21%.
Sandbox escape in Google Chrome's ANGLE graphics component (versions prior to 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating from renderer-level code execution to the more privileged GPU/browser context. Google rates the Chromium severity as High and a vendor patch is available; there is no public exploit identified and it is not listed in CISA KEV, with EPSS exploitation probability low at 0.21%.
Sandbox escape in Google Chrome's Headless component (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page. Rated High by Chromium and CVSS 8.3, it is a CWE-416 use-after-free with no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records no known exploitation.
Out-of-bounds read/write (use-after-free) in Google Chrome's GPU component lets a remote attacker who has already compromised the renderer process run arbitrary code - though still confined inside the sandbox - by serving a crafted HTML page to a Chrome build prior to 150.0.7871.47. Google rates the Chromium severity High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and EPSS puts near-term exploitation probability at just 0.26%.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Linux allows an adjacent-network attacker to run arbitrary code by sending malicious network traffic to a vulnerable client before version 150.0.7871.47. The flaw is a use-after-free memory-corruption issue rated High by Chromium and carries a CVSS 8.8. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low (0.24%, 15th percentile), indicating no observed exploitation activity yet.
Sandbox escape in Google Chrome on Windows before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page, escalating from renderer code execution to the more privileged browser process. Rated High severity by Chromium with a CVSS of 8.3 (scope-changing), it stems from insufficient validation of untrusted input in the Settings component. There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and CISA SSVC lists exploitation as none, indicating no observed in-the-wild use despite the total technical impact.
Local privilege escalation in Google Chrome's Updater component on macOS versions prior to 150.0.7871.47 lets an attacker abuse a use-after-free (CWE-416) via a malicious file to gain the elevated privileges under which the updater runs. Google rates the Chromium severity as High, and the CVSS 3.1 base score is 7.8; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is low at 0.13% (3rd percentile), consistent with the SSVC exploitation status of 'none'.
Heap corruption in Google Chrome's Dawn WebGPU implementation lets a remote attacker who lures a victim to a crafted HTML page potentially achieve memory corruption and code execution in all versions prior to 150.0.7871.47. The flaw stems from use of uninitialized memory (CWE-457) and carries a High Chromium severity with a CVSS 8.8; no public exploit has been identified and EPSS is low (0.23%), and SSVC currently rates exploitation as none. A vendor patch is available in the June 2026 Stable channel update.
Privilege escalation in Google Chrome's Extensions subsystem before version 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of that context and gain elevated privileges by delivering a crafted HTML page. Google rates the Chromium severity as High, and the assigned CVSS is 7.5 (AV:N/AC:H). There is no public exploit identified at time of analysis, EPSS is low (0.21%, 11th percentile), and CISA's SSVC framework records exploitation status as none, indicating this is currently a patch-and-move-on issue rather than an active threat.
Sandbox escape in Google Chrome's Glic component before version 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the browser sandbox by serving a crafted HTML page that triggers a use-after-free (CWE-416). Rated High by Chromium with a CVSS of 8.3 and a scope-changing vector; there is no public exploit identified at time of analysis, and EPSS is low at 0.21%. SSVC shows no known exploitation and Google has released a patched Stable channel build.
Remote code execution in Google Chrome desktop versions prior to 150.0.7871.47 stems from a use-after-free in the Canvas component, letting a remote attacker run arbitrary code within the renderer sandbox when a victim opens a crafted HTML page. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a malicious page), but no authentication. There is no public exploit identified at time of analysis, and EPSS is low at 0.26% (17th percentile).
Out-of-bounds memory read in the ANGLE graphics component of Google Chrome on macOS before 150.0.7871.47 lets an attacker who has already compromised the renderer process read memory outside intended bounds via a crafted HTML page. Rated High by Chromium and CVSS 8.1, it functions as a chained post-exploitation primitive rather than a standalone entry point. No public exploit is identified at time of analysis and EPSS exploitation probability is low at 0.21% (11th percentile).
Sandbox escape in Google Chrome versions prior to 150.0.7871.47 stems from insufficient input validation in the Glic component, allowing a remote attacker who lures a victim to a crafted HTML page to potentially break out of the renderer sandbox. The flaw carries a CVSS 8.8 (High) rating and requires user interaction (visiting a malicious page); there is no public exploit identified at time of analysis and EPSS estimates only a 0.21% exploitation probability. A vendor patch is available and the issue is not listed in CISA KEV.
Remote code execution in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) allows a remote attacker to run arbitrary code inside the renderer sandbox by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated High by Chromium and 8.8 (CVSS 3.1); it requires user interaction (visiting a malicious page) and no privileges. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, with a low EPSS of 0.26% (17th percentile).
Heap corruption via a use-after-free in the Views UI component of Google Chrome allows a remote attacker who serves a crafted HTML page and lures a user into performing specific UI gestures to potentially execute code in the browser process. All desktop Chrome builds prior to 150.0.7871.47 are affected; Google rates the Chromium severity as High and has shipped a fix. No public exploit identified at time of analysis, and EPSS is low (0.21%, 11th percentile).
