Red Hat
Monthly
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote unauthenticated attacker to misrepresent browser interface elements - such as the address bar or security indicators - through a specially crafted HTML page, potentially deceiving users about the origin or trustworthiness of web content. The CVSS vector (PR:N, UI:R) confirms no authentication is required but user interaction is necessary, and the SSVC framework rates exploitation as 'none' with partial technical impact. EPSS at 0.21% (11th percentile) and the absence of any KEV listing or public exploit code indicate no public exploitation activity at time of analysis.
UI spoofing in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to misrepresent browser interface elements by luring a user to a crafted HTML page. The flaw stems from an inappropriate implementation in the Paint subsystem (CWE-451), enabling visual manipulation of browser UI state to deceive users into false trust decisions. No public exploit has been identified, SSVC rates exploitation as none, and EPSS sits at the 11th percentile - making this a low-urgency patch despite Chrome's near-ubiquitous deployment footprint.
UI spoofing in Google Chrome's PageInfo component (prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users about a page's security context or origin by serving a crafted HTML page. The flaw stems from insufficient policy enforcement in PageInfo - the browser panel users rely on to assess site trustworthiness - and maps to CWE-451 (UI Misrepresentation of Critical Information). No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Universal Cross-Site Scripting (UXSS) in Google Chrome's HTMLParser prior to 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML into a victim's browser context by serving a crafted HTML page. The flaw is classified Medium severity by Google's Chromium security team and carries a CVSS 5.4 score, with EPSS at 0.17% (7th percentile) and no CISA KEV listing, indicating low current exploitation activity. A vendor-released patch exists in Chrome 150.0.7871.47; Chrome's auto-update mechanism substantially narrows the exposure window for most consumer endpoints.
Sandbox escape in Google Chrome prior to 150.0.7871.47 exploits a heap-based buffer overflow (CWE-122) in the Storage component, enabling an attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is a chained, second-stage vulnerability - renderer compromise through a separate flaw is a hard prerequisite, making standalone exploitation infeasible. EPSS sits at 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; a vendor patch is confirmed available as Chrome 150.0.7871.47.
Out-of-bounds read in ANGLE, Chrome's cross-platform graphics abstraction engine, enables sensitive process memory disclosure on macOS for attackers who have already compromised the renderer process. Affected versions are Google Chrome prior to 150.0.7871.47 on Mac; Windows and Linux are not listed as affected. This flaw is a second-stage technique in a multi-vulnerability chain - not a standalone entry point - and no public exploit code or CISA KEV listing has been identified, placing real-world exploitation risk substantially below what the C:H confidentiality impact alone might imply.
UI spoofing in Google Chrome prior to 150.0.7871.47 allows a remote attacker to visually deceive users by misrepresenting browser UI elements through a crafted HTML page that requires the victim to perform specific interaction gestures. The flaw originates in an inappropriate implementation within Chrome's UI layer (CWE-451), enabling misrepresentation of critical information that could mislead users into unintended actions or false security assumptions. No public exploit code has been identified and the vulnerability is absent from CISA KEV; Google has released a fix in Chrome 150.0.7871.47.
UI spoofing in Google Chrome's Paint component prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent critical interface elements by delivering a crafted HTML page to a victim. The root cause is an inappropriate implementation in the Paint rendering subsystem (CWE-451), enabling visual deception that could facilitate phishing or credential theft. No public exploit code has been identified and CISA SSVC rates exploitation as none, placing real-world risk well below what the network-reachable attack vector might imply.
Uninitialized memory read in Skia, Chrome's 2D graphics library, exposes process memory contents to an attacker who has already compromised the renderer process by delivering a crafted HTML page. Affected are all Chrome desktop installations prior to 150.0.7871.47; the confidentiality impact is scoped to renderer process memory, which may contain session tokens, DOM content, or cached credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS Medium score of 5.3 reflects the high attack complexity imposed by the renderer pre-compromise prerequisite.
Uninitialized memory exposure in Google Chrome's Media component allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. Affected versions are all Chrome releases prior to 150.0.7871.47, across desktop platforms. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation requires a chained renderer compromise, significantly constraining real-world risk despite the high confidentiality impact rating.
Uninitialized memory exposure in the UI layer of Google Chrome on Android (prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. The vulnerability is CWE-457 (use of uninitialized variable) and is scoped to the Android platform only. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch has been released.
UI spoofing via inappropriate History implementation in Google Chrome prior to 150.0.7871.47 allows a remote attacker to present falsified browsing context to a victim through a crafted HTML page. The flaw (CWE-451) permits manipulation of how history entries are represented in the browser's UI, potentially misleading users about their navigation state or visited URLs. No public exploits are known, EPSS probability sits at 0.21% (11th percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the monitor-and-patch category rather than emergency response.
Navigation restriction bypass in Google Chrome's WebView component on Android (all versions prior to 150.0.7871.47) allows remote unauthenticated attackers to circumvent enforcement of navigation policies via a specially crafted HTML page, producing high integrity impact with no confidentiality or availability consequence. The CVSS vector (PR:N, UI:R) confirms unauthenticated network exploitation gated on victim interaction, consistent with a social-engineering or malicious-redirect delivery. No public exploit exists and CISA has not added this to KEV; EPSS of 0.22% (13th percentile) and SSVC Exploitation:none collectively indicate low active exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already achieved renderer process compromise to escape PDF-layer sandboxing controls via a crafted HTML page, circumventing browser navigation security boundaries. This is a chained-attack-only scenario: the flaw is not independently exploitable and requires a prior renderer compromise as a prerequisite. No public exploit has been identified, EPSS is 0.22% (13th percentile), and SSVC rates exploitation as none - making this a theoretical second-stage risk rather than an immediate standalone threat. Vendor-released patch is confirmed at version 150.0.7871.47.
Process memory disclosure in Google Chrome DevTools on Windows (versions prior to 150.0.7871.47) allows a remote attacker to read potentially sensitive data from browser process memory by serving a crafted HTML page and convincing a user to perform specific UI gestures. The flaw stems from insufficient input validation (CWE-20) within the DevTools subsystem and is limited to the Windows platform. No public exploit code or CISA KEV listing has been identified at time of analysis, but the confidentiality impact is rated High by NVD.
UI spoofing in Google Chrome's Passwords component (all versions prior to 150.0.7871.47) enables remote, unauthenticated attackers to misrepresent critical interface elements to users via a specially crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in Chrome's password management UI, meaning a malicious page can render deceptive credential-related prompts or overlays that appear to originate from the browser's trusted Passwords subsystem. No public exploit code has been identified and CISA SSVC rates active exploitation as none, making this a moderate-priority patching item rather than an emergency response.
Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) enables remote attackers to violate cross-origin isolation by delivering a crafted HTML page to a victim user. The flaw originates in Blink's insufficient validation of untrusted input (CWE-20), resulting in a limited integrity impact when a user browses to attacker-controlled content. No active exploitation is confirmed - SSVC classifies exploitation as none, EPSS sits at 0.22% (13th percentile), and the vulnerability is absent from CISA KEV - and a vendor patch has been released in Chrome 150.0.7871.47.
Uninitialized memory use in the codec subsystem of Google Chrome on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. All Chrome for Windows releases prior to 150.0.7871.47 are affected; the flaw is platform-specific and does not affect Chrome on Linux, macOS, or mobile. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, though the CVSS C:H rating reflects meaningful confidentiality risk, and the uninitialized read could serve as a precursor step toward ASLR bypass in a chained attack.
