Red Hat
Monthly
Uninitialized memory use in Dawn, Chrome's WebGPU implementation, on ChromeOS prior to version 150.0.7871.46 enables remote attackers to read potentially sensitive contents from GPU process memory by serving a crafted HTML page. The flaw (CWE-457) allows stale or uninitialized buffer data to be exposed back to the requesting JavaScript context without proper sanitization. No public exploit has been identified at time of analysis, and CISA SSVC rates this as non-automatable with partial technical impact, though the CVSS confidentiality rating is High.
Cross-origin data leakage in Google Chrome's ANGLE graphics subsystem (all versions prior to 150.0.7871.46) enables remote attackers to read sensitive data from other browser origins by luring a victim to a crafted HTML page. The flaw stems from uninitialized memory use in ANGLE, Chrome's GPU abstraction layer, which may expose stale cross-origin pixel buffers or texture memory to attacker-controlled JavaScript. No public exploit has been identified and CISA's SSVC framework rates exploitation as none with a non-automatable attack path, indicating limited immediate real-world threat despite the network-accessible vector.
Uninitialized memory read in ANGLE - Chrome's graphics abstraction layer - exposes potentially sensitive process memory to remote attackers on Windows systems running Chrome prior to 150.0.7871.46. Exploitation requires the victim to visit a crafted HTML page, after which the ANGLE Direct3D translation path leaks heap or stack contents that may include session tokens, cached credentials, or other browser-resident data. No active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.20% at the 10th percentile reflects very low current exploitation activity despite the CVSS C:H rating.
Out-of-bounds read in Chrome's V8 JavaScript engine allows a memory disclosure attack against users running Google Chrome prior to 150.0.7871.46. An attacker who socially engineers a victim into installing a crafted malicious extension can trigger the OOB read to leak sensitive data from the renderer process memory, such as tokens or session material. No public exploit code has been identified and SSVC classifies exploitation as none, but the high confidentiality impact and Chrome's global install base make patching the appropriate near-term action.
Out-of-bounds read in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome prior to 150.0.7871.46 exposes process memory to remote attackers via a crafted HTML page. An unauthenticated remote attacker can cause a victim's browser to disclose potentially sensitive process memory - such as cached credentials or heap artifacts - with no integrity or availability impact. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS at 0.23% (14th percentile) confirms low near-term exploitation probability.
Out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction layer) prior to version 150.0.7871.46 allows a remote attacker to extract potentially sensitive data from the browser's process memory by directing a victim to a crafted HTML page. The CVSS vector confirms network delivery with no authentication required but mandates user interaction, and the High confidentiality impact (C:H) indicates that in-memory data such as session tokens, cached credentials, or page content could be exposed. SSVC assessment records no active exploitation and the flaw is absent from the CISA KEV catalog; a vendor patch has been released and no public exploit code has been identified at time of analysis.
Cross-origin data exfiltration in Google Chrome's ANGLE graphics layer exposes sensitive browser memory contents to remote attackers who can induce a victim to visit a crafted HTML page. The out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction engine) affects all Chrome desktop versions prior to 150.0.7871.46, confirmed by Google's stable channel advisory. No public exploit code or active exploitation has been identified at time of analysis; an EPSS of 0.17% (7th percentile) reflects minimal current weaponization pressure despite the high confidentiality impact assigned in CVSS.
Cross-origin data leakage in Google Chrome on Windows prior to 150.0.7871.46 stems from an out-of-bounds read in ANGLE, the browser's graphics abstraction layer. Remote attackers can exploit this by serving a crafted HTML page to a Windows user, causing the ANGLE subsystem to read memory beyond its intended buffer boundary and exposing data belonging to a separate web origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates low exploitation probability in the near term.
Integer overflow in Chrome's ANGLE graphics abstraction layer on Windows enables a remote attacker, who has already compromised the renderer process, to read potentially sensitive data from process memory. The attack requires a user to visit a crafted HTML page, making this a second-stage component in a multi-step exploit chain rather than a standalone critical flaw. No public exploit code has been identified and CISA has not added this to the KEV catalog; Chrome 150.0.7871.46 resolves the issue.
Insufficient input validation in Skia, Chrome's 2D graphics library, exposes process memory to an attacker who has already achieved renderer process compromise. Affected versions of Chrome prior to 150.0.7871.46 can leak potentially sensitive in-memory data when the victim visits a crafted HTML page. No public exploit code exists and no active exploitation is confirmed - EPSS at 0.22% (12th percentile) and SSVC Exploitation: none corroborate low near-term risk despite the High confidentiality impact rating.
UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 150.0.7871.46) enables remote attackers to misrepresent security indicators during Progressive Web App installation prompts via a crafted HTML page. The incorrect security UI (CWE-451) can deceive users into believing they are installing a legitimate, trusted application when they are not, resulting in a low-integrity impact. EPSS is 0.18% (8th percentile), no public exploit code exists, and this vulnerability has not been added to CISA KEV, indicating minimal active exploitation risk at time of analysis.
UI spoofing in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.46) allows a remote attacker who has already compromised the renderer process to mislead users through a crafted HTML page. The attack requires renderer process compromise as a prerequisite, making this a chained exploit component rather than a standalone threat. EPSS at 0.18% (8th percentile) and absence from CISA KEV confirm no known active exploitation; Chromium's own team rated this Low severity.
UI spoofing via a crafted PDF file in Google Chrome's PDFium rendering engine allows a remote, unauthenticated attacker to visually mislead users into performing unintended actions or trusting falsified content. All Chrome versions prior to 150.0.7871.46 are affected. Exploitation requires the victim to open a malicious PDF - no special configuration is needed beyond default Chrome behavior. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Symlink traversal in oras-go's file content store allows writes outside the intended `workingDir` boundary even when `AllowPathTraversalOnWrite=false`. Applications that pull OCI artifacts from untrusted registries where an attacker controls blob titles (`ocispec.AnnotationTitle`) are at risk if any directory component under `workingDir` is a symlink pointing to an external path. No confirmed active exploitation (not in CISA KEV), but a self-contained proof-of-concept was included in the researcher's disclosure, making reproduction straightforward given the prerequisites.
Timestamp forgery in sigstore-js allows an attacker supplying a crafted bundle v0.2 to manipulate certificate validity window checks by controlling the `integratedTime` field in an inclusionProof-only tlog entry. Because the inclusionProof-only code path in `@sigstore/verify` does not cryptographically bind `integratedTime` (unlike the signed inclusionPromise/set path), a low-privileged attacker who can present an untrusted bundle can cause the verifier to accept expired or not-yet-valid signing certificates as currently valid. A publicly available proof-of-concept exists; this vulnerability is not in CISA KEV.
SQL injection in the Wikimedia Foundation's MediaWiki Cargo Extension exposes wiki deployments to unauthenticated database read and write operations across all versions prior to 1.43.9, 1.44.6, and 1.45.4. The Cargo extension's core function - accepting user-supplied query parameters to construct database queries - makes this a structurally sensitive attack surface, as improper neutralization of SQL special elements allows crafted input to escape intended query boundaries. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the PR:N/AC:L/AT:N CVSS 4.0 vector confirms exploitation requires no authentication or special preconditions against default-accessible Cargo query endpoints.
Heap buffer over-write in ImageMagick's JP2 (JPEG 2000) encoder - present in all versions prior to 7.1.2-26 - allows an attacker to crash the process by supplying a maliciously crafted JP2 image file, resulting in a denial-of-service condition. The root cause is CWE-682 (Incorrect Calculation): argument handling logic in the JP2 encoder computes incorrect bounds, leading to an out-of-bounds heap write. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Uncontrolled resource consumption in ImageMagick (all versions prior to 6.9.13-51 and 7.1.2-26) allows a denial-of-service condition by supplying invalid arguments to the connected-components processing option, which causes an infinite loop that exhausts CPU resources indefinitely. The vulnerability requires local access, user interaction, and high attack complexity, confining realistic risk to environments where untrusted input can influence ImageMagick invocations - such as automated image-processing pipelines or web applications that expose connected-components functionality. Vendor-released patches exist for both the 6.x and 7.x branches; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stack overflow in ImageMagick's MVG decoder prior to versions 6.9.13-51 and 7.1.2-26 allows remote unauthenticated attackers to crash image-processing services by submitting a crafted MVG image file. The root cause is a missing depth check in the MVG decoder (CWE-400), enabling unbounded recursion that exhausts stack memory. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the zero-friction attack surface - any application accepting image uploads with unpatched ImageMagick - makes patching a practical priority.
Heap buffer overflow in ImageMagick's MVG decoder allows remote unauthenticated attackers to trigger an out-of-bounds write by supplying a specially crafted image file, resulting in denial of service. Affected are all ImageMagick deployments prior to versions 6.9.13-51 (legacy v6 branch) and 7.1.2-26 (current v7 branch). No public exploit code or active exploitation has been identified at time of analysis; however, the network-accessible vector and zero-privilege requirement make this relevant for any service that accepts and processes user-supplied images.
Use-after-free in ImageMagick's 8BIM profile parser crashes the process when a specially crafted image is identified, affecting all releases prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch). The vulnerability is triggered by a specific format string embedded in the 8BIM metadata profile, causing memory corruption that results in a denial-of-service condition. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the intelligence feed.
Heap memory disclosure in ImageMagick's MNG decoder affects all versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch), allowing remote unauthenticated attackers to obtain partial heap contents by submitting a crafted MNG image file and retrieving the processed output. The root cause (CWE-908) is that pixel buffers are not fully initialized before output is written, leaving residual in-process heap data embedded in the resulting image. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication, network-accessible attack vector makes this a meaningful risk for any image-processing pipeline that accepts untrusted MNG input.
Credential exposure in AWS CLI on Unix-like systems allows other local users on the same host to read sensitive credentials written to disk by three specific subcommands: aws codeartifact login, aws iam create-virtual-mfa-device, and aws deploy register. When the system umask is at its default permissive value - the case on most Unix-like systems - credential files are written without adequately restrictive permissions, making them readable by other local accounts. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor (Amazon) has confirmed the issue and released patched versions 1.44.78 (v1) and 2.34.29 (v2).
Authentication bypass in the Wikimedia Foundation's WikiLambda extension for MediaWiki allows unauthenticated remote attackers to circumvent access controls via improper neutralization of input terminator characters (CWE-288). Affected are all WikiLambda deployments running versions prior to 1.43.9, 1.44.6, and 1.45.4 across the supported MediaWiki release branches. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-prerequisite attack vector warrants prompt patching.
Integer overflow in ImageMagick's XCF (GIMP native format) decoder allows remote unauthenticated attackers to trigger an out-of-bounds read by supplying a crafted XCF image file, resulting in an application crash or limited memory disclosure. All ImageMagick releases prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch) are affected. No public exploit code or active exploitation has been identified at time of analysis, but the zero-complexity, pre-authentication attack surface makes this a meaningful risk for any internet-facing service that processes user-supplied images via ImageMagick.