Sandbox escape in Google Chrome for iOS prior to 150.0.7871.47 lets a remote attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating from renderer-level code execution to broader access on the device. The flaw stems from insufficient policy enforcement (CWE-20) and carries a High Chromium severity rating with a CVSS 8.3 (scope-changed) score. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS probability is low at 0.21% (11th percentile).
Renderer-process remote code execution in Google Chrome desktop before 150.0.7871.47 stems from a use-after-free in the Input Method Editor (IME) component, letting a remote attacker run arbitrary code within the browser's sandbox when a victim visits a crafted HTML page. Rated High by Chromium and CVSS 8.8, it requires user interaction (visiting a page) but no authentication. No public exploit identified at time of analysis, and the EPSS score is low (0.26%, 17th percentile), indicating no evidence of widespread exploitation yet.
Remote code execution in Google Chrome on iOS prior to 150.0.7871.47 stems from a use-after-free in the browser's Import component, allowing a remote attacker who lures a victim into opening a malicious file and performing specific UI gestures to execute arbitrary code. Rated High by Chromium and CVSS 7.5, the flaw has no public exploit identified at time of analysis and a low EPSS of 0.24% (15th percentile), consistent with its high attack complexity and required user interaction. A vendor patch is available in the June 2026 Stable channel update.
Site-isolation bypass in Google Chrome desktop before 150.0.7871.47 lets an attacker who has already compromised the renderer process escape cross-origin protections through insufficient input validation in the Accessibility component via a crafted HTML page. Rated High by Chromium and CVSS 8.1, it is a second-stage primitive rather than an initial-access flaw; no public exploit has been identified and EPSS exploitation probability is low (0.22%). It requires an existing renderer compromise plus a user visiting a malicious page, so it is realistically a chained-exploit component.
Remote code execution in Google Chrome for macOS prior to 150.0.7871.47 stems from a use-after-free in the GFX (graphics) component, allowing a remote attacker to run arbitrary code after a victim opens a crafted HTML page. Chromium rates the severity High and the CVSS is 8.8, but exploitation requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis and EPSS is low (0.26%, 17th percentile), indicating no observed weaponization yet.
Sandbox escape in Google Chrome's Chromecast component (versions before 150.0.7871.47) lets an attacker who has already compromised the renderer process break out of the browser sandbox and reach the host via a crafted HTML page. Rooted in a use-after-free (CWE-416) memory-corruption bug rated High by Chromium, it carries a CVSS 8.3 driven by a scope change and full CIA impact, but requires a pre-existing renderer compromise, high attack complexity, and user interaction. No public exploit identified at time of analysis, and the low EPSS (0.21%) plus SSVC 'exploitation: none' indicate it is not currently being exploited.
Sandbox escape in Google Chrome desktop before 150.0.7871.47 lets a remote attacker who has already compromised the renderer process escalate out of the sandbox via a crafted HTML page that triggers a type-confusion bug (CWE-843) in the Tabs component. Exploitation is gated behind prior renderer compromise and user interaction, and the flaw is rated High by Chromium with a CVSS 8.3 due to scope change and total impact. There is no public exploit identified at time of analysis, EPSS is low (0.23%, 13th percentile), and CISA SSVC lists exploitation as none.
Remote code execution in Google Chrome (Views UI component) prior to 150.0.7871.47 allows a remote attacker to execute arbitrary code by luring a victim to a crafted HTML page and inducing specific UI gestures that trigger a use-after-free. Rated High by Chromium and CVSS 7.5, the flaw is elevated in complexity by its requirement for user interaction, and no public exploit has been identified at time of analysis; EPSS probability is low at 0.26%.
Sandbox escape in Google Chrome's Chromecast component allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox and gain broader host access via a crafted HTML page. Affects Chrome desktop versions prior to 150.0.7871.47, rated High by Chromium with a CVSS of 8.3. There is no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile) and CISA SSVC records exploitation as none.
Local privilege escalation in the Google Chrome Updater on Windows (versions prior to 150.0.7871.47) allows a local attacker to gain OS-level privileges by planting a malicious file that the Updater component mishandles. Rated High by Chromium and CVSS 7.8, exploitation requires local access plus user interaction; there is no public exploit identified at time of analysis, and EPSS is low at 0.13% (3rd percentile). A vendor patch is available in the June 2026 Stable Channel release.
Heap corruption in Google Chrome's QUIC networking stack (versions prior to 150.0.7871.47) stems from a use-after-free that a remote attacker can trigger through crafted network traffic, potentially leading to arbitrary code execution in the affected browser process. Google rated the Chromium security severity as High and has shipped a fixed Stable-channel build; there is no public exploit identified at time of analysis and CISA's SSVC records exploitation status as 'none'. EPSS is low (0.19%, 9th percentile), indicating no observed weaponization despite a total technical-impact rating.