Incorrect security UI in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 enables Universal Cross-Site Scripting (UXSS), allowing script or HTML injection across web origins via a crafted HTML page. Exploitation requires that the victim user be socially engineered into installing a malicious extension, after which a crafted page triggers the CWE-79 flaw in the Extensions UI. No public exploit exists at time of analysis, EPSS sits at the 4th percentile, and CISA has not listed this in KEV, consistent with the SSVC exploitation:none assessment.
UI spoofing in Google Chrome's PageInfo component (all versions prior to 150.0.7871.47) enables remote attackers to misrepresent the browser's security indicators through a crafted HTML page that induces specific user UI gestures. The flaw (CWE-451) causes the PageInfo panel - the panel users consult to evaluate site trustworthiness - to render incorrect security UI, potentially deceiving victims into trusting malicious or unverified origins. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires high attack complexity and deliberate user interaction, keeping real-world risk moderate despite the ubiquitous deployment footprint of Chrome.
Insufficient XML policy enforcement in Google Chrome on Android (prior to 150.0.7871.47) exposes process memory contents to remote attackers who can deliver a crafted HTML page. The flaw is classified under CWE-284 (Improper Access Control), allowing the browser's XML handling to bypass intended isolation boundaries and leak potentially sensitive in-process data - such as cookies, credentials, or other runtime state - to an attacker-controlled origin. No active exploitation is confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 6.5 (Medium) reflects meaningful real-world risk given the zero-authentication, high-confidentiality-impact profile.
Navigation restriction bypass in Google Chrome's SplitView feature (prior to 150.0.7871.47) enables a remote attacker who has already achieved renderer process compromise to escape navigation controls via a crafted HTML page. The CWE-284 (Improper Access Control) root cause means Chrome's SplitView fails to enforce navigation policy in a post-renderer-compromise context, making this a chained exploit component rather than a standalone initial-access vector. EPSS is very low (0.22%, 13th percentile), no public exploit code has been identified, and SSVC rates exploitation as none with partial technical impact at time of analysis.
Cross-origin data leakage in Google Chrome's PerformanceAPI implementation (versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to infer sensitive data from other browser origins by luring a victim to visit a crafted HTML page. The flaw exploits timing measurements exposed by the Performance API to create a side-channel that bypasses the Same-Origin Policy for limited data reads. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS probability stands at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' assessment.
Uninitialized GPU memory use in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to read sensitive data from GPU process memory by delivering a crafted HTML page. This is a second-stage information disclosure primitive - exploitation is contingent on a prior renderer compromise, making it a component of a multi-vulnerability attack chain rather than a standalone critical issue. No public exploit code or CISA KEV listing has been identified at time of analysis; Google has released a patched stable channel build (150.0.7871.47).
Insufficient policy enforcement in the Payments component of Google Chrome on Android prior to 150.0.7871.47 exposes potentially sensitive data from process memory to remote attackers. Exploitation requires a victim to visit a specially crafted HTML page, making this a user-interaction-dependent, network-delivered information disclosure. No active exploitation is confirmed (SSVC: Exploitation: none; not listed in CISA KEV), and no public exploit code has been identified at time of analysis, though the CVSS confidentiality impact is rated High due to the potential for process memory leakage.
Uninitialized memory read in Google Chrome's XR (Extended Reality/WebXR) subsystem exposes process memory to a remote attacker who has already achieved renderer process compromise. Affected versions are all Chrome releases prior to 150.0.7871.47. This is a second-stage, chained vulnerability - an attacker leverages a crafted HTML page to trigger the uninitialized read and extract sensitive data from process memory, but only after separately exploiting a renderer process escape. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data leakage in Google Chrome on iOS (prior to 150.0.7871.47) stems from an inappropriate implementation in the ScriptInjections subsystem, exploitable by a remote attacker who can lure a victim to a crafted HTML page. The flaw allows the attacker's origin to read data belonging to a different, protected origin - a fundamental violation of the Same-Origin Policy on Apple's iOS platform. No public exploit code has been identified at time of analysis, EPSS places exploitation probability at 0.22% (13th percentile), and SSVC signals no observed active exploitation, making this a medium-priority patch item despite its cross-origin impact.
Uninitialized memory use in Chrome's CSS engine on Android exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Unauthenticated remote attackers can trigger this information leak against any Android Chrome user who visits attacker-controlled content (CVSS PR:N, UI:R), with high confidentiality impact per the CVSS vector. Notably, Chromium's internal severity rating is Medium despite the C:H CVSS impact, suggesting reliable extraction of useful sensitive data may be inconsistent in practice; no public exploit code or CISA KEV listing exists at time of analysis.
UI spoofing in Google Chrome for Android's SiteSettings component (versions prior to 150.0.7871.47) enables remote attackers to deceive users about site origin or permission context via a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could cause victims to grant permissions to unintended origins or trust fraudulent site identity indicators. No public exploit or active exploitation has been identified; CISA SSVC and EPSS both confirm minimal real-world exploitation pressure at this time.
Uninitialized memory exposure in Google Chrome's Cast component prior to 150.0.7871.47 allows an unauthenticated attacker on the same local network segment to leak sensitive contents from the browser's process memory via malicious Cast protocol traffic. The root cause is CWE-457 (Use of Uninitialized Variable): memory allocated for Cast operations is not zeroed before use, allowing residual in-memory data - potentially including credentials, session tokens, or cached page content - to be disclosed in responses to crafted network input. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Google has released a patched build.
Cross-origin credential data leakage in Google Chrome's Passwords component (prior to 150.0.7871.47) enables a renderer-level attacker to exfiltrate saved passwords across origins via a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-284) in Chrome's built-in password manager, exploitable only when the attacker has already achieved renderer process compromise - making this a second-stage component in an exploit chain rather than a standalone threat. No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) alongside SSVC exploitation status of 'none' confirms limited real-world exploitation activity.
Memory disclosure in Google Chrome's Passwords component on Android prior to 150.0.7871.47 allows a remote attacker to extract potentially sensitive information from process memory. Exploitation requires luring a target user to visit a specially crafted HTML page, placing this squarely in the social-engineering-assisted drive-by category. No public exploit code has been identified at time of analysis, but the high confidentiality impact (C:H in CVSS) indicates meaningful credential exposure risk given Chrome's role as a primary password manager on Android devices.
Side-channel information leakage via the ComputePressure API in Google Chrome prior to 150.0.7871.47 enables remote attackers to read cross-origin data by inducing a victim to visit a crafted HTML page. The vulnerability exploits physical or logical resource-pressure side channels exposed through the ComputePressure browser API, violating the same-origin policy's confidentiality guarantees. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) corroborates the low near-term exploitation probability despite the high confidentiality impact rating.
Insufficient policy enforcement in Chrome's built-in Passwords subsystem (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to read potentially sensitive credential data from process memory via a crafted HTML page. This is a second-stage, chained information-disclosure flaw - not a standalone exploit - that bypasses Chrome's inter-process access boundaries to reach password manager data. No public exploit code has been identified at time of analysis, and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Cross-origin data exfiltration in Google Chrome's Sharing feature on Android exposes sensitive page content to remote attackers who have already compromised the renderer process, exploitable via a crafted HTML page. All Chrome for Android builds prior to 150.0.7871.47 are affected; the fixed release is confirmed by Google's stable channel advisory. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate negligible observed exploitation pressure at time of analysis, though the high confidentiality impact and ubiquitous deployment of Chrome on Android make patching a clear priority.
UI spoofing in Google Chrome on Windows (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to manipulate the browser interface via a specially crafted HTML page, potentially deceiving users into interacting with falsified content or controls. The vulnerability stems from an inappropriate implementation in the Media component and is classified as medium severity (CVSS 6.5). No public exploit code or active exploitation has been identified - EPSS sits at the 11th percentile (0.21%) and no CISA KEV listing exists - and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome prior to version 150.0.7871.47 enables remote attackers to circumvent browser policy enforcement via a crafted HTML page targeting the 'Actor' component. The flaw is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), where controls that should be authoritative are applied within the browser and can be subverted by an adversary-controlled page. EPSS at 0.22% (13th percentile) indicates low current exploitation probability, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV; no public exploit identified at time of analysis.