Arbitrary HDF5 file read in Keras up to 3.13.2 enables information disclosure when a victim loads a crafted model file, representing an incomplete patch for the prior CVE-2026-1669. The flaw lies in two specific code paths - `H5IOStore._verify_dataset()` and `file_editor.py` - which omit the `dataset.is_virtual` check, allowing a malicious HDF5 Virtual Dataset (VDS) to silently redirect reads to attacker-specified paths on the local filesystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the attack surface is realistic in ML supply chain and model-sharing contexts.
Plugin directory guard bypass in HashiCorp Vault and Vault Enterprise allows a highly privileged, authenticated attacker to read files outside the intended audit plugin directory via path traversal. Exploitation requires network access, high-privilege credentials, and the use of the legacy file audit path option - a non-default configuration. Fixed versions are 2.0.1, 1.21.6, 1.20.11, and 1.19.17; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-tenant information disclosure in Foreman (packaged as Red Hat Satellite 6) allows an authenticated user holding host-edit permissions to retrieve sensitive infrastructure metadata from organizations and locations they are not authorized to access. The root cause is the taxonomy_scope controller method accepting organization and location IDs from nested request parameters without validating them against the caller's authorized tenancy scope, implementing a textbook CWE-639 authorization bypass through user-controlled key. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis; however, the low attack complexity and lack of user interaction make this straightforward to exploit for any low-privileged authenticated user in multi-tenant Satellite deployments.
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host-edit permissions to retarget an existing lookup value override to hosts outside their authorized organizational or location scope. The flaw stems from insufficient authorization enforcement on the match field when modified via nested host attributes, allowing an attacker to effectively write configuration overrides to managed hosts they are not permitted to administer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_keypairs' permission to bypass taxonomy scoping and retrieve private SSH keys belonging to foreign organizations by directly querying key pair IDs via the API. The flaw is an IDOR (CWE-639) at the multi-tenancy enforcement layer, meaning the isolation contract between tenant organizations is broken for any user granted that permission. No CISA KEV listing or public exploit code has been identified at time of analysis; impact is strictly confidentiality - no write or destructive capability is exposed through this path.
Race condition in the Linux kernel HSR (High-availability Seamless Redundancy) subsystem triggers a WARN_ONCE() during device teardown, potentially causing denial of service on affected systems. The flaw exists in hsr_addr_is_self() at net/hsr/hsr_framereg.c:39, where hsr->self_node is NULLed by hsr_del_self_node() before unregister_netdevice_many() completes, leaving a window for concurrent packet transmission to access a NULL pointer. On kernels configured with panic_on_warn=1, this warning escalates to a full kernel panic; no public exploit identified at time of analysis, and the vulnerability was discovered by Google's syzbot kernel fuzzer with EPSS at the 5th percentile.
Core dump handling in the Linux kernel's RISC-V ptrace subsystem emits a kernel warning and disrupts crash reporting due to REGSET_CFI missing USER_REGSET_NOTE_TYPE. Affected kernels (7.0 through pre-patch 7.1 on RISC-V) trigger the warning at fs/binfmt_elf.c:1771 whenever a process core dumps with CFI register state present. Any low-privileged local user on a RISC-V host can trigger this condition; no public exploit exists and EPSS sits at 0.14%, indicating no practical threat beyond the operational disruption of broken core dumps.
NULL pointer dereference in the Linux kernel's ASoC wm_adsp driver crashes the kernel when firmware controls are removed without a prior NULL check on private control data. Systems running affected kernel versions (5.16 through multiple stable branches) with Wolfson/Cirrus Logic ADSP hardware are exposed to local denial-of-service via kernel panic. No active exploitation has been identified, EPSS sits at 0.16% (6th percentile), and patches have been backported to all active stable branches.
Dangling function pointer in the Linux kernel's netfilter connection tracking subsystem (nf_conntrack) causes a kernel oops when a NAT helper module is unloaded while live expectations referencing its text remain in the expectation table. Specifically, NAT helpers such as nf_nat_h323 store raw pointers to module code in exp->expectfn; nf_ct_helper_expectfn_unregister() unlinks the callback descriptor without purging matching expectations, so when the expected connection subsequently arrives, init_conntrack() dereferences freed module text and crashes the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), consistent with the local, high-privilege exploitation path required.
NULL pointer dereference in the Linux kernel's ASoC SDCA (SoundWire Device Class for Audio) subsystem crashes the kernel during audio device cleanup, resulting in a denial of service. The `sdca_dev_unregister_functions()` routine iterates over SDCA function descriptors without validating for NULL entries, which can be present when function registration fails partway through or when device cleanup races with probe deferral. This crash was observed in practice on Lenovo ThinkPad X1 Carbon G14 (Panther Lake) systems where missing SOF firmware caused the SOF audio driver probe to fail, triggering the NULL dereference during subsequent SoundWire device teardown. No public exploit exists and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific and locally-triggered nature of this flaw.
Kernel panic in the Linux drm/virtio subsystem occurs during virtio-gpu driver removal or device unbinding when the kernel is compiled with KMS disabled, leaving DRM atomic and modesetting structures uninitialized. Teardown code unconditionally accesses these uninitialized structures (CWE-908), crashing the host kernel and causing a denial of service in virtualized guest environments. EPSS is 0.16% (5th percentile) and no public exploit or KEV listing exists, limiting practical risk to non-default kernel build configurations.
Memory leak in the Linux kernel KVM subsystem exposes x86 SEV-ES (Secure Encrypted Virtualization-Encrypted State) guest environments to resource exhaustion when userspace terminates a VM without calling KVM_RUN after a VM-Exit. KVM retains writable page mappings across exits to userspace for certain SEV-ES VM-Exits, and when vCPU destruction must release these mappings, the kernel incorrectly emits a WARN about dirtying memory without a running vCPU - masking the real defect and complicating the fix. No public exploit exists and EPSS is 0.16% (5th percentile), placing this firmly as a low-exploitation-probability availability defect; patches are confirmed across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel's pinctrl mcp23s08 driver (MCP23S08 SPI GPIO expander) crashes the kernel during device probe on systems where mcp->dev and mcp->addr are accessed before initialization. Affected kernels include Linux 6.19 through the fix commits in stable series 7.0.13 and 7.1. A local attacker with low privileges on a system hosting MCP23S08 SPI hardware can trigger a kernel panic (denial of service) by causing driver probe to execute. No active exploitation confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific nature of the exposure.
CVE-2026-53343 causes a deterministic boot-time kernel panic on ARMv5-class Linux systems (ARM926/VersatilePB) with KASAN VMAP stack instrumentation enabled. A word-sized `ldr` instruction introduced by commit 44e9a3bb76e5 accesses byte-granular KASAN shadow memory without guaranteed word alignment; ARMv5 strictly enforces aligned word loads and raises a data abort, crashing the kernel in __switch_to() before init is reached. No public exploit code exists and EPSS is 0.16% (6th percentile), consistent with the extremely narrow hardware and configuration footprint required.
Missing pagetable destructor calls in the ARM64 memory management subsystem cause kernel instability and resource leaks during memory hot-remove operations. Since commit 5e8eb9aeeda3, ARM64 page-table allocation unconditionally invokes pagetable_{pte,pmd,pud,p4d}_ctor(), but the matching pagetable_dtor() teardown was never added to the hot-remove path (free_hotplug_pgtable_page()), leaving PGTY_table type flags set and potentially leaking PTL allocations. No public exploit has been identified and EPSS at 0.15% (5th percentile) reflects the narrow exploitation path, though availability impact on affected ARM64 systems is confirmed by kernel maintainers.
Clock and pinctrl state inconsistency in the Linux kernel's i2c-imx driver causes a system crash on NXP i.MX SoC platforms when runtime power management suspend fails mid-sequence. Specifically, if pinctrl_pm_select_sleep_state() returns an error after the I2C peripheral clock has already been disabled, the kernel leaves the clock off while aborting the suspend - any subsequent hardware access to the I2C controller then triggers a kernel panic, resulting in full system denial of service. No public exploit code exists and EPSS of 0.15% confirms negligible exploitation probability; this is a maintenance-priority patch for embedded Linux maintainers on i.MX hardware, not an enterprise emergency.
NULL pointer dereference in the Linux kernel's Qualcomm Camera Control Interface (CCI) i2c driver crashes the kernel during driver removal on boards where only one of the two available I2C masters is initialized. Triggering device unbinding or module unloading on affected Qualcomm hardware configurations causes cci_remove() to call cci_halt() for both masters, dereferencing an uninitialized completion pointer for the disabled master and producing a kernel panic. No public exploit exists and EPSS is at the 6th percentile, indicating no meaningful exploitation activity; impact is limited to availability via local denial of service on specific Qualcomm SoC configurations.
NULL pointer dereference in the Linux kernel's Airoha QDMA network driver crashes the kernel when a misconfigured Device Tree Source (DTS) causes `of_reserved_mem_lookup()` to return NULL without a guard check. Systems running the `net/airoha` driver with a DTS referencing a non-existent or removed `memory-region` node in the reserved memory table trigger a kernel panic during driver initialization at `airoha_qdma_init_hfwd_queues()`. The impact is exclusively a local denial-of-service (system crash); no confidentiality or integrity compromise is possible. No public exploit exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with the highly specific hardware and configuration prerequisites.
NULL pointer dereference in the Linux kernel bonding subsystem crashes the kernel when a local user with CAP_NET_ADMIN invokes bond_do_ioctl() with a non-existent slave interface name. The slave_dbg() macro unconditionally dereferences slave_dev->name before the NULL guard is evaluated, producing a kernel oops and local denial-of-service. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), indicating very low observed exploitation activity; patches are available across all active stable branches.
Infinite-loop hang in the Linux kernel's nvmem ONIE TLV layout driver causes a local denial-of-service when the EEPROM contains unknown or vendor-specific entry types. Affected kernels from the 6.4 series through multiple stable branches fail to advance the offset pointer when an unrecognized TLV type is encountered, leaving the parser stuck indefinitely. No public exploit or active exploitation (CISA KEV) has been identified; with an EPSS of 0.16% at the 5th percentile, real-world exploitation risk is very low and limited to systems with specific hardware configurations.
NULL pointer dereference in the Linux kernel's DAMON LRU Sort subsystem crashes the kernel when damon_ctx allocation fails under memory pressure. Affected are Linux kernel versions through 6.18 and 7.0.x before 7.0.13, where damon_lru_sort_enabled_store() omits a NULL check before passing the allocation result to damon_commit_ctx(). A local attacker with low privileges can trigger a kernel panic, causing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.17% (6th percentile), reflecting negligible observed exploitation activity.