Sandbox escape in Google Chrome desktop versions prior to 150.0.7871.47 stems from a heap buffer overflow in the Chromecast component, letting an attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6, but it is a second-stage bug requiring prior renderer control, and there is no public exploit identified at time of analysis (SSVC exploitation: none, EPSS 0.22%). No CISA KEV listing exists, indicating no confirmed active exploitation.
Sandbox escape in Google Chrome's Chromecast component (versions prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. Rated High by Chromium with a CVSS of 9.6 due to scope change and full CIA impact, this is a second-stage bug typically chained after an initial renderer exploit. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS is low at 0.21%.
Sandbox escape in Google Chrome's Chromecast component before 150.0.7871.47 lets an attacker who has already compromised the renderer process break out of the sandbox via a crafted HTML page, escalating from renderer-level code execution to the more privileged browser process. Google rates the Chromium severity High and the CVSS is 9.6 due to the scope change; however, EPSS is only 0.21% (11th percentile) and there is no public exploit identified at time of analysis. A vendor patch is available.
Remote code execution in Google Chrome on Windows before version 150.0.7871.47 allows an attacker to run arbitrary code by luring a victim to a crafted HTML page and getting them to perform specific UI gestures against the WebAppInstalls component. Chromium rates the flaw High severity; no public exploit identified at time of analysis, and the EPSS probability is low (0.26%, 17th percentile), indicating the attack is not yet broadly commoditized despite the serious impact.
Sandbox escape in Google Chrome for macOS versions prior to 150.0.7871.47 stems from a use-after-free in the Touchbar component, letting a remote attacker who lures a victim to a crafted HTML page potentially break out of the renderer sandbox. Reported through Google's internal Chrome security process and rated High by Chromium, it carries a CVSS 9.6 due to scope change and full CIA impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is low at 0.21%. SSVC assesses current exploitation as none, indicating this is a patch-now-but-not-panic item.
Arbitrary code execution in Google Chrome desktop before 150.0.7871.47 arises from insufficient input validation in the Downloads component, letting a crafted Chrome extension break out of its intended sandbox constraints. An attacker who first convinces a victim to install a malicious extension can leverage the flaw to run arbitrary code, which Chromium rates High severity. No public exploit has been identified at time of analysis and EPSS is low (0.15%, 5th percentile), indicating no observed widespread exploitation.
Sandbox escape in Google Chrome's GPU process (versions prior to 150.0.7871.47) lets a remote attacker who has already compromised the renderer process break out of the browser sandbox via a crafted HTML page. Rated High by Chromium and CVSS 9.6 due to a scope-changing (S:C) full-impact outcome, this is a use-after-free (CWE-416) memory-corruption bug. No public exploit identified at time of analysis; EPSS is low (0.21%, 11th percentile) and CISA SSVC lists exploitation as none, so it is a serious-but-not-yet-exploited patch priority.
Remote code execution in Google Chrome for Android before 150.0.7871.47 stems from a use-after-free in the Fullscreen component, letting a remote attacker who lures a victim to a crafted HTML page corrupt memory and run arbitrary code in the renderer. Chromium rates the flaw Critical, though CVSS scores it 8.8 because exploitation requires the victim to open the malicious page. There is no public exploit identified at time of analysis, and the EPSS probability is low (0.26%, 17th percentile), with CISA SSVC showing no known exploitation.
Remote code execution in Google Chrome's Chromoting (Chrome Remote Desktop) component on Windows affects all desktop builds prior to 150.0.7871.47, where a use-after-free (CWE-416) lets a remote attacker corrupt memory via malicious network traffic. Google rates the Chromium severity Critical, and a vendor patch is available, but there is no public exploit identified at time of analysis and EPSS is low at 0.24%. High attack complexity (AC:H) means the memory-corruption race is non-trivial to win reliably, tempering the CVSS 8.1 score.
Remote code execution in Google Chrome's Ozone platform-abstraction layer prior to 150.0.7871.47 lets a remote attacker execute arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated Critical by Chromium and CVSS 8.8, requiring the victim to visit a malicious page (UI:R) but no privileges. No public exploit has been identified at time of analysis and EPSS probability is low (0.26%), but the memory-corruption class and 'total' technical impact make it a high-priority browser patch.
Sandbox escape in Google Chrome on macOS before 150.0.7871.47 stems from a use-after-free in the browser's Bluetooth component, letting a remote attacker who lures a user into specific UI gestures on a crafted HTML page corrupt memory and break out of the renderer sandbox. Rated Critical by Chromium and CVSS 9.6, though no public exploit has been identified and EPSS is low (0.22%, 13th percentile). A vendor fix is available and CISA SSVC currently marks exploitation as 'none'.