Navigation restriction bypass in Google Chrome's DevTools component on Android (all versions prior to 150.0.7871.47) allows a local attacker to circumvent policy-enforced browsing controls by delivering a crafted malicious file. The vulnerability is confined to Android - desktop Chrome is not in scope - and requires user interaction with the malicious file, substantially narrowing the realistic attack surface. No public exploit code exists and no active exploitation has been confirmed; an EPSS score of 0.14% (3rd percentile) corroborates low real-world exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to circumvent Chrome's network navigation controls via a crafted HTML page. The vulnerability stems from CWE-20 (Improper Input Validation) in Chrome's Network component, producing a high-integrity impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) places exploitation likelihood well below the median, though the pre-compromised renderer prerequisite makes this a chained attack vector relevant primarily within multi-stage browser exploitation chains.
Same-origin policy bypass in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to perform cross-origin integrity violations by serving a crafted HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. This is explicitly a chained attack requiring a pre-existing renderer compromise, making it a second-stage exploit rather than a standalone entry point. No public exploit code exists and no public exploitation has been confirmed at time of analysis.
Uninitialized GPU memory use in Google Chrome on Android prior to 150.0.7871.47 allows a remote attacker to read potentially sensitive data from process memory by luring a user to a crafted HTML page. The flaw (CWE-457) is confined to the Android GPU code path and requires only user interaction to trigger, with CVSS confirming unauthenticated network delivery and High confidentiality impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Google has released a fix in stable channel version 150.0.7871.47.
Side-channel cross-origin data leakage in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows remote attackers to infer sensitive content belonging to other origins by enticing a victim to visit a crafted HTML page. The vulnerability exploits a weakness in the Paint subsystem's rendering pipeline (CWE-1300: Improper Protection of Physical Side Channels), enabling an attacker page to observe rendering state or timing variations and reconstruct protected cross-origin data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS probability is low at 0.21% (11th percentile). Vendor-released patch is available in Chrome 150.0.7871.47.
Same-origin policy bypass in Google Chrome's DeviceBoundSessionCredentials component allows remote attackers to violate cross-origin isolation guarantees via a crafted HTML page. Affected are all Chrome desktop releases prior to 150.0.7871.47 on all supported platforms. Exploitation requires user interaction (visiting an attacker-controlled page) and yields high integrity impact - enabling cross-origin state manipulation - with no confidentiality or availability consequence. No active exploitation is confirmed (not in CISA KEV), EPSS is low at 0.22% (13th percentile), and SSVC rates exploitation as none with partial technical impact; a vendor patch is available.
Site isolation bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to circumvent extension policy enforcement and escape site isolation boundaries via a crafted HTML page. The root cause (CWE-602) is client-side enforcement of security policies in the Extensions subsystem that can be subverted once the renderer is under attacker control. No active exploitation has been confirmed - EPSS is 0.22% (13th percentile), SSVC rates exploitation as none and the attack as non-automatable - and a vendor-released patch is available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) allows a remote attacker to subvert browser-enforced navigation controls by luring a user into performing specific UI gestures on a crafted HTML page. Classified as CWE-20 (Improper Input Validation), the flaw undermines integrity by permitting unauthorized navigation that the browser is intended to block. No public exploit code exists and EPSS sits at 0.22% (13th percentile), indicating low observed exploitation probability; the vulnerability is not listed in CISA KEV.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser interface elements - such as the address bar or origin indicators - by serving a crafted HTML page, potentially deceiving users into trusting malicious content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms network-reachable exploitation with no privilege requirement but mandatory user interaction, limiting impact to partial integrity loss with no confidentiality or availability effect. No public exploit or active exploitation has been identified; an EPSS score of 0.21% at the 11th percentile indicates very low current exploitation probability, and this vulnerability does not appear in the CISA KEV catalog.
Chrome's built-in Passwords subsystem on macOS leaks sensitive process memory contents when a malicious file is processed, potentially exposing stored credentials or authentication tokens to a local attacker. All Google Chrome releases for Mac prior to 150.0.7871.47 are affected. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the confidentiality impact is rated High given the nature of the data at risk within the Passwords feature.
Cross-origin data leakage in Google Chrome's Autofill subsystem on iOS (versions prior to 150.0.7871.47) enables remote attackers to read sensitive data across origin boundaries by luring victims into performing specific UI gestures on a crafted page. Rooted in CWE-346 (Origin Validation Error), the Autofill policy enforcement layer fails to maintain proper origin isolation under targeted interaction conditions. With an EPSS of 0.21% (11th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the CVSS-rated High confidentiality impact warrants prompt patching given Chrome's broad iOS deployment footprint.
UI spoofing in Google Chrome's Safe Browsing component on iOS enables remote attackers to mislead users through a crafted HTML page, potentially causing them to dismiss or misinterpret security warnings. Only Chrome for iOS versions prior to 150.0.7871.47 are affected; the desktop channel is not impacted by this specific flaw. No public exploit code exists and exploitation probability is very low (EPSS 0.21%, 11th percentile), though the network-accessible, zero-authentication attack surface keeps it relevant where phishing-style delivery is feasible.
Insufficient policy enforcement in the Spellcheck component of Google Chrome prior to 150.0.7871.47 exposes process memory to attackers who have already achieved renderer process compromise. The vulnerability enables a second-stage information disclosure step in a chained attack: after compromising the renderer, the attacker serves a crafted HTML page that exploits the Spellcheck policy gap to read potentially sensitive data from memory. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Google has released a fix in the stable channel update.
Cross-origin data leakage in the WebXR implementation of Google Chrome on Android (versions prior to 150.0.7871.47) allows remote unauthenticated attackers to exfiltrate sensitive cross-origin information by enticing a victim to visit a crafted HTML page. The flaw is rooted in CWE-693 (Protection Mechanism Failure), where WebXR fails to enforce cross-origin isolation policies on Android specifically. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; the vulnerability is not listed in the CISA KEV catalog.
Navigation restriction bypass in Google Chrome's Omnibox on iOS (prior to 150.0.7871.47) enables a remote attacker to circumvent address bar security controls through insufficient input validation, contingent on user interaction with specific UI gestures during exposure to malicious network traffic. The integrity impact is rated High (I:H) with no confidentiality or availability impact, consistent with a content/navigation spoofing class of vulnerability. No public exploit code or CISA KEV listing has been identified; EPSS score of 0.20% (10th percentile) indicates low observed exploitation probability at time of analysis.
Out-of-bounds read in Google Chrome's Codecs component (prior to 150.0.7871.47) enables remote attackers to leak sensitive data from renderer process memory by delivering a crafted HTML page. The CVSS C:H rating reflects meaningful exposure of in-process data such as session tokens or credentials, though Chromium's own team assessed this as Medium severity, and the sandbox boundary (S:U) limits blast radius to the renderer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition exploitation in Google Chrome for iOS (prior to 150.0.7871.47) exposes potentially sensitive data from process memory to a local attacker with physical device access. The flaw is rooted in improper synchronization (CWE-362) and requires high attack complexity to successfully win the timing window. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor has released a patching fix in the 150.0.7871.47 stable channel update.