NULL pointer dereference in the Linux kernel's DAMON_RECLAIM memory management subsystem crashes the kernel when a `damon_ctx` object allocation fails during initialization. Local users with low privileges can trigger this by enabling DAMON_RECLAIM via its sysfs interface while the system is under memory pressure, causing `damon_commit_ctx()` to dereference a NULL pointer and inducing a kernel panic. No active exploitation is identified; EPSS of 0.17% (6th percentile) and absence from CISA KEV confirm this remains a low-probability, theoretically triggerable denial-of-service condition.
Incorrect guard ordering in the Linux kernel's mincore subsystem causes spurious kernel WARN events and false non-resident page reporting on kernels compiled without CONFIG_SWAP support. Affected are Linux 6.18.x (before 6.18.36) and 7.x (before 7.0.13/7.1) builds where CONFIG_SWAP is disabled but CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is enabled - a configuration typical of embedded or specialized deployments. With EPSS at 0.15% (5th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to niche build environments.
Kernel crash in the Linux slimbus qcom-ngd-ctrl driver affects Qualcomm SoC-based systems from kernel 4.19 onward due to a race condition where SSR and PDR callbacks are registered before the NGD platform device is fully initialized. When the remoteproc subsystem starts concurrently with NGD driver probe - or is already running at PDR lookup registration time - callbacks fire on uninitialized kernel memory, producing a NULL pointer dereference in qcom_slim_ngd_ssr_pdr_notify() and crashing the kernel. No public exploit exists and EPSS is 0.17% (6th percentile); this vulnerability is not in CISA KEV.
Deadlock vulnerability in the Linux kernel's Qualcomm SLIMbus NGD controller driver (slimbus/qcom-ngd-ctrl) causes complete system availability loss through an ABBA lock-ordering inversion between tx_lock and ctrl->lock. Systems running affected kernel versions on Qualcomm SLIMbus-equipped hardware are vulnerable to kernel hangs when SSR/PDR (Subsystem Restart/Process Domain Restart) events race with ongoing DMA TX transactions. EPSS is 0.17% (7th percentile), no public exploit has been identified, and this vulnerability is not listed in CISA KEV.
Spurious WARN_ON in the Linux kernel's sched_ext cgroup migration path can trigger a kernel warning - and potentially a system panic when CONFIG_PANIC_ON_WARN is set - when systemd's user manager writes '+cpu +memory +pids' to its own subtree_control while a sched_ext BPF scheduler is loaded. The root cause is a mismatch between cgroup identity (used by scx_cgroup_can_attach) and CSS identity (used to drive migration), allowing scx_cgroup_move_task() to run against a task whose cgrp_moving_from was never initialized. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) confirms negligible exploitation interest.
Denial of service in the Linux kernel's debugobjects subsystem affects RT-enabled (PREEMPT_RT) kernel builds when fill_pool() is called while a task already has pi_blocked_on set. On real-time kernels, fill_pool() invokes rtlock_lock(), which triggers a kernel assertion failure because the priority inheritance chain cannot branch - a task can only be blocked on one lock simultaneously. Exploitation is local-only, requires low privilege, and is constrained to RT kernel configurations; no public exploit exists and EPSS is 0.17% (6th percentile). Notably, the 'Information Disclosure' tag associated with this CVE is inconsistent with the technical description, which describes a kernel assertion crash - a denial-of-service condition.
Deadlock in the Linux kernel debugobjects subsystem on ARM64 PREEMPT_RT debug builds causes system availability loss during early boot. During the early boot window between interrupt enablement and scheduler activation (before SYSTEM_SCHEDULING is set), a hardware interrupt can fire and attempt to call fill_pool() in hard interrupt context, deadlocking if the interrupted boot path already holds a lock required by the allocation path. CVSS rates this Medium (5.5) with local access and availability-only impact; EPSS at 0.17% (6th percentile) confirms minimal exploitation interest, and no public exploit or CISA KEV listing exists at time of analysis.
Session identifier generation in CGI::Session::ID::md5 versions prior to 4.49 for Perl is cryptographically weak, enabling remote attackers with sufficient effort to predict valid session tokens and impersonate authenticated users. The generate_id method combines three deterministic or low-entropy sources - process ID, Unix epoch timestamp, and Perl's non-cryptographic rand() - before hashing with MD5, leaving the session ID space practically enumerable given approximate knowledge of server state. No public exploit has been identified at time of analysis; SSVC assigns Exploitation: none and EPSS places this at the 8th percentile, indicating low real-world exploitation probability despite the C:H confidentiality impact.
HTML injection via Matrix and XMPP chat in Mozilla Thunderbird allows remote network-accessible attackers to inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI without any authentication. All Thunderbird versions prior to 152.0.1 and 140.12.1 ESR are affected. No public exploit has been identified and EPSS sits at 0.14% (4th percentile), but SSVC flags the attack as automatable with partial technical impact, making it a realistic phishing and UI-deception vehicle for anyone reachable via federated Matrix or XMPP.
Memory exhaustion denial-of-service in Mozilla Thunderbird's LDAP address-book autocomplete client allows a malicious or compromised LDAP server to crash the application by returning unbounded data payloads. Affected users are those explicitly configured to query an LDAP directory server for autocomplete, making this a targeted rather than opportunistic attack. No public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) alongside a CISA SSVC exploitation rating of 'none' confirms very low real-world urgency.
Remote code execution risk in c3p0 versions prior to 0.14.0 arises from the library serving as an essential 'sink' in Java deserialization gadget chains. c3p0's DataSource and ConnectionPoolDataSource objects conform to JavaBean's getXXX() naming convention, causing commons-beanutils and similar libraries to invoke JDBC connection methods as though they were safe property accessors during deserialization - triggering arbitrary JDBC driver execution under attacker control. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 vector scores this at 6.3, largely due to the partial attack requirements (AT:P), though real-world impact when prerequisites are met can substantially exceed that rating.
Same-origin policy bypass in Google Chrome's StorageAccessAPI allows an attacker who has already compromised the Chrome renderer process to further escalate access via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The integrity impact is rated High (I:H) in the CVSS vector, meaning cross-origin data writes or manipulations become possible, but only as a second-stage component in a chained exploit. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none with partial technical impact - consistent with the renderer pre-compromise prerequisite that substantially limits standalone risk.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 exposes sensitive user data from other origins when a victim visits a specially crafted HTML page that exploits insufficient policy enforcement in the StorageAccessAPI. The API, designed to manage third-party storage access in privacy-restricting browser contexts, fails to enforce cross-origin boundaries correctly, allowing an attacker to read data belonging to unrelated origins. No active exploitation has been confirmed - CVE is absent from CISA KEV, EPSS rates exploitation likelihood at 0.17% (7th percentile), and SSVC classifies exploitation status as none - though the CVSS confidentiality impact is rated High.
UI spoofing in Google Chrome's DevTools component allows an attacker to misrepresent critical interface information to users who have been socially engineered into installing a malicious Chrome Extension. Affected versions are all Chrome releases prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-451) in DevTools, enabling an extension to manipulate how DevTools renders UI elements - potentially deceiving developers or power users into trusting falsified debugging output or security indicators. No public exploit code has been identified at time of analysis, and this vulnerability is not in the CISA KEV catalog.
UI spoofing in the Glic component of Google Chrome (all versions prior to 150.0.7871.47) enables a remote attacker to misrepresent browser interface elements via a crafted HTML page, provided the victim is socially engineered into performing specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns high confidentiality impact, suggesting the spoofed UI can be leveraged to elicit disclosure of sensitive information such as credentials or session data. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
UI spoofing via the Speech component in Google Chrome prior to 150.0.7871.47 requires an attacker to have already compromised the renderer process, making this a chained, second-stage exploit rather than a standalone remote attack. The vulnerability stems from insufficient input validation (CWE-20) in Chrome's Speech subsystem, enabling a renderer-compromised attacker to manipulate browser UI elements through a crafted HTML page. No public exploit code exists, SSVC assessment confirms no active exploitation, and an EPSS score of 0.17% (7th percentile) reflects a very low probability of mass exploitation - consistent with Google's own 'Low' internal severity rating.
Type confusion in the CSS processing engine of Google Chrome prior to 150.0.7871.47 enables remote attackers to read potentially sensitive data from renderer process memory by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no attacker privileges required, though a single user interaction - visiting the malicious page - is necessary. No public exploit code has been identified, CISA SSVC rates exploitation as none at time of analysis, and Chromium's own team classified severity as Low, suggesting limited practical memory disclosure value despite the NVD CVSS C:H rating.
Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 150.0.7871.47 allows remote attackers to inject arbitrary scripts or HTML across origin boundaries by exploiting an inappropriate implementation in Chrome's CSS engine via a crafted HTML page. Unlike application-level XSS, this browser-level flaw bypasses same-origin protections, meaning injected scripts can execute in the context of any open origin. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a patch-promptly, not emergency-response, priority.
Cross-origin data leak in Google Chrome's CSS implementation (versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive data from other origins when a victim visits a specially crafted HTML page. The vulnerability stems from inappropriate CSS handling that creates a side-channel bypassing same-origin policy protections, resulting in high-confidentiality-impact information disclosure with no integrity or availability consequences. No public exploit has been identified and exploitation has not been observed in the wild; CISA SSVC rates exploitation as none and technical impact as partial, aligning with Google's internal Low severity classification despite the NVD CVSS 6.5 score.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML by luring a user to a crafted web page, with the scope change (S:C) in the CVSS vector indicating potential Same-Origin Policy bypass affecting other loaded origins. No public exploit or active exploitation is identified at time of analysis - EPSS sits at 0.17% (6th percentile) and SSVC exploitation status is rated 'none.' A vendor-released patch is available in stable channel 150.0.7871.47.
UI spoofing in Google Chrome's Views component (versions prior to 150.0.7871.47) allows a remote attacker to misrepresent security-critical browser interface elements through a crafted HTML page. Exploitation requires convincing a target user to perform specific UI gestures, making the attack conditional on social engineering. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; Google has released a patch as part of the stable channel update.
UI spoofing in Google Chrome's Passwords feature on iOS (versions prior to 150.0.7871.47) enables remote attackers to manipulate the presentation of security-critical password UI elements via a specially crafted HTML page. Users who visit a malicious page in Chrome on iOS may see misleading security indicators or spoofed password dialogs, potentially deceiving them into unintended credential interactions. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and SSVC confirms no observed exploitation - risk is real but low-priority relative to the broader threat landscape.
UI spoofing in Google Chrome's Extensions implementation (all versions prior to 150.0.7871.47) enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to render deceptive UI elements through a crafted HTML page, potentially misleading users into unintended interactions. The vulnerability carries a CVSS 5.4 Medium score, though Chromium's internal rating is Low, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation probability. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Domain spoofing via incorrect security UI in Google Chrome's Document Picture-in-Picture feature on Android (prior to 150.0.7871.47) allows a remote attacker to deceive users about the origin of displayed content. By serving a crafted HTML page, an attacker can cause Chrome on Android to render a misleading security UI - misrepresenting the domain shown to the user. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none, making this a low operational priority despite its network-accessible attack vector.