Navigation restriction bypass in Google Chrome's Safe Browsing implementation on iOS allows a remote, unauthenticated attacker to circumvent phishing and malicious-site protections via a specially crafted HTML page, affecting all Chrome for iOS versions prior to 150.0.7871.47. The flaw is classified as CWE-693 (Protection Mechanism Failure), meaning the Safe Browsing guard can be rendered ineffective rather than defeated through cryptographic or authentication means. No public exploit or CISA KEV listing has been identified, and the EPSS score of 0.23% (14th percentile) signals low current exploitation probability - but the zero-prerequisite network delivery and high integrity impact make this a meaningful risk for iOS users who have not updated.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to misrepresent browser interface elements - such as address bars or security indicators - by delivering a crafted HTML page to a victim on an iOS device. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw exploits an inappropriate implementation specific to Chrome's iOS code path, which differs from desktop Chrome due to WKWebView constraints imposed by Apple. No public exploit code exists, CISA SSVC rates exploitation as none, and EPSS sits at the 12th percentile, indicating minimal real-world threat at time of analysis.
Navigation restriction bypass in Google Chrome's Chromecast implementation (versions prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to circumvent navigation restrictions via a specially crafted HTML page. This is a post-compromise escalation primitive rather than a standalone entry point - the renderer must already be under attacker control, making this a link in an exploit chain rather than an initial access vector. No public exploit has been identified at time of analysis; EPSS at 0.23% (14th percentile) reflects very low observed exploitation probability, consistent with the chained-exploit requirement.
Navigation restriction bypass in Google Chrome's Glic feature (versions prior to 150.0.7871.47) enables remote attackers to circumvent policy enforcement controls by delivering a crafted HTML page that triggers insufficient validation logic. The flaw maps to CWE-602, meaning security enforcement intended to be authoritative is implemented client-side in a bypassable manner, resulting in high integrity impact with no confidentiality or availability consequence. No public exploit or active exploitation has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability.
UI spoofing via Chrome's Autofill component affects all desktop installations prior to version 150.0.7871.47, enabling a remote attacker to misrepresent interface elements through a crafted HTML page. Exploitation requires both navigating to an attacker-controlled page and performing specific UI gestures, reflected in CVSS AC:H and UI:R - passive browsing is insufficient. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.2 Medium score reflects limited integrity and availability impact with no confidentiality loss.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a network-positioned attacker to circumvent browser-enforced navigation policies via a crafted HTML page. The attacker must occupy a privileged network position (e.g., man-in-the-middle) and requires user interaction with the malicious page, per the CVSS UI:R and the description's explicit network-position prerequisite. With an EPSS of 0.15% at the 5th percentile, no public exploit code, and no CISA KEV listing, exploitation probability is low - this is a medium-severity issue with a meaningful but situational attack barrier.
Cross-origin data exfiltration in Google Chrome's WebUI component (versions prior to 150.0.7871.47) enables remote attackers to leak sensitive data across origin boundaries by delivering crafted malicious network traffic to an unpatched browser. The flaw arises from insufficient input validation (CWE-20) within the WebUI layer, undermining same-origin policy protections and exposing data from isolated origins to attacker-controlled contexts. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, EPSS sits at 0.20% (10th percentile), and no public POC has been identified; a vendor-released patch is available in Chrome 150.0.7871.47.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 exposes sensitive information from other origins when a remote attacker convinces a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from an inappropriate implementation in the iOS-specific Chrome browser layer, classified under CWE-451 (UI Misrepresentation), and enables confidentiality compromise without requiring attacker privileges. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (12th percentile) signals low near-term automated exploitation risk.
Out-of-bounds read in the Chromecast component of Google Chrome prior to 150.0.7871.47 enables a remote attacker, who has already achieved renderer process compromise, to exfiltrate potentially sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - it cannot be exploited in isolation and requires a prior renderer compromise as a prerequisite. Google has released a patch in Chrome 150.0.7871.47; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's NFC implementation on Android exposes sensitive information to attackers who have already compromised the renderer process. Chrome versions prior to 150.0.7871.47 on Android fail to properly validate origins when handling NFC interactions, allowing a renderer-level attacker to read data across origin boundaries via a crafted HTML page. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at the 11th percentile, indicating low observed exploitation probability despite the theoretical confidentiality impact.
Content Security Policy bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote attackers to circumvent enforcement mechanisms via a specially crafted HTML page, resulting in high-integrity impact with no confidentiality or availability consequence. Affected versions are all Chrome releases prior to 150.0.7871.47. User interaction is required - the victim must visit the attacker-controlled page - and no public exploit or CISA KEV listing has been identified at time of analysis. The low EPSS score of 0.22% (13th percentile) reinforces that active exploitation is not currently observed.
Same-origin policy bypass in Google Chrome's WebAppInstalls component allows remote attackers to compromise cross-origin integrity via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-346, Origin Validation Error) in the PWA installation subsystem, enabling an attacker to perform unauthorized cross-origin writes or manipulations when a user visits attacker-controlled content. No public exploit identified at time of analysis, and the EPSS score of 0.23% (14th percentile) indicates low near-term exploitation probability, though the ubiquitous deployment of Chrome elevates aggregate exposure.
Use-after-free in Google Chrome's Bluetooth subsystem (all versions prior to 150.0.7871.47) enables an unauthenticated attacker within Bluetooth radio range to leak sensitive data from Chrome's process memory by operating a malicious Bluetooth peripheral. The CVSS vector (AV:A/PR:N/UI:N/C:H) confirms no attacker-side authentication is required and impact is confidentiality-only, with no integrity or availability loss. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV; the Chromium security team rated this Medium severity, consistent with the bounded adjacency-only attack vector.
Process memory disclosure in Google Chrome's ANGLE graphics abstraction layer (versions prior to 150.0.7871.47) enables a renderer-compromised attacker to read potentially sensitive data from process memory via a crafted HTML page. This is a post-exploitation, second-stage vulnerability: it cannot be triggered without a prior renderer process compromise, functioning as a chaining component rather than a standalone entry point. No public exploit code or CISA KEV listing has been identified at time of analysis; Chromium's own team rates it Medium severity, consistent with the prerequisite attack complexity.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 is achievable by an attacker holding a privileged network position who can manipulate traffic between the victim's browser and a server. The flaw originates in Chrome's Network component (CWE-693: Protection Mechanism Failure), where an inappropriate implementation allows CSP enforcement to be circumvented via crafted network traffic, yielding a High Integrity impact. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries an EPSS score of 0.15% (4th percentile) - but the attack vector is unauthenticated and the integrity impact is significant for high-value targets on adversarial networks.
Memory disclosure in Google Chrome's GPU component on Windows enables a remote attacker - who has already established renderer process compromise - to extract sensitive data from process memory via a crafted HTML page. Affected versions are all Chrome for Windows releases prior to 150.0.7871.47. This is a second-stage exploit component: it does not independently achieve remote code execution but can be chained with a renderer exploit to leak process memory contents, potentially exposing credentials, tokens, or other in-memory sensitive data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition in the DataTransfer API in Google Chrome prior to 150.0.7871.47 allows a remote attacker to read potentially sensitive data from renderer process memory by luring a user to a specially crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the impact is limited to confidentiality - no integrity or availability loss - and that reliable exploitation requires winning a timing race (AC:H) combined with user interaction. No public exploit identified at time of analysis; Google has shipped a patch in the stable channel update dated June 2026.
Out-of-bounds read in Chrome's Layout engine prior to 150.0.7871.47 allows remote attackers to leak potentially sensitive data from the renderer process memory by serving a crafted HTML page. User interaction is required - the victim must visit the malicious page - limiting automated mass exploitation. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, placing real-world urgency below what the CVSS 6.5 score alone might suggest.
GuestView policy enforcement in Google Chrome prior to 150.0.7871.47 can be subverted by an attacker who has already achieved renderer process compromise, allowing site isolation to be bypassed via a crafted HTML page. The flaw (CWE-602: Client-Side Enforcement of Server-Side Security) enables manipulation of cross-origin content or policy in embedded browsing contexts that Chrome's site isolation architecture is designed to protect. No public exploit code has been identified and EPSS places exploitation probability at 0.22% (13th percentile), consistent with the elevated prerequisite of a prior renderer compromise required to trigger this vulnerability.
Site isolation bypass in Google Chrome on Android prior to 150.0.7871.47 enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to break cross-origin security boundaries using a crafted HTML page. The root cause is CWE-346 (Origin Validation Error) in Chrome's Android-specific network implementation, meaning the network layer fails to enforce origin checks when requests originate from a compromised renderer context. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.22% at the 13th percentile reflects the high chaining complexity required.
UI spoofing via Chrome's Geolocation implementation (versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to deceive users about the origin or context of geolocation permission requests through a crafted HTML page. Exploitation requires user interaction with the malicious page, limiting automated attack potential. With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified, real-world exploitation risk is low despite the broad deployment footprint of Chrome.
Site isolation bypass in Google Chrome for Android (prior to 150.0.7871.47) allows a remote attacker who has already achieved renderer process compromise to cross origin boundaries using a crafted HTML page, enabling high-integrity impact against other open sites. The root cause is CWE-20 (Improper Input Validation) within Chrome's Input subsystem on Android - an input handling implementation flaw that fails to enforce cross-origin separation once the renderer is under adversary control. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), placing this firmly in the category of a meaningful escalation primitive rather than a standalone mass-exploitation risk.
UI spoofing in Google Chrome Enterprise prior to version 150.0.7871.47 allows unauthenticated remote attackers to deceive users into believing they are interacting with legitimate browser UI by serving a crafted HTML page. The root cause is insufficient validation of untrusted HTML input within Chrome's Enterprise component (CWE-20), enabling an attacker to manipulate visual elements such as address bars, dialog prompts, or permission requests. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low current exploitation probability despite a network-accessible attack vector.
Insufficient Web Authentication (WebAuthn/Passkeys) policy enforcement in Google Chrome on iOS prior to 150.0.7871.47 enables cross-origin data leakage to an attacker controlling a privileged network position. The flaw stems from CWE-693 (Protection Mechanism Failure) in the browser's WebAuthn subsystem, which fails to enforce origin isolation correctly when processing crafted HTML pages. No public exploit code exists and CISA has not listed this in KEV, but the high confidentiality impact (C:H) and the specificity of Chrome-on-iOS as the attack surface make this a targeted patching priority for organizations with a managed iOS fleet.
UI spoofing in Google Chrome's Autofill component on Windows (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users into interacting with forged security UI elements by convincing them to perform specific on-page gestures against a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an adversary to obscure or fabricate Autofill security indicators, potentially tricking users into submitting saved credentials or personal data to attacker-controlled destinations. No public exploit or CISA KEV listing has been confirmed; Google has released a fix in stable channel version 150.0.7871.47.
Out-of-bounds read in Chrome's bundled FFmpeg video decoding component (all versions prior to 150.0.7871.47) allows a remote attacker to leak renderer process memory contents via a crafted video file. The CVSS vector confirms network reachability with no required privileges (PR:N) but mandates user interaction (UI:R), meaning the victim must process the malicious video. SSVC assessment rates exploitation as none and the attack non-automatable, and no public exploit has been identified at time of analysis; Google has released a patched build at 150.0.7871.47.
UI spoofing via crafted HTML in Google Chrome's Geometry component (versions prior to 150.0.7871.47) enables remote attackers to misrepresent security-critical interface elements to users who are socially engineered into performing specific UI gestures. The flaw stems from an inappropriate implementation in Chrome's Geometry subsystem (CWE-451), affecting the integrity and availability of the browser interface at low impact levels. No public exploit or active exploitation has been identified; Google has released a confirmed patch in version 150.0.7871.47.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to exfiltrate sensitive information from other origins by luring victims to a crafted HTML page that exploits insufficient input validation. The vulnerability carries a CVSS 6.5 with high confidentiality impact (AV:N/PR:N/C:H) but requires user interaction and is iOS-platform-specific, constraining the realistic attack surface. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.22% at the 12th percentile and SSVC rates exploitation as none.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote unauthenticated attackers to display a falsified URL in the browser address bar by delivering a crafted HTML page to an iOS user. The flaw is classified CWE-451 (UI misrepresentation of critical information) and is iOS-platform-specific, with no impact on Chrome for Android, Windows, macOS, or Linux. No active exploitation is confirmed - the vulnerability is not listed in CISA KEV and EPSS sits at 0.22% (12th percentile) - but the spoofing primitive is a classic enabler of targeted phishing campaigns against mobile users.
Cross-origin data leakage in Google Chrome's Canvas component prior to version 150.0.7871.47 exposes sensitive cross-origin content to remote attackers via a crafted HTML page. The flaw bypasses Same-Origin Policy protections enforced at the Canvas API layer, enabling pixel-level or structured data extraction from cross-origin resources rendered in a canvas context. With CVSS 6.5, EPSS at 0.21% (11th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world exploitation is low-probability but credible given the zero-privilege, network-accessible attack path requiring only a single user visit.
Same-origin policy bypass in Google Chrome's CSS engine allows a remote, unauthenticated attacker to undermine web isolation guarantees by serving a crafted HTML page to an unsuspecting user. All Chrome releases prior to 150.0.7871.47 are affected. No public exploit code or active exploitation has been confirmed; SSVC rates exploitation as 'none' and EPSS sits at the 13th percentile, placing real-world urgency below what the I:H CVSS score alone might suggest.
Same-origin policy bypass in Google Chrome's CSS implementation allows a remote, unauthenticated attacker to violate cross-origin integrity protections by luring a user to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. Google has released a patch; no active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.22% at the 13th percentile indicates low current exploitation probability.
UI spoofing in Google Chrome before 150.0.7871.47 allows remote unauthenticated attackers to visually deceive users by serving a crafted HTML page that exploits a flaw in Chrome's CSS implementation. The flaw (CWE-451: UI Misrepresentation of Critical Information) enables attacker-controlled content to obscure or mimic trusted browser UI elements such as the address bar or security indicators, creating a credible phishing surface. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) indicates minimal observed exploitation activity; however, Google's internal Chromium severity rating of 'High' reflects the significant phishing and credential-theft potential inherent in convincing browser UI spoofing.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. The flaw exploits an inappropriate handling of CSS that causes Chrome's renderer to break the same-origin policy, enabling script execution in the context of other origins. No public exploit or CISA KEV listing has been identified; EPSS probability is very low (0.21%, 12th percentile), suggesting limited active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics library on macOS allows a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. Affected are all Chrome versions on Mac prior to 150.0.7871.47. The flaw stems from uninitialized memory use within ANGLE, Chrome's graphics abstraction layer, enabling residual memory contents from other security origins to be read and potentially returned to an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis; EPSS is low at 0.23% (13th percentile), consistent with a high-CVSS flaw constrained by both user-interaction and platform requirements.
Memory disclosure in Google Chrome's Enterprise policy implementation exposes sensitive process memory contents to remote attackers who can direct victims to a crafted HTML page. All Chrome desktop releases prior to 150.0.7871.47 are affected. No public exploit code exists and CISA SSVC classifies exploitation status as none, but the high confidentiality impact and zero-privilege-required attack path make prompt patching advisable for enterprise-managed Chrome deployments.
UI spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables a remote unauthenticated attacker to misrepresent browser interface elements - such as the address bar or security indicators - through a specially crafted HTML page, potentially deceiving users about the origin or trustworthiness of web content. The CVSS vector (PR:N, UI:R) confirms no authentication is required but user interaction is necessary, and the SSVC framework rates exploitation as 'none' with partial technical impact. EPSS at 0.21% (11th percentile) and the absence of any KEV listing or public exploit code indicate no public exploitation activity at time of analysis.