UI spoofing in Google Chrome for Android prior to 150.0.7871.47 enables remote unauthenticated attackers to deceive users about page origin or content through insufficient validation of untrusted input in the browser's Input component. Exploitation requires user interaction - a victim must visit a crafted HTML page - and produces only limited integrity impact (visual deception), with no code execution or data exfiltration capability. No public exploit identified at time of analysis; EPSS sits at 0.18% (8th percentile) and CISA SSVC confirms zero observed exploitation, consistent with Google's own 'Low' severity classification for this Chromium issue.
UI spoofing in Google Chrome's TabStrip component prior to version 150.0.7871.47 allows a remote attacker to misrepresent tab or page identity through a crafted HTML page, contingent on convincing the victim to perform specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) places real-world risk in the lower tier: high attack complexity, mandatory user interaction, and no confidentiality impact combine to limit practical exploitation. No public exploit code exists and CISA has not added this to the KEV catalog, consistent with Google's own Low severity classification.
UI spoofing in Google Chrome's WebAppInstalls component on Windows (versions prior to 150.0.7871.47) enables a remote attacker to misrepresent the browser interface by luring a user into performing specific UI interaction gestures on a crafted HTML page. The flaw is Windows-platform-specific and rooted in an inappropriate implementation of the Progressive Web App installation UI flow. Google rates this Low severity; no public exploit identified at time of analysis, and EPSS data is not present in the provided intelligence, but the CVSS 4.2 score and required high-complexity user interaction significantly limit real-world risk.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to manipulate browser interface elements via a crafted HTML page, provided the attacker can lure the victim into performing specific UI gestures. The root cause is insufficient validation of untrusted HTML input (CWE-20) within Chrome's iOS-specific rendering layer, resulting in low-integrity and low-availability impact. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog; Chromium's own severity classification is Low.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent browser interface elements by delivering a crafted HTML page to a victim who visits it. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw arises from insufficient validation of untrusted HTML input in the iOS-specific Chrome rendering pipeline, enabling manipulation of trust signals such as address bar display or security indicators. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation: none confirm negligible current threat actor interest.
UI spoofing in Google Chrome's Network component (versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, allowing browser UI elements to be faked via a crafted HTML page. This is a chained exploit - not a standalone flaw - requiring both prior renderer compromise and user interaction, which significantly constrains real-world risk. No public exploit code exists and no confirmed active exploitation has been recorded; EPSS at 0.18% (8th percentile) and Chromium's own 'Low' severity rating reinforce this assessment.
UI spoofing via Google Chrome's Autofill implementation on Android (prior to 150.0.7871.47) allows remote unauthenticated attackers to misrepresent interface elements through a crafted HTML page, potentially deceiving users into disclosing sensitive input or taking unintended actions. The vulnerability is platform-specific to Android and carries a Chromium-internal severity of Low, consistent with its limited integrity-only impact and requirement for user interaction. No public exploit code or active exploitation has been identified at time of analysis, and EPSS probability sits at 0.17% (7th percentile), confirming minimal real-world threat pressure.
UI spoofing via race condition in Google Chrome's History Embeddings component (versions prior to 150.0.7871.47) enables remote attackers to present falsified browser interface elements to users through a crafted HTML page. The flaw requires both high attack complexity - a precisely timed race window - and victim interaction, yielding only limited confidentiality and integrity impact with no code execution capability. No public exploit or active exploitation has been identified; EPSS at 0.14% (4th percentile) and SSVC exploitation status of 'none' confirm extremely low real-world exploitation probability at time of analysis.
UI spoofing in Google Chrome's WebXR component (all versions prior to 150.0.7871.47) allows remote attackers to misrepresent browser interface elements when a victim visits a crafted HTML page. The flaw stems from an inappropriate implementation in the WebXR Device API, enabling manipulation of what the user perceives as trusted UI - potentially obscuring origin indicators, security state, or page identity. No public exploit code exists and EPSS stands at 0.18% (8th percentile); CISA SSVC rates exploitation as none with partial technical impact, placing this firmly in the lower-priority tier despite its network-accessible vector.
UI spoofing in Google Chrome's WebAppInstalls component (prior to 150.0.7871.47) is reachable only after an attacker has already compromised the Chrome renderer process, making this a chained, post-exploitation capability rather than a standalone entry point. With a compromised renderer, the attacker can serve a crafted HTML page that bypasses insufficient input validation in WebAppInstalls to forge Chrome's native UI - potentially deceiving users into trusting malicious web app install prompts or dialogs. No public exploit or active exploitation (CISA KEV) is confirmed; EPSS sits at 0.18% (8th percentile), consistent with the high prerequisite barrier and Chromium's own 'Low' severity rating.
UI spoofing in Google Chrome's Omnibox (address bar) prior to version 150.0.7871.47 allows a remote attacker to misrepresent origin or security indicators to a victim via a crafted HTML page. Rooted in CWE-451 (misrepresentation of critical security information), the flaw can enable phishing or origin-confusion attacks by deceiving users into trusting a false domain indicator. No public exploit code exists, CISA SSVC rates exploitation as none, and the EPSS score of 0.18% (8th percentile) confirms this is low-priority outside phishing-sensitive deployments.
UI spoofing in Google Chrome for Android (prior to 150.0.7871.47) via the PreviewTab feature allows remote attackers to misrepresent interface elements through a crafted HTML page. Successful exploitation requires high attack complexity - specifically, the attacker must convince a victim to perform particular UI gestures - limiting this to targeted rather than opportunistic attacks. No active exploitation or public proof-of-concept has been identified; the Chromium security team rates this as Low severity, consistent with its constrained CVSS 4.2 score.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to display false URL content in the browser's address bar by luring a user to a crafted HTML page, creating a credible phishing vector. The flaw stems from inappropriate implementation in the iOS-specific Omnibox rendering logic (CWE-451), distinct from Chrome's desktop codebase. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible opportunistic exploitation probability at this time.
UI spoofing in Google Chrome's Printing subsystem (all versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, enabling misrepresentation of critical browser UI via a crafted HTML page. This is a post-exploitation primitive rather than an initial-access vector - the renderer must be independently compromised before this flaw is reachable. No public exploit code exists and CISA SSVC rates exploitation as none, consistent with the low EPSS score of 0.18% (8th percentile), placing real-world urgency squarely in routine maintenance rather than emergency response.
Domain spoofing in Google Chrome for Android (versions prior to 150.0.7871.47) allows remote attackers to deceive users about the origin of a webpage by exploiting incorrect rendering of security-critical UI elements via a crafted HTML page. User interaction is required - the victim must navigate to the attacker-controlled page - and impact is limited to integrity (UI misrepresentation), with no direct confidentiality or availability consequences. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.17% at the 7th percentile reflects minimal real-world exploitation activity; Google itself rates this 'Low' severity.
Uninitialized memory use in Chrome's ANGLE graphics layer exposes potentially sensitive process memory contents to remote attackers who can entice a user to visit a crafted HTML page. The flaw affects all Chrome versions prior to 150.0.7871.47, with High confidentiality impact per CVSS despite Google's own Chromium severity rating of Low - a discrepancy suggesting practical extraction of meaningful data is constrained in real-world conditions. No public exploit identified at time of analysis, and no CISA KEV listing; a vendor patch has been released.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to display a fraudulent URL in the browser's address bar by delivering a crafted HTML page. The root cause is classified as CWE-451 (UI Misrepresentation of Critical Information), meaning the security UI fails to accurately reflect the true origin of displayed content - a condition that directly undermines phishing defenses. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates very low observed exploitation pressure, consistent with the Chromium team's own 'Low' severity rating.
Type confusion in Chrome's Bluetooth stack on Windows (versions prior to 150.0.7871.47) enables an adjacent-network attacker to exfiltrate sensitive data from Chrome process memory by presenting a malicious Bluetooth peripheral. The CVSS 6.5 score reflects high confidentiality impact but no integrity or availability exposure; notably, Chromium's internal security team rated this Low severity, suggesting the memory regions accessible are constrained. No public exploit code and no CISA KEV listing exist at time of analysis, and exploitation is physically bounded by Bluetooth range.
Cross-origin data leak in Google Chrome DevTools prior to version 150.0.7871.47 exposes sensitive information from foreign origins when a victim visits a crafted HTML page and performs attacker-directed UI gestures. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability consequences. No public exploit identified at time of analysis, and EPSS of 0.18% at the 8th percentile - combined with Chromium's own 'Low' severity classification - signals limited real-world exploitation likelihood despite the Medium NVD score.
Memory disclosure via DevTools in Google Chrome on Windows (prior to 150.0.7871.47) enables a remote attacker to read sensitive process memory contents by delivering a crafted HTML page and manipulating the victim into performing specific UI gestures. The vulnerability is Windows-platform-exclusive and carries a Chromium-internal severity of Low, consistent with SSVC's assessment of no current exploitation and non-automatable delivery. No active exploitation or public exploit code has been identified at time of analysis, though the CVSS C:H rating reflects meaningful confidentiality risk if successfully triggered.
Uninitialized memory use in Dawn, Chrome's WebGPU implementation, on ChromeOS prior to version 150.0.7871.46 enables remote attackers to read potentially sensitive contents from GPU process memory by serving a crafted HTML page. The flaw (CWE-457) allows stale or uninitialized buffer data to be exposed back to the requesting JavaScript context without proper sanitization. No public exploit has been identified at time of analysis, and CISA SSVC rates this as non-automatable with partial technical impact, though the CVSS confidentiality rating is High.
Cross-origin data leakage in Google Chrome's ANGLE graphics subsystem (all versions prior to 150.0.7871.46) enables remote attackers to read sensitive data from other browser origins by luring a victim to a crafted HTML page. The flaw stems from uninitialized memory use in ANGLE, Chrome's GPU abstraction layer, which may expose stale cross-origin pixel buffers or texture memory to attacker-controlled JavaScript. No public exploit has been identified and CISA's SSVC framework rates exploitation as none with a non-automatable attack path, indicating limited immediate real-world threat despite the network-accessible vector.
Uninitialized memory read in ANGLE - Chrome's graphics abstraction layer - exposes potentially sensitive process memory to remote attackers on Windows systems running Chrome prior to 150.0.7871.46. Exploitation requires the victim to visit a crafted HTML page, after which the ANGLE Direct3D translation path leaks heap or stack contents that may include session tokens, cached credentials, or other browser-resident data. No active exploitation has been confirmed (absent from CISA KEV), and EPSS of 0.20% at the 10th percentile reflects very low current exploitation activity despite the CVSS C:H rating.
Out-of-bounds read in Chrome's V8 JavaScript engine allows a memory disclosure attack against users running Google Chrome prior to 150.0.7871.46. An attacker who socially engineers a victim into installing a crafted malicious extension can trigger the OOB read to leak sensitive data from the renderer process memory, such as tokens or session material. No public exploit code has been identified and SSVC classifies exploitation as none, but the high confidentiality impact and Chrome's global install base make patching the appropriate near-term action.
Out-of-bounds read in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome prior to 150.0.7871.46 exposes process memory to remote attackers via a crafted HTML page. An unauthenticated remote attacker can cause a victim's browser to disclose potentially sensitive process memory - such as cached credentials or heap artifacts - with no integrity or availability impact. No public exploit code has been identified and CISA has not added this to the KEV catalog; EPSS at 0.23% (14th percentile) confirms low near-term exploitation probability.
Out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction layer) prior to version 150.0.7871.46 allows a remote attacker to extract potentially sensitive data from the browser's process memory by directing a victim to a crafted HTML page. The CVSS vector confirms network delivery with no authentication required but mandates user interaction, and the High confidentiality impact (C:H) indicates that in-memory data such as session tokens, cached credentials, or page content could be exposed. SSVC assessment records no active exploitation and the flaw is absent from the CISA KEV catalog; a vendor patch has been released and no public exploit code has been identified at time of analysis.
Cross-origin data exfiltration in Google Chrome's ANGLE graphics layer exposes sensitive browser memory contents to remote attackers who can induce a victim to visit a crafted HTML page. The out-of-bounds read in ANGLE (Chrome's cross-platform graphics abstraction engine) affects all Chrome desktop versions prior to 150.0.7871.46, confirmed by Google's stable channel advisory. No public exploit code or active exploitation has been identified at time of analysis; an EPSS of 0.17% (7th percentile) reflects minimal current weaponization pressure despite the high confidentiality impact assigned in CVSS.
Cross-origin data leakage in Google Chrome on Windows prior to 150.0.7871.46 stems from an out-of-bounds read in ANGLE, the browser's graphics abstraction layer. Remote attackers can exploit this by serving a crafted HTML page to a Windows user, causing the ANGLE subsystem to read memory beyond its intended buffer boundary and exposing data belonging to a separate web origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates low exploitation probability in the near term.
Integer overflow in Chrome's ANGLE graphics abstraction layer on Windows enables a remote attacker, who has already compromised the renderer process, to read potentially sensitive data from process memory. The attack requires a user to visit a crafted HTML page, making this a second-stage component in a multi-step exploit chain rather than a standalone critical flaw. No public exploit code has been identified and CISA has not added this to the KEV catalog; Chrome 150.0.7871.46 resolves the issue.
Insufficient input validation in Skia, Chrome's 2D graphics library, exposes process memory to an attacker who has already achieved renderer process compromise. Affected versions of Chrome prior to 150.0.7871.46 can leak potentially sensitive in-memory data when the victim visits a crafted HTML page. No public exploit code exists and no active exploitation is confirmed - EPSS at 0.22% (12th percentile) and SSVC Exploitation: none corroborate low near-term risk despite the High confidentiality impact rating.
UI spoofing in Google Chrome's WebAppInstalls component (versions prior to 150.0.7871.46) enables remote attackers to misrepresent security indicators during Progressive Web App installation prompts via a crafted HTML page. The incorrect security UI (CWE-451) can deceive users into believing they are installing a legitimate, trusted application when they are not, resulting in a low-integrity impact. EPSS is 0.18% (8th percentile), no public exploit code exists, and this vulnerability has not been added to CISA KEV, indicating minimal active exploitation risk at time of analysis.
UI spoofing in Google Chrome's Skia graphics engine (versions prior to 150.0.7871.46) allows a remote attacker who has already compromised the renderer process to mislead users through a crafted HTML page. The attack requires renderer process compromise as a prerequisite, making this a chained exploit component rather than a standalone threat. EPSS at 0.18% (8th percentile) and absence from CISA KEV confirm no known active exploitation; Chromium's own team rated this Low severity.
UI spoofing via a crafted PDF file in Google Chrome's PDFium rendering engine allows a remote, unauthenticated attacker to visually mislead users into performing unintended actions or trusting falsified content. All Chrome versions prior to 150.0.7871.46 are affected. Exploitation requires the victim to open a malicious PDF - no special configuration is needed beyond default Chrome behavior. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none with partial technical impact.
Symlink traversal in oras-go's file content store allows writes outside the intended `workingDir` boundary even when `AllowPathTraversalOnWrite=false`. Applications that pull OCI artifacts from untrusted registries where an attacker controls blob titles (`ocispec.AnnotationTitle`) are at risk if any directory component under `workingDir` is a symlink pointing to an external path. No confirmed active exploitation (not in CISA KEV), but a self-contained proof-of-concept was included in the researcher's disclosure, making reproduction straightforward given the prerequisites.
Timestamp forgery in sigstore-js allows an attacker supplying a crafted bundle v0.2 to manipulate certificate validity window checks by controlling the `integratedTime` field in an inclusionProof-only tlog entry. Because the inclusionProof-only code path in `@sigstore/verify` does not cryptographically bind `integratedTime` (unlike the signed inclusionPromise/set path), a low-privileged attacker who can present an untrusted bundle can cause the verifier to accept expired or not-yet-valid signing certificates as currently valid. A publicly available proof-of-concept exists; this vulnerability is not in CISA KEV.
SQL injection in the Wikimedia Foundation's MediaWiki Cargo Extension exposes wiki deployments to unauthenticated database read and write operations across all versions prior to 1.43.9, 1.44.6, and 1.45.4. The Cargo extension's core function - accepting user-supplied query parameters to construct database queries - makes this a structurally sensitive attack surface, as improper neutralization of SQL special elements allows crafted input to escape intended query boundaries. No public exploit code has been identified at time of analysis, and CISA KEV listing is absent, but the PR:N/AC:L/AT:N CVSS 4.0 vector confirms exploitation requires no authentication or special preconditions against default-accessible Cargo query endpoints.
Heap buffer over-write in ImageMagick's JP2 (JPEG 2000) encoder - present in all versions prior to 7.1.2-26 - allows an attacker to crash the process by supplying a maliciously crafted JP2 image file, resulting in a denial-of-service condition. The root cause is CWE-682 (Incorrect Calculation): argument handling logic in the JP2 encoder computes incorrect bounds, leading to an out-of-bounds heap write. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Uncontrolled resource consumption in ImageMagick (all versions prior to 6.9.13-51 and 7.1.2-26) allows a denial-of-service condition by supplying invalid arguments to the connected-components processing option, which causes an infinite loop that exhausts CPU resources indefinitely. The vulnerability requires local access, user interaction, and high attack complexity, confining realistic risk to environments where untrusted input can influence ImageMagick invocations - such as automated image-processing pipelines or web applications that expose connected-components functionality. Vendor-released patches exist for both the 6.x and 7.x branches; no public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Stack overflow in ImageMagick's MVG decoder prior to versions 6.9.13-51 and 7.1.2-26 allows remote unauthenticated attackers to crash image-processing services by submitting a crafted MVG image file. The root cause is a missing depth check in the MVG decoder (CWE-400), enabling unbounded recursion that exhausts stack memory. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis, but the zero-friction attack surface - any application accepting image uploads with unpatched ImageMagick - makes patching a practical priority.
Heap buffer overflow in ImageMagick's MVG decoder allows remote unauthenticated attackers to trigger an out-of-bounds write by supplying a specially crafted image file, resulting in denial of service. Affected are all ImageMagick deployments prior to versions 6.9.13-51 (legacy v6 branch) and 7.1.2-26 (current v7 branch). No public exploit code or active exploitation has been identified at time of analysis; however, the network-accessible vector and zero-privilege requirement make this relevant for any service that accepts and processes user-supplied images.
Use-after-free in ImageMagick's 8BIM profile parser crashes the process when a specially crafted image is identified, affecting all releases prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch). The vulnerability is triggered by a specific format string embedded in the 8BIM metadata profile, causing memory corruption that results in a denial-of-service condition. No public exploit or CISA KEV listing has been identified at time of analysis; EPSS data was not provided in the intelligence feed.
Heap memory disclosure in ImageMagick's MNG decoder affects all versions prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch), allowing remote unauthenticated attackers to obtain partial heap contents by submitting a crafted MNG image file and retrieving the processed output. The root cause (CWE-908) is that pixel buffers are not fully initialized before output is written, leaving residual in-process heap data embedded in the resulting image. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication, network-accessible attack vector makes this a meaningful risk for any image-processing pipeline that accepts untrusted MNG input.
Credential exposure in AWS CLI on Unix-like systems allows other local users on the same host to read sensitive credentials written to disk by three specific subcommands: aws codeartifact login, aws iam create-virtual-mfa-device, and aws deploy register. When the system umask is at its default permissive value - the case on most Unix-like systems - credential files are written without adequately restrictive permissions, making them readable by other local accounts. No public exploit or CISA KEV listing exists at time of analysis; however, the vendor (Amazon) has confirmed the issue and released patched versions 1.44.78 (v1) and 2.34.29 (v2).
Authentication bypass in the Wikimedia Foundation's WikiLambda extension for MediaWiki allows unauthenticated remote attackers to circumvent access controls via improper neutralization of input terminator characters (CWE-288). Affected are all WikiLambda deployments running versions prior to 1.43.9, 1.44.6, and 1.45.4 across the supported MediaWiki release branches. No public exploit or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-prerequisite attack vector warrants prompt patching.
Integer overflow in ImageMagick's XCF (GIMP native format) decoder allows remote unauthenticated attackers to trigger an out-of-bounds read by supplying a crafted XCF image file, resulting in an application crash or limited memory disclosure. All ImageMagick releases prior to 6.9.13-51 (legacy branch) and 7.1.2-26 (current branch) are affected. No public exploit code or active exploitation has been identified at time of analysis, but the zero-complexity, pre-authentication attack surface makes this a meaningful risk for any internet-facing service that processes user-supplied images via ImageMagick.
Arbitrary HDF5 file read in Keras up to 3.13.2 enables information disclosure when a victim loads a crafted model file, representing an incomplete patch for the prior CVE-2026-1669. The flaw lies in two specific code paths - `H5IOStore._verify_dataset()` and `file_editor.py` - which omit the `dataset.is_virtual` check, allowing a malicious HDF5 Virtual Dataset (VDS) to silently redirect reads to attacker-specified paths on the local filesystem. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog, but the attack surface is realistic in ML supply chain and model-sharing contexts.