UI spoofing in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to misrepresent browser interface elements by luring a user to a crafted HTML page. The flaw stems from an inappropriate implementation in the Paint subsystem (CWE-451), enabling visual manipulation of browser UI state to deceive users into false trust decisions. No public exploit has been identified, SSVC rates exploitation as none, and EPSS sits at the 11th percentile - making this a low-urgency patch despite Chrome's near-ubiquitous deployment footprint.
UI spoofing in Google Chrome's PageInfo component (prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users about a page's security context or origin by serving a crafted HTML page. The flaw stems from insufficient policy enforcement in PageInfo - the browser panel users rely on to assess site trustworthiness - and maps to CWE-451 (UI Misrepresentation of Critical Information). No public exploit code has been identified and CISA has not listed this in KEV; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' indicate no observed active exploitation at time of analysis.
Universal Cross-Site Scripting (UXSS) in Google Chrome's HTMLParser prior to 150.0.7871.47 enables remote attackers to inject arbitrary scripts or HTML into a victim's browser context by serving a crafted HTML page. The flaw is classified Medium severity by Google's Chromium security team and carries a CVSS 5.4 score, with EPSS at 0.17% (7th percentile) and no CISA KEV listing, indicating low current exploitation activity. A vendor-released patch exists in Chrome 150.0.7871.47; Chrome's auto-update mechanism substantially narrows the exposure window for most consumer endpoints.
Sandbox escape in Google Chrome prior to 150.0.7871.47 exploits a heap-based buffer overflow (CWE-122) in the Storage component, enabling an attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. This is a chained, second-stage vulnerability - renderer compromise through a separate flaw is a hard prerequisite, making standalone exploitation infeasible. EPSS sits at 0.21% (11th percentile), there is no CISA KEV listing, and no public exploit code has been identified at time of analysis; a vendor patch is confirmed available as Chrome 150.0.7871.47.
Out-of-bounds read in ANGLE, Chrome's cross-platform graphics abstraction engine, enables sensitive process memory disclosure on macOS for attackers who have already compromised the renderer process. Affected versions are Google Chrome prior to 150.0.7871.47 on Mac; Windows and Linux are not listed as affected. This flaw is a second-stage technique in a multi-vulnerability chain - not a standalone entry point - and no public exploit code or CISA KEV listing has been identified, placing real-world exploitation risk substantially below what the C:H confidentiality impact alone might imply.
UI spoofing in Google Chrome prior to 150.0.7871.47 allows a remote attacker to visually deceive users by misrepresenting browser UI elements through a crafted HTML page that requires the victim to perform specific interaction gestures. The flaw originates in an inappropriate implementation within Chrome's UI layer (CWE-451), enabling misrepresentation of critical information that could mislead users into unintended actions or false security assumptions. No public exploit code has been identified and the vulnerability is absent from CISA KEV; Google has released a fix in Chrome 150.0.7871.47.
UI spoofing in Google Chrome's Paint component prior to version 150.0.7871.47 allows a remote, unauthenticated attacker to misrepresent critical interface elements by delivering a crafted HTML page to a victim. The root cause is an inappropriate implementation in the Paint rendering subsystem (CWE-451), enabling visual deception that could facilitate phishing or credential theft. No public exploit code has been identified and CISA SSVC rates exploitation as none, placing real-world risk well below what the network-reachable attack vector might imply.
Uninitialized memory read in Skia, Chrome's 2D graphics library, exposes process memory contents to an attacker who has already compromised the renderer process by delivering a crafted HTML page. Affected are all Chrome desktop installations prior to 150.0.7871.47; the confidentiality impact is scoped to renderer process memory, which may contain session tokens, DOM content, or cached credentials. No public exploit code and no CISA KEV listing have been identified at time of analysis; the CVSS Medium score of 5.3 reflects the high attack complexity imposed by the renderer pre-compromise prerequisite.
Uninitialized memory exposure in Google Chrome's Media component allows a remote attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. Affected versions are all Chrome releases prior to 150.0.7871.47, across desktop platforms. No public exploit code or active exploitation (CISA KEV) has been identified at time of analysis; exploitation requires a chained renderer compromise, significantly constraining real-world risk despite the high confidentiality impact rating.
Uninitialized memory exposure in the UI layer of Google Chrome on Android (prior to 150.0.7871.47) allows an attacker who has already compromised the renderer process to read potentially sensitive data from process memory by serving a crafted HTML page. The vulnerability is CWE-457 (use of uninitialized variable) and is scoped to the Android platform only. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch has been released.
UI spoofing via inappropriate History implementation in Google Chrome prior to 150.0.7871.47 allows a remote attacker to present falsified browsing context to a victim through a crafted HTML page. The flaw (CWE-451) permits manipulation of how history entries are represented in the browser's UI, potentially misleading users about their navigation state or visited URLs. No public exploits are known, EPSS probability sits at 0.21% (11th percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the monitor-and-patch category rather than emergency response.
Navigation restriction bypass in Google Chrome's WebView component on Android (all versions prior to 150.0.7871.47) allows remote unauthenticated attackers to circumvent enforcement of navigation policies via a specially crafted HTML page, producing high integrity impact with no confidentiality or availability consequence. The CVSS vector (PR:N, UI:R) confirms unauthenticated network exploitation gated on victim interaction, consistent with a social-engineering or malicious-redirect delivery. No public exploit exists and CISA has not added this to KEV; EPSS of 0.22% (13th percentile) and SSVC Exploitation:none collectively indicate low active exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already achieved renderer process compromise to escape PDF-layer sandboxing controls via a crafted HTML page, circumventing browser navigation security boundaries. This is a chained-attack-only scenario: the flaw is not independently exploitable and requires a prior renderer compromise as a prerequisite. No public exploit has been identified, EPSS is 0.22% (13th percentile), and SSVC rates exploitation as none - making this a theoretical second-stage risk rather than an immediate standalone threat. Vendor-released patch is confirmed at version 150.0.7871.47.
Process memory disclosure in Google Chrome DevTools on Windows (versions prior to 150.0.7871.47) allows a remote attacker to read potentially sensitive data from browser process memory by serving a crafted HTML page and convincing a user to perform specific UI gestures. The flaw stems from insufficient input validation (CWE-20) within the DevTools subsystem and is limited to the Windows platform. No public exploit code or CISA KEV listing has been identified at time of analysis, but the confidentiality impact is rated High by NVD.
UI spoofing in Google Chrome's Passwords component (all versions prior to 150.0.7871.47) enables remote, unauthenticated attackers to misrepresent critical interface elements to users via a specially crafted HTML page. The flaw stems from an inappropriate implementation (CWE-451) in Chrome's password management UI, meaning a malicious page can render deceptive credential-related prompts or overlays that appear to originate from the browser's trusted Passwords subsystem. No public exploit code has been identified and CISA SSVC rates active exploitation as none, making this a moderate-priority patching item rather than an emergency response.
Same-origin policy bypass in Google Chrome's Blink rendering engine (versions prior to 150.0.7871.47) enables remote attackers to violate cross-origin isolation by delivering a crafted HTML page to a victim user. The flaw originates in Blink's insufficient validation of untrusted input (CWE-20), resulting in a limited integrity impact when a user browses to attacker-controlled content. No active exploitation is confirmed - SSVC classifies exploitation as none, EPSS sits at 0.22% (13th percentile), and the vulnerability is absent from CISA KEV - and a vendor patch has been released in Chrome 150.0.7871.47.
Uninitialized memory use in the codec subsystem of Google Chrome on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. All Chrome for Windows releases prior to 150.0.7871.47 are affected; the flaw is platform-specific and does not affect Chrome on Linux, macOS, or mobile. No public exploit code has been identified and this vulnerability is absent from the CISA KEV catalog, though the CVSS C:H rating reflects meaningful confidentiality risk, and the uninitialized read could serve as a precursor step toward ASLR bypass in a chained attack.
Incorrect security UI in Google Chrome's Extensions subsystem prior to version 150.0.7871.47 enables Universal Cross-Site Scripting (UXSS), allowing script or HTML injection across web origins via a crafted HTML page. Exploitation requires that the victim user be socially engineered into installing a malicious extension, after which a crafted page triggers the CWE-79 flaw in the Extensions UI. No public exploit exists at time of analysis, EPSS sits at the 4th percentile, and CISA has not listed this in KEV, consistent with the SSVC exploitation:none assessment.
UI spoofing in Google Chrome's PageInfo component (all versions prior to 150.0.7871.47) enables remote attackers to misrepresent the browser's security indicators through a crafted HTML page that induces specific user UI gestures. The flaw (CWE-451) causes the PageInfo panel - the panel users consult to evaluate site trustworthiness - to render incorrect security UI, potentially deceiving victims into trusting malicious or unverified origins. No public exploit code has been identified and this vulnerability is not listed in the CISA KEV catalog; exploitation requires high attack complexity and deliberate user interaction, keeping real-world risk moderate despite the ubiquitous deployment footprint of Chrome.
Insufficient XML policy enforcement in Google Chrome on Android (prior to 150.0.7871.47) exposes process memory contents to remote attackers who can deliver a crafted HTML page. The flaw is classified under CWE-284 (Improper Access Control), allowing the browser's XML handling to bypass intended isolation boundaries and leak potentially sensitive in-process data - such as cookies, credentials, or other runtime state - to an attacker-controlled origin. No active exploitation is confirmed in CISA KEV and no public proof-of-concept has been identified at time of analysis, though the CVSS score of 6.5 (Medium) reflects meaningful real-world risk given the zero-authentication, high-confidentiality-impact profile.
Navigation restriction bypass in Google Chrome's SplitView feature (prior to 150.0.7871.47) enables a remote attacker who has already achieved renderer process compromise to escape navigation controls via a crafted HTML page. The CWE-284 (Improper Access Control) root cause means Chrome's SplitView fails to enforce navigation policy in a post-renderer-compromise context, making this a chained exploit component rather than a standalone initial-access vector. EPSS is very low (0.22%, 13th percentile), no public exploit code has been identified, and SSVC rates exploitation as none with partial technical impact at time of analysis.
Cross-origin data leakage in Google Chrome's PerformanceAPI implementation (versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to infer sensitive data from other browser origins by luring a victim to visit a crafted HTML page. The flaw exploits timing measurements exposed by the Performance API to create a side-channel that bypasses the Same-Origin Policy for limited data reads. No public exploit code or active exploitation (CISA KEV) has been identified; EPSS probability stands at 0.21% (11th percentile), consistent with SSVC's 'exploitation: none' assessment.
Uninitialized GPU memory use in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to read sensitive data from GPU process memory by delivering a crafted HTML page. This is a second-stage information disclosure primitive - exploitation is contingent on a prior renderer compromise, making it a component of a multi-vulnerability attack chain rather than a standalone critical issue. No public exploit code or CISA KEV listing has been identified at time of analysis; Google has released a patched stable channel build (150.0.7871.47).
Insufficient policy enforcement in the Payments component of Google Chrome on Android prior to 150.0.7871.47 exposes potentially sensitive data from process memory to remote attackers. Exploitation requires a victim to visit a specially crafted HTML page, making this a user-interaction-dependent, network-delivered information disclosure. No active exploitation is confirmed (SSVC: Exploitation: none; not listed in CISA KEV), and no public exploit code has been identified at time of analysis, though the CVSS confidentiality impact is rated High due to the potential for process memory leakage.
Uninitialized memory read in Google Chrome's XR (Extended Reality/WebXR) subsystem exposes process memory to a remote attacker who has already achieved renderer process compromise. Affected versions are all Chrome releases prior to 150.0.7871.47. This is a second-stage, chained vulnerability - an attacker leverages a crafted HTML page to trigger the uninitialized read and extract sensitive data from process memory, but only after separately exploiting a renderer process escape. No public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data leakage in Google Chrome on iOS (prior to 150.0.7871.47) stems from an inappropriate implementation in the ScriptInjections subsystem, exploitable by a remote attacker who can lure a victim to a crafted HTML page. The flaw allows the attacker's origin to read data belonging to a different, protected origin - a fundamental violation of the Same-Origin Policy on Apple's iOS platform. No public exploit code has been identified at time of analysis, EPSS places exploitation probability at 0.22% (13th percentile), and SSVC signals no observed active exploitation, making this a medium-priority patch item despite its cross-origin impact.
Uninitialized memory use in Chrome's CSS engine on Android exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Unauthenticated remote attackers can trigger this information leak against any Android Chrome user who visits attacker-controlled content (CVSS PR:N, UI:R), with high confidentiality impact per the CVSS vector. Notably, Chromium's internal severity rating is Medium despite the C:H CVSS impact, suggesting reliable extraction of useful sensitive data may be inconsistent in practice; no public exploit code or CISA KEV listing exists at time of analysis.
UI spoofing in Google Chrome for Android's SiteSettings component (versions prior to 150.0.7871.47) enables remote attackers to deceive users about site origin or permission context via a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could cause victims to grant permissions to unintended origins or trust fraudulent site identity indicators. No public exploit or active exploitation has been identified; CISA SSVC and EPSS both confirm minimal real-world exploitation pressure at this time.
Uninitialized memory exposure in Google Chrome's Cast component prior to 150.0.7871.47 allows an unauthenticated attacker on the same local network segment to leak sensitive contents from the browser's process memory via malicious Cast protocol traffic. The root cause is CWE-457 (Use of Uninitialized Variable): memory allocated for Cast operations is not zeroed before use, allowing residual in-memory data - potentially including credentials, session tokens, or cached page content - to be disclosed in responses to crafted network input. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis; Google has released a patched build.
Cross-origin credential data leakage in Google Chrome's Passwords component (prior to 150.0.7871.47) enables a renderer-level attacker to exfiltrate saved passwords across origins via a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-284) in Chrome's built-in password manager, exploitable only when the attacker has already achieved renderer process compromise - making this a second-stage component in an exploit chain rather than a standalone threat. No public exploit is identified at time of analysis, and EPSS at 0.21% (11th percentile) alongside SSVC exploitation status of 'none' confirms limited real-world exploitation activity.
Memory disclosure in Google Chrome's Passwords component on Android prior to 150.0.7871.47 allows a remote attacker to extract potentially sensitive information from process memory. Exploitation requires luring a target user to visit a specially crafted HTML page, placing this squarely in the social-engineering-assisted drive-by category. No public exploit code has been identified at time of analysis, but the high confidentiality impact (C:H in CVSS) indicates meaningful credential exposure risk given Chrome's role as a primary password manager on Android devices.
Side-channel information leakage via the ComputePressure API in Google Chrome prior to 150.0.7871.47 enables remote attackers to read cross-origin data by inducing a victim to visit a crafted HTML page. The vulnerability exploits physical or logical resource-pressure side channels exposed through the ComputePressure browser API, violating the same-origin policy's confidentiality guarantees. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.21% (11th percentile) corroborates the low near-term exploitation probability despite the high confidentiality impact rating.