Plugin directory guard bypass in HashiCorp Vault and Vault Enterprise allows a highly privileged, authenticated attacker to read files outside the intended audit plugin directory via path traversal. Exploitation requires network access, high-privilege credentials, and the use of the legacy file audit path option - a non-default configuration. Fixed versions are 2.0.1, 1.21.6, 1.20.11, and 1.19.17; no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Cross-tenant information disclosure in Foreman (packaged as Red Hat Satellite 6) allows an authenticated user holding host-edit permissions to retrieve sensitive infrastructure metadata from organizations and locations they are not authorized to access. The root cause is the taxonomy_scope controller method accepting organization and location IDs from nested request parameters without validating them against the caller's authorized tenancy scope, implementing a textbook CWE-639 authorization bypass through user-controlled key. No active exploitation has been confirmed (not listed in CISA KEV), and no public exploit code is identified at time of analysis; however, the low attack complexity and lack of user interaction make this straightforward to exploit for any low-privileged authenticated user in multi-tenant Satellite deployments.
Broken access control in Foreman (the upstream engine of Red Hat Satellite 6) permits an authenticated user holding host-edit permissions to retarget an existing lookup value override to hosts outside their authorized organizational or location scope. The flaw stems from insufficient authorization enforcement on the match field when modified via nested host attributes, allowing an attacker to effectively write configuration overrides to managed hosts they are not permitted to administer. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Private SSH key exfiltration in Red Hat Satellite 6 (upstream: Foreman) allows authenticated users holding the 'view_keypairs' permission to bypass taxonomy scoping and retrieve private SSH keys belonging to foreign organizations by directly querying key pair IDs via the API. The flaw is an IDOR (CWE-639) at the multi-tenancy enforcement layer, meaning the isolation contract between tenant organizations is broken for any user granted that permission. No CISA KEV listing or public exploit code has been identified at time of analysis; impact is strictly confidentiality - no write or destructive capability is exposed through this path.
Race condition in the Linux kernel HSR (High-availability Seamless Redundancy) subsystem triggers a WARN_ONCE() during device teardown, potentially causing denial of service on affected systems. The flaw exists in hsr_addr_is_self() at net/hsr/hsr_framereg.c:39, where hsr->self_node is NULLed by hsr_del_self_node() before unregister_netdevice_many() completes, leaving a window for concurrent packet transmission to access a NULL pointer. On kernels configured with panic_on_warn=1, this warning escalates to a full kernel panic; no public exploit identified at time of analysis, and the vulnerability was discovered by Google's syzbot kernel fuzzer with EPSS at the 5th percentile.
Core dump handling in the Linux kernel's RISC-V ptrace subsystem emits a kernel warning and disrupts crash reporting due to REGSET_CFI missing USER_REGSET_NOTE_TYPE. Affected kernels (7.0 through pre-patch 7.1 on RISC-V) trigger the warning at fs/binfmt_elf.c:1771 whenever a process core dumps with CFI register state present. Any low-privileged local user on a RISC-V host can trigger this condition; no public exploit exists and EPSS sits at 0.14%, indicating no practical threat beyond the operational disruption of broken core dumps.
NULL pointer dereference in the Linux kernel's ASoC wm_adsp driver crashes the kernel when firmware controls are removed without a prior NULL check on private control data. Systems running affected kernel versions (5.16 through multiple stable branches) with Wolfson/Cirrus Logic ADSP hardware are exposed to local denial-of-service via kernel panic. No active exploitation has been identified, EPSS sits at 0.16% (6th percentile), and patches have been backported to all active stable branches.
Dangling function pointer in the Linux kernel's netfilter connection tracking subsystem (nf_conntrack) causes a kernel oops when a NAT helper module is unloaded while live expectations referencing its text remain in the expectation table. Specifically, NAT helpers such as nf_nat_h323 store raw pointers to module code in exp->expectfn; nf_ct_helper_expectfn_unregister() unlinks the callback descriptor without purging matching expectations, so when the expected connection subsequently arrives, init_conntrack() dereferences freed module text and crashes the kernel. No public exploit has been identified at time of analysis, and EPSS sits at 0.16% (6th percentile), consistent with the local, high-privilege exploitation path required.
NULL pointer dereference in the Linux kernel's ASoC SDCA (SoundWire Device Class for Audio) subsystem crashes the kernel during audio device cleanup, resulting in a denial of service. The `sdca_dev_unregister_functions()` routine iterates over SDCA function descriptors without validating for NULL entries, which can be present when function registration fails partway through or when device cleanup races with probe deferral. This crash was observed in practice on Lenovo ThinkPad X1 Carbon G14 (Panther Lake) systems where missing SOF firmware caused the SOF audio driver probe to fail, triggering the NULL dereference during subsequent SoundWire device teardown. No public exploit exists and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific and locally-triggered nature of this flaw.
Kernel panic in the Linux drm/virtio subsystem occurs during virtio-gpu driver removal or device unbinding when the kernel is compiled with KMS disabled, leaving DRM atomic and modesetting structures uninitialized. Teardown code unconditionally accesses these uninitialized structures (CWE-908), crashing the host kernel and causing a denial of service in virtualized guest environments. EPSS is 0.16% (5th percentile) and no public exploit or KEV listing exists, limiting practical risk to non-default kernel build configurations.
Memory leak in the Linux kernel KVM subsystem exposes x86 SEV-ES (Secure Encrypted Virtualization-Encrypted State) guest environments to resource exhaustion when userspace terminates a VM without calling KVM_RUN after a VM-Exit. KVM retains writable page mappings across exits to userspace for certain SEV-ES VM-Exits, and when vCPU destruction must release these mappings, the kernel incorrectly emits a WARN about dirtying memory without a running vCPU - masking the real defect and complicating the fix. No public exploit exists and EPSS is 0.16% (5th percentile), placing this firmly as a low-exploitation-probability availability defect; patches are confirmed across multiple stable kernel branches.
NULL pointer dereference in the Linux kernel's pinctrl mcp23s08 driver (MCP23S08 SPI GPIO expander) crashes the kernel during device probe on systems where mcp->dev and mcp->addr are accessed before initialization. Affected kernels include Linux 6.19 through the fix commits in stable series 7.0.13 and 7.1. A local attacker with low privileges on a system hosting MCP23S08 SPI hardware can trigger a kernel panic (denial of service) by causing driver probe to execute. No active exploitation confirmed (not in CISA KEV) and EPSS sits at 0.14% (4th percentile), reflecting the hardware-specific nature of the exposure.
CVE-2026-53343 causes a deterministic boot-time kernel panic on ARMv5-class Linux systems (ARM926/VersatilePB) with KASAN VMAP stack instrumentation enabled. A word-sized `ldr` instruction introduced by commit 44e9a3bb76e5 accesses byte-granular KASAN shadow memory without guaranteed word alignment; ARMv5 strictly enforces aligned word loads and raises a data abort, crashing the kernel in __switch_to() before init is reached. No public exploit code exists and EPSS is 0.16% (6th percentile), consistent with the extremely narrow hardware and configuration footprint required.
Missing pagetable destructor calls in the ARM64 memory management subsystem cause kernel instability and resource leaks during memory hot-remove operations. Since commit 5e8eb9aeeda3, ARM64 page-table allocation unconditionally invokes pagetable_{pte,pmd,pud,p4d}_ctor(), but the matching pagetable_dtor() teardown was never added to the hot-remove path (free_hotplug_pgtable_page()), leaving PGTY_table type flags set and potentially leaking PTL allocations. No public exploit has been identified and EPSS at 0.15% (5th percentile) reflects the narrow exploitation path, though availability impact on affected ARM64 systems is confirmed by kernel maintainers.
Clock and pinctrl state inconsistency in the Linux kernel's i2c-imx driver causes a system crash on NXP i.MX SoC platforms when runtime power management suspend fails mid-sequence. Specifically, if pinctrl_pm_select_sleep_state() returns an error after the I2C peripheral clock has already been disabled, the kernel leaves the clock off while aborting the suspend - any subsequent hardware access to the I2C controller then triggers a kernel panic, resulting in full system denial of service. No public exploit code exists and EPSS of 0.15% confirms negligible exploitation probability; this is a maintenance-priority patch for embedded Linux maintainers on i.MX hardware, not an enterprise emergency.
NULL pointer dereference in the Linux kernel's Qualcomm Camera Control Interface (CCI) i2c driver crashes the kernel during driver removal on boards where only one of the two available I2C masters is initialized. Triggering device unbinding or module unloading on affected Qualcomm hardware configurations causes cci_remove() to call cci_halt() for both masters, dereferencing an uninitialized completion pointer for the disabled master and producing a kernel panic. No public exploit exists and EPSS is at the 6th percentile, indicating no meaningful exploitation activity; impact is limited to availability via local denial of service on specific Qualcomm SoC configurations.
NULL pointer dereference in the Linux kernel's Airoha QDMA network driver crashes the kernel when a misconfigured Device Tree Source (DTS) causes `of_reserved_mem_lookup()` to return NULL without a guard check. Systems running the `net/airoha` driver with a DTS referencing a non-existent or removed `memory-region` node in the reserved memory table trigger a kernel panic during driver initialization at `airoha_qdma_init_hfwd_queues()`. The impact is exclusively a local denial-of-service (system crash); no confidentiality or integrity compromise is possible. No public exploit exists and EPSS places exploitation probability at 0.15% (5th percentile), consistent with the highly specific hardware and configuration prerequisites.
NULL pointer dereference in the Linux kernel bonding subsystem crashes the kernel when a local user with CAP_NET_ADMIN invokes bond_do_ioctl() with a non-existent slave interface name. The slave_dbg() macro unconditionally dereferences slave_dev->name before the NULL guard is evaluated, producing a kernel oops and local denial-of-service. No public exploit has been identified and EPSS sits at 0.16% (6th percentile), indicating very low observed exploitation activity; patches are available across all active stable branches.
Infinite-loop hang in the Linux kernel's nvmem ONIE TLV layout driver causes a local denial-of-service when the EEPROM contains unknown or vendor-specific entry types. Affected kernels from the 6.4 series through multiple stable branches fail to advance the offset pointer when an unrecognized TLV type is encountered, leaving the parser stuck indefinitely. No public exploit or active exploitation (CISA KEV) has been identified; with an EPSS of 0.16% at the 5th percentile, real-world exploitation risk is very low and limited to systems with specific hardware configurations.
NULL pointer dereference in the Linux kernel's DAMON LRU Sort subsystem crashes the kernel when damon_ctx allocation fails under memory pressure. Affected are Linux kernel versions through 6.18 and 7.0.x before 7.0.13, where damon_lru_sort_enabled_store() omits a NULL check before passing the allocation result to damon_commit_ctx(). A local attacker with low privileges can trigger a kernel panic, causing a denial of service. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.17% (6th percentile), reflecting negligible observed exploitation activity.
NULL pointer dereference in the Linux kernel's DAMON_RECLAIM memory management subsystem crashes the kernel when a `damon_ctx` object allocation fails during initialization. Local users with low privileges can trigger this by enabling DAMON_RECLAIM via its sysfs interface while the system is under memory pressure, causing `damon_commit_ctx()` to dereference a NULL pointer and inducing a kernel panic. No active exploitation is identified; EPSS of 0.17% (6th percentile) and absence from CISA KEV confirm this remains a low-probability, theoretically triggerable denial-of-service condition.
Incorrect guard ordering in the Linux kernel's mincore subsystem causes spurious kernel WARN events and false non-resident page reporting on kernels compiled without CONFIG_SWAP support. Affected are Linux 6.18.x (before 6.18.36) and 7.x (before 7.0.13/7.1) builds where CONFIG_SWAP is disabled but CONFIG_MIGRATION or CONFIG_MEMORY_FAILURE is enabled - a configuration typical of embedded or specialized deployments. With EPSS at 0.15% (5th percentile), no CISA KEV listing, and no public exploit identified at time of analysis, real-world risk is low and constrained to niche build environments.
Kernel crash in the Linux slimbus qcom-ngd-ctrl driver affects Qualcomm SoC-based systems from kernel 4.19 onward due to a race condition where SSR and PDR callbacks are registered before the NGD platform device is fully initialized. When the remoteproc subsystem starts concurrently with NGD driver probe - or is already running at PDR lookup registration time - callbacks fire on uninitialized kernel memory, producing a NULL pointer dereference in qcom_slim_ngd_ssr_pdr_notify() and crashing the kernel. No public exploit exists and EPSS is 0.17% (6th percentile); this vulnerability is not in CISA KEV.
Deadlock vulnerability in the Linux kernel's Qualcomm SLIMbus NGD controller driver (slimbus/qcom-ngd-ctrl) causes complete system availability loss through an ABBA lock-ordering inversion between tx_lock and ctrl->lock. Systems running affected kernel versions on Qualcomm SLIMbus-equipped hardware are vulnerable to kernel hangs when SSR/PDR (Subsystem Restart/Process Domain Restart) events race with ongoing DMA TX transactions. EPSS is 0.17% (7th percentile), no public exploit has been identified, and this vulnerability is not listed in CISA KEV.
Spurious WARN_ON in the Linux kernel's sched_ext cgroup migration path can trigger a kernel warning - and potentially a system panic when CONFIG_PANIC_ON_WARN is set - when systemd's user manager writes '+cpu +memory +pids' to its own subtree_control while a sched_ext BPF scheduler is loaded. The root cause is a mismatch between cgroup identity (used by scx_cgroup_can_attach) and CSS identity (used to drive migration), allowing scx_cgroup_move_task() to run against a task whose cgrp_moving_from was never initialized. No public exploit has been identified at time of analysis, and EPSS at 0.17% (6th percentile) confirms negligible exploitation interest.
Denial of service in the Linux kernel's debugobjects subsystem affects RT-enabled (PREEMPT_RT) kernel builds when fill_pool() is called while a task already has pi_blocked_on set. On real-time kernels, fill_pool() invokes rtlock_lock(), which triggers a kernel assertion failure because the priority inheritance chain cannot branch - a task can only be blocked on one lock simultaneously. Exploitation is local-only, requires low privilege, and is constrained to RT kernel configurations; no public exploit exists and EPSS is 0.17% (6th percentile). Notably, the 'Information Disclosure' tag associated with this CVE is inconsistent with the technical description, which describes a kernel assertion crash - a denial-of-service condition.
Deadlock in the Linux kernel debugobjects subsystem on ARM64 PREEMPT_RT debug builds causes system availability loss during early boot. During the early boot window between interrupt enablement and scheduler activation (before SYSTEM_SCHEDULING is set), a hardware interrupt can fire and attempt to call fill_pool() in hard interrupt context, deadlocking if the interrupted boot path already holds a lock required by the allocation path. CVSS rates this Medium (5.5) with local access and availability-only impact; EPSS at 0.17% (6th percentile) confirms minimal exploitation interest, and no public exploit or CISA KEV listing exists at time of analysis.
Session identifier generation in CGI::Session::ID::md5 versions prior to 4.49 for Perl is cryptographically weak, enabling remote attackers with sufficient effort to predict valid session tokens and impersonate authenticated users. The generate_id method combines three deterministic or low-entropy sources - process ID, Unix epoch timestamp, and Perl's non-cryptographic rand() - before hashing with MD5, leaving the session ID space practically enumerable given approximate knowledge of server state. No public exploit has been identified at time of analysis; SSVC assigns Exploitation: none and EPSS places this at the 8th percentile, indicating low real-world exploitation probability despite the C:H confidentiality impact.
HTML injection via Matrix and XMPP chat in Mozilla Thunderbird allows remote network-accessible attackers to inject arbitrary styled content, phishing links, and CSS that manipulates the chat UI without any authentication. All Thunderbird versions prior to 152.0.1 and 140.12.1 ESR are affected. No public exploit has been identified and EPSS sits at 0.14% (4th percentile), but SSVC flags the attack as automatable with partial technical impact, making it a realistic phishing and UI-deception vehicle for anyone reachable via federated Matrix or XMPP.
Memory exhaustion denial-of-service in Mozilla Thunderbird's LDAP address-book autocomplete client allows a malicious or compromised LDAP server to crash the application by returning unbounded data payloads. Affected users are those explicitly configured to query an LDAP directory server for autocomplete, making this a targeted rather than opportunistic attack. No public exploit has been identified at time of analysis, and EPSS at 0.14% (4th percentile) alongside a CISA SSVC exploitation rating of 'none' confirms very low real-world urgency.
Remote code execution risk in c3p0 versions prior to 0.14.0 arises from the library serving as an essential 'sink' in Java deserialization gadget chains. c3p0's DataSource and ConnectionPoolDataSource objects conform to JavaBean's getXXX() naming convention, causing commons-beanutils and similar libraries to invoke JDBC connection methods as though they were safe property accessors during deserialization - triggering arbitrary JDBC driver execution under attacker control. No public exploit code or CISA KEV listing has been identified at time of analysis; the CVSS 4.0 vector scores this at 6.3, largely due to the partial attack requirements (AT:P), though real-world impact when prerequisites are met can substantially exceed that rating.
Same-origin policy bypass in Google Chrome's StorageAccessAPI allows an attacker who has already compromised the Chrome renderer process to further escalate access via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The integrity impact is rated High (I:H) in the CVSS vector, meaning cross-origin data writes or manipulations become possible, but only as a second-stage component in a chained exploit. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none with partial technical impact - consistent with the renderer pre-compromise prerequisite that substantially limits standalone risk.
Cross-origin data leakage in Google Chrome prior to 150.0.7871.47 exposes sensitive user data from other origins when a victim visits a specially crafted HTML page that exploits insufficient policy enforcement in the StorageAccessAPI. The API, designed to manage third-party storage access in privacy-restricting browser contexts, fails to enforce cross-origin boundaries correctly, allowing an attacker to read data belonging to unrelated origins. No active exploitation has been confirmed - CVE is absent from CISA KEV, EPSS rates exploitation likelihood at 0.17% (7th percentile), and SSVC classifies exploitation status as none - though the CVSS confidentiality impact is rated High.
UI spoofing in Google Chrome's DevTools component allows an attacker to misrepresent critical interface information to users who have been socially engineered into installing a malicious Chrome Extension. Affected versions are all Chrome releases prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-451) in DevTools, enabling an extension to manipulate how DevTools renders UI elements - potentially deceiving developers or power users into trusting falsified debugging output or security indicators. No public exploit code has been identified at time of analysis, and this vulnerability is not in the CISA KEV catalog.
UI spoofing in the Glic component of Google Chrome (all versions prior to 150.0.7871.47) enables a remote attacker to misrepresent browser interface elements via a crafted HTML page, provided the victim is socially engineered into performing specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) assigns high confidentiality impact, suggesting the spoofed UI can be leveraged to elicit disclosure of sensitive information such as credentials or session data. No public exploit code exists and this vulnerability is not listed in the CISA KEV catalog at time of analysis.
UI spoofing via the Speech component in Google Chrome prior to 150.0.7871.47 requires an attacker to have already compromised the renderer process, making this a chained, second-stage exploit rather than a standalone remote attack. The vulnerability stems from insufficient input validation (CWE-20) in Chrome's Speech subsystem, enabling a renderer-compromised attacker to manipulate browser UI elements through a crafted HTML page. No public exploit code exists, SSVC assessment confirms no active exploitation, and an EPSS score of 0.17% (7th percentile) reflects a very low probability of mass exploitation - consistent with Google's own 'Low' internal severity rating.
Type confusion in the CSS processing engine of Google Chrome prior to 150.0.7871.47 enables remote attackers to read potentially sensitive data from renderer process memory by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network delivery with no attacker privileges required, though a single user interaction - visiting the malicious page - is necessary. No public exploit code has been identified, CISA SSVC rates exploitation as none at time of analysis, and Chromium's own team classified severity as Low, suggesting limited practical memory disclosure value despite the NVD CVSS C:H rating.
Universal Cross-Site Scripting (UXSS) in Google Chrome prior to 150.0.7871.47 allows remote attackers to inject arbitrary scripts or HTML across origin boundaries by exploiting an inappropriate implementation in Chrome's CSS engine via a crafted HTML page. Unlike application-level XSS, this browser-level flaw bypasses same-origin protections, meaning injected scripts can execute in the context of any open origin. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.16% (6th percentile), and SSVC rates exploitation status as none - indicating this is a patch-promptly, not emergency-response, priority.
Cross-origin data leak in Google Chrome's CSS implementation (versions prior to 150.0.7871.47) enables remote attackers to exfiltrate sensitive data from other origins when a victim visits a specially crafted HTML page. The vulnerability stems from inappropriate CSS handling that creates a side-channel bypassing same-origin policy protections, resulting in high-confidentiality-impact information disclosure with no integrity or availability consequences. No public exploit has been identified and exploitation has not been observed in the wild; CISA SSVC rates exploitation as none and technical impact as partial, aligning with Google's internal Low severity classification despite the NVD CVSS 6.5 score.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML by luring a user to a crafted web page, with the scope change (S:C) in the CVSS vector indicating potential Same-Origin Policy bypass affecting other loaded origins. No public exploit or active exploitation is identified at time of analysis - EPSS sits at 0.17% (6th percentile) and SSVC exploitation status is rated 'none.' A vendor-released patch is available in stable channel 150.0.7871.47.
UI spoofing in Google Chrome's Views component (versions prior to 150.0.7871.47) allows a remote attacker to misrepresent security-critical browser interface elements through a crafted HTML page. Exploitation requires convincing a target user to perform specific UI gestures, making the attack conditional on social engineering. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog; Google has released a patch as part of the stable channel update.
UI spoofing in Google Chrome's Passwords feature on iOS (versions prior to 150.0.7871.47) enables remote attackers to manipulate the presentation of security-critical password UI elements via a specially crafted HTML page. Users who visit a malicious page in Chrome on iOS may see misleading security indicators or spoofed password dialogs, potentially deceiving them into unintended credential interactions. No public exploit identified at time of analysis; EPSS is 0.18% (8th percentile), and SSVC confirms no observed exploitation - risk is real but low-priority relative to the broader threat landscape.
UI spoofing in Google Chrome's Extensions implementation (all versions prior to 150.0.7871.47) enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to render deceptive UI elements through a crafted HTML page, potentially misleading users into unintended interactions. The vulnerability carries a CVSS 5.4 Medium score, though Chromium's internal rating is Low, and the EPSS score of 0.18% (8th percentile) reflects minimal exploitation probability. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Domain spoofing via incorrect security UI in Google Chrome's Document Picture-in-Picture feature on Android (prior to 150.0.7871.47) allows a remote attacker to deceive users about the origin of displayed content. By serving a crafted HTML page, an attacker can cause Chrome on Android to render a misleading security UI - misrepresenting the domain shown to the user. No public exploit has been identified at time of analysis, EPSS sits at 0.18% (8th percentile), and SSVC rates exploitation as none, making this a low operational priority despite its network-accessible attack vector.
UI spoofing in Google Chrome for Android prior to 150.0.7871.47 enables remote unauthenticated attackers to deceive users about page origin or content through insufficient validation of untrusted input in the browser's Input component. Exploitation requires user interaction - a victim must visit a crafted HTML page - and produces only limited integrity impact (visual deception), with no code execution or data exfiltration capability. No public exploit identified at time of analysis; EPSS sits at 0.18% (8th percentile) and CISA SSVC confirms zero observed exploitation, consistent with Google's own 'Low' severity classification for this Chromium issue.
UI spoofing in Google Chrome's TabStrip component prior to version 150.0.7871.47 allows a remote attacker to misrepresent tab or page identity through a crafted HTML page, contingent on convincing the victim to perform specific UI gestures. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L) places real-world risk in the lower tier: high attack complexity, mandatory user interaction, and no confidentiality impact combine to limit practical exploitation. No public exploit code exists and CISA has not added this to the KEV catalog, consistent with Google's own Low severity classification.
UI spoofing in Google Chrome's WebAppInstalls component on Windows (versions prior to 150.0.7871.47) enables a remote attacker to misrepresent the browser interface by luring a user into performing specific UI interaction gestures on a crafted HTML page. The flaw is Windows-platform-specific and rooted in an inappropriate implementation of the Progressive Web App installation UI flow. Google rates this Low severity; no public exploit identified at time of analysis, and EPSS data is not present in the provided intelligence, but the CVSS 4.2 score and required high-complexity user interaction significantly limit real-world risk.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to manipulate browser interface elements via a crafted HTML page, provided the attacker can lure the victim into performing specific UI gestures. The root cause is insufficient validation of untrusted HTML input (CWE-20) within Chrome's iOS-specific rendering layer, resulting in low-integrity and low-availability impact. No public exploit code has been identified at time of analysis, and this vulnerability has not been added to the CISA KEV catalog; Chromium's own severity classification is Low.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent browser interface elements by delivering a crafted HTML page to a victim who visits it. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw arises from insufficient validation of untrusted HTML input in the iOS-specific Chrome rendering pipeline, enabling manipulation of trust signals such as address bar display or security indicators. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) and SSVC Exploitation: none confirm negligible current threat actor interest.
UI spoofing in Google Chrome's Network component (versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, allowing browser UI elements to be faked via a crafted HTML page. This is a chained exploit - not a standalone flaw - requiring both prior renderer compromise and user interaction, which significantly constrains real-world risk. No public exploit code exists and no confirmed active exploitation has been recorded; EPSS at 0.18% (8th percentile) and Chromium's own 'Low' severity rating reinforce this assessment.
UI spoofing via Google Chrome's Autofill implementation on Android (prior to 150.0.7871.47) allows remote unauthenticated attackers to misrepresent interface elements through a crafted HTML page, potentially deceiving users into disclosing sensitive input or taking unintended actions. The vulnerability is platform-specific to Android and carries a Chromium-internal severity of Low, consistent with its limited integrity-only impact and requirement for user interaction. No public exploit code or active exploitation has been identified at time of analysis, and EPSS probability sits at 0.17% (7th percentile), confirming minimal real-world threat pressure.
UI spoofing via race condition in Google Chrome's History Embeddings component (versions prior to 150.0.7871.47) enables remote attackers to present falsified browser interface elements to users through a crafted HTML page. The flaw requires both high attack complexity - a precisely timed race window - and victim interaction, yielding only limited confidentiality and integrity impact with no code execution capability. No public exploit or active exploitation has been identified; EPSS at 0.14% (4th percentile) and SSVC exploitation status of 'none' confirm extremely low real-world exploitation probability at time of analysis.
UI spoofing in Google Chrome's WebXR component (all versions prior to 150.0.7871.47) allows remote attackers to misrepresent browser interface elements when a victim visits a crafted HTML page. The flaw stems from an inappropriate implementation in the WebXR Device API, enabling manipulation of what the user perceives as trusted UI - potentially obscuring origin indicators, security state, or page identity. No public exploit code exists and EPSS stands at 0.18% (8th percentile); CISA SSVC rates exploitation as none with partial technical impact, placing this firmly in the lower-priority tier despite its network-accessible vector.
UI spoofing in Google Chrome's WebAppInstalls component (prior to 150.0.7871.47) is reachable only after an attacker has already compromised the Chrome renderer process, making this a chained, post-exploitation capability rather than a standalone entry point. With a compromised renderer, the attacker can serve a crafted HTML page that bypasses insufficient input validation in WebAppInstalls to forge Chrome's native UI - potentially deceiving users into trusting malicious web app install prompts or dialogs. No public exploit or active exploitation (CISA KEV) is confirmed; EPSS sits at 0.18% (8th percentile), consistent with the high prerequisite barrier and Chromium's own 'Low' severity rating.
UI spoofing in Google Chrome's Omnibox (address bar) prior to version 150.0.7871.47 allows a remote attacker to misrepresent origin or security indicators to a victim via a crafted HTML page. Rooted in CWE-451 (misrepresentation of critical security information), the flaw can enable phishing or origin-confusion attacks by deceiving users into trusting a false domain indicator. No public exploit code exists, CISA SSVC rates exploitation as none, and the EPSS score of 0.18% (8th percentile) confirms this is low-priority outside phishing-sensitive deployments.
UI spoofing in Google Chrome for Android (prior to 150.0.7871.47) via the PreviewTab feature allows remote attackers to misrepresent interface elements through a crafted HTML page. Successful exploitation requires high attack complexity - specifically, the attacker must convince a victim to perform particular UI gestures - limiting this to targeted rather than opportunistic attacks. No active exploitation or public proof-of-concept has been identified; the Chromium security team rates this as Low severity, consistent with its constrained CVSS 4.2 score.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to display false URL content in the browser's address bar by luring a user to a crafted HTML page, creating a credible phishing vector. The flaw stems from inappropriate implementation in the iOS-specific Omnibox rendering logic (CWE-451), distinct from Chrome's desktop codebase. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), indicating negligible opportunistic exploitation probability at this time.
UI spoofing in Google Chrome's Printing subsystem (all versions prior to 150.0.7871.47) can be triggered by a remote attacker who has already compromised the renderer process, enabling misrepresentation of critical browser UI via a crafted HTML page. This is a post-exploitation primitive rather than an initial-access vector - the renderer must be independently compromised before this flaw is reachable. No public exploit code exists and CISA SSVC rates exploitation as none, consistent with the low EPSS score of 0.18% (8th percentile), placing real-world urgency squarely in routine maintenance rather than emergency response.
Domain spoofing in Google Chrome for Android (versions prior to 150.0.7871.47) allows remote attackers to deceive users about the origin of a webpage by exploiting incorrect rendering of security-critical UI elements via a crafted HTML page. User interaction is required - the victim must navigate to the attacker-controlled page - and impact is limited to integrity (UI misrepresentation), with no direct confidentiality or availability consequences. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.17% at the 7th percentile reflects minimal real-world exploitation activity; Google itself rates this 'Low' severity.
Uninitialized memory use in Chrome's ANGLE graphics layer exposes potentially sensitive process memory contents to remote attackers who can entice a user to visit a crafted HTML page. The flaw affects all Chrome versions prior to 150.0.7871.47, with High confidentiality impact per CVSS despite Google's own Chromium severity rating of Low - a discrepancy suggesting practical extraction of meaningful data is constrained in real-world conditions. No public exploit identified at time of analysis, and no CISA KEV listing; a vendor patch has been released.
Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 150.0.7871.47 allows a remote attacker to display a fraudulent URL in the browser's address bar by delivering a crafted HTML page. The root cause is classified as CWE-451 (UI Misrepresentation of Critical Information), meaning the security UI fails to accurately reflect the true origin of displayed content - a condition that directly undermines phishing defenses. No public exploit code has been identified at time of analysis, and the EPSS score of 0.18% (8th percentile) indicates very low observed exploitation pressure, consistent with the Chromium team's own 'Low' severity rating.
Type confusion in Chrome's Bluetooth stack on Windows (versions prior to 150.0.7871.47) enables an adjacent-network attacker to exfiltrate sensitive data from Chrome process memory by presenting a malicious Bluetooth peripheral. The CVSS 6.5 score reflects high confidentiality impact but no integrity or availability exposure; notably, Chromium's internal security team rated this Low severity, suggesting the memory regions accessible are constrained. No public exploit code and no CISA KEV listing exist at time of analysis, and exploitation is physically bounded by Bluetooth range.
Cross-origin data leak in Google Chrome DevTools prior to version 150.0.7871.47 exposes sensitive information from foreign origins when a victim visits a crafted HTML page and performs attacker-directed UI gestures. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms high confidentiality impact with no integrity or availability consequences. No public exploit identified at time of analysis, and EPSS of 0.18% at the 8th percentile - combined with Chromium's own 'Low' severity classification - signals limited real-world exploitation likelihood despite the Medium NVD score.
Memory disclosure via DevTools in Google Chrome on Windows (prior to 150.0.7871.47) enables a remote attacker to read sensitive process memory contents by delivering a crafted HTML page and manipulating the victim into performing specific UI gestures. The vulnerability is Windows-platform-exclusive and carries a Chromium-internal severity of Low, consistent with SSVC's assessment of no current exploitation and non-automatable delivery. No active exploitation or public exploit code has been identified at time of analysis, though the CVSS C:H rating reflects meaningful confidentiality risk if successfully triggered.