Insufficient policy enforcement in Chrome's built-in Passwords subsystem (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to read potentially sensitive credential data from process memory via a crafted HTML page. This is a second-stage, chained information-disclosure flaw - not a standalone exploit - that bypasses Chrome's inter-process access boundaries to reach password manager data. No public exploit code has been identified at time of analysis, and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Cross-origin data exfiltration in Google Chrome's Sharing feature on Android exposes sensitive page content to remote attackers who have already compromised the renderer process, exploitable via a crafted HTML page. All Chrome for Android builds prior to 150.0.7871.47 are affected; the fixed release is confirmed by Google's stable channel advisory. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate negligible observed exploitation pressure at time of analysis, though the high confidentiality impact and ubiquitous deployment of Chrome on Android make patching a clear priority.
UI spoofing in Google Chrome on Windows (prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to manipulate the browser interface via a specially crafted HTML page, potentially deceiving users into interacting with falsified content or controls. The vulnerability stems from an inappropriate implementation in the Media component and is classified as medium severity (CVSS 6.5). No public exploit code or active exploitation has been identified - EPSS sits at the 11th percentile (0.21%) and no CISA KEV listing exists - and a vendor patch is confirmed available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome prior to version 150.0.7871.47 enables remote attackers to circumvent browser policy enforcement via a crafted HTML page targeting the 'Actor' component. The flaw is rooted in CWE-602 (Client-Side Enforcement of Server-Side Security), where controls that should be authoritative are applied within the browser and can be subverted by an adversary-controlled page. EPSS at 0.22% (13th percentile) indicates low current exploitation probability, no public exploit code has been identified, and the vulnerability is not listed in CISA KEV; no public exploit identified at time of analysis.
Navigation restriction bypass in Google Chrome's DevTools component on Android (all versions prior to 150.0.7871.47) allows a local attacker to circumvent policy-enforced browsing controls by delivering a crafted malicious file. The vulnerability is confined to Android - desktop Chrome is not in scope - and requires user interaction with the malicious file, substantially narrowing the realistic attack surface. No public exploit code exists and no active exploitation has been confirmed; an EPSS score of 0.14% (3rd percentile) corroborates low real-world exploitation probability at time of analysis.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to circumvent Chrome's network navigation controls via a crafted HTML page. The vulnerability stems from CWE-20 (Improper Input Validation) in Chrome's Network component, producing a high-integrity impact with no confidentiality or availability loss. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (13th percentile) places exploitation likelihood well below the median, though the pre-compromised renderer prerequisite makes this a chained attack vector relevant primarily within multi-stage browser exploitation chains.
Same-origin policy bypass in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to perform cross-origin integrity violations by serving a crafted HTML page. Affected versions are all Chrome for Android releases prior to 150.0.7871.47. This is explicitly a chained attack requiring a pre-existing renderer compromise, making it a second-stage exploit rather than a standalone entry point. No public exploit code exists and no public exploitation has been confirmed at time of analysis.
Uninitialized GPU memory use in Google Chrome on Android prior to 150.0.7871.47 allows a remote attacker to read potentially sensitive data from process memory by luring a user to a crafted HTML page. The flaw (CWE-457) is confined to the Android GPU code path and requires only user interaction to trigger, with CVSS confirming unauthenticated network delivery and High confidentiality impact. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Google has released a fix in stable channel version 150.0.7871.47.
Side-channel cross-origin data leakage in Google Chrome's Paint rendering component (all versions prior to 150.0.7871.47) allows remote attackers to infer sensitive content belonging to other origins by enticing a victim to visit a crafted HTML page. The vulnerability exploits a weakness in the Paint subsystem's rendering pipeline (CWE-1300: Improper Protection of Physical Side Channels), enabling an attacker page to observe rendering state or timing variations and reconstruct protected cross-origin data. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; EPSS probability is low at 0.21% (11th percentile). Vendor-released patch is available in Chrome 150.0.7871.47.
Same-origin policy bypass in Google Chrome's DeviceBoundSessionCredentials component allows remote attackers to violate cross-origin isolation guarantees via a crafted HTML page. Affected are all Chrome desktop releases prior to 150.0.7871.47 on all supported platforms. Exploitation requires user interaction (visiting an attacker-controlled page) and yields high integrity impact - enabling cross-origin state manipulation - with no confidentiality or availability consequence. No active exploitation is confirmed (not in CISA KEV), EPSS is low at 0.22% (13th percentile), and SSVC rates exploitation as none with partial technical impact; a vendor patch is available.
Site isolation bypass in Google Chrome prior to 150.0.7871.47 enables a remote attacker who has already compromised the renderer process to circumvent extension policy enforcement and escape site isolation boundaries via a crafted HTML page. The root cause (CWE-602) is client-side enforcement of security policies in the Extensions subsystem that can be subverted once the renderer is under attacker control. No active exploitation has been confirmed - EPSS is 0.22% (13th percentile), SSVC rates exploitation as none and the attack as non-automatable - and a vendor-released patch is available in Chrome 150.0.7871.47.
Navigation restriction bypass in Google Chrome for iOS (prior to 150.0.7871.47) allows a remote attacker to subvert browser-enforced navigation controls by luring a user into performing specific UI gestures on a crafted HTML page. Classified as CWE-20 (Improper Input Validation), the flaw undermines integrity by permitting unauthorized navigation that the browser is intended to block. No public exploit code exists and EPSS sits at 0.22% (13th percentile), indicating low observed exploitation probability; the vulnerability is not listed in CISA KEV.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 allows a remote attacker to misrepresent browser interface elements - such as the address bar or origin indicators - by serving a crafted HTML page, potentially deceiving users into trusting malicious content. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms network-reachable exploitation with no privilege requirement but mandatory user interaction, limiting impact to partial integrity loss with no confidentiality or availability effect. No public exploit or active exploitation has been identified; an EPSS score of 0.21% at the 11th percentile indicates very low current exploitation probability, and this vulnerability does not appear in the CISA KEV catalog.
Chrome's built-in Passwords subsystem on macOS leaks sensitive process memory contents when a malicious file is processed, potentially exposing stored credentials or authentication tokens to a local attacker. All Google Chrome releases for Mac prior to 150.0.7871.47 are affected. No public exploit code has been identified at time of analysis, and this vulnerability is not listed in CISA KEV; however, the confidentiality impact is rated High given the nature of the data at risk within the Passwords feature.
Cross-origin data leakage in Google Chrome's Autofill subsystem on iOS (versions prior to 150.0.7871.47) enables remote attackers to read sensitive data across origin boundaries by luring victims into performing specific UI gestures on a crafted page. Rooted in CWE-346 (Origin Validation Error), the Autofill policy enforcement layer fails to maintain proper origin isolation under targeted interaction conditions. With an EPSS of 0.21% (11th percentile) and no CISA KEV listing, no public exploit identified at time of analysis, though the CVSS-rated High confidentiality impact warrants prompt patching given Chrome's broad iOS deployment footprint.
UI spoofing in Google Chrome's Safe Browsing component on iOS enables remote attackers to mislead users through a crafted HTML page, potentially causing them to dismiss or misinterpret security warnings. Only Chrome for iOS versions prior to 150.0.7871.47 are affected; the desktop channel is not impacted by this specific flaw. No public exploit code exists and exploitation probability is very low (EPSS 0.21%, 11th percentile), though the network-accessible, zero-authentication attack surface keeps it relevant where phishing-style delivery is feasible.
Insufficient policy enforcement in the Spellcheck component of Google Chrome prior to 150.0.7871.47 exposes process memory to attackers who have already achieved renderer process compromise. The vulnerability enables a second-stage information disclosure step in a chained attack: after compromising the renderer, the attacker serves a crafted HTML page that exploits the Spellcheck policy gap to read potentially sensitive data from memory. No public exploit code or active exploitation via CISA KEV has been identified at time of analysis; Google has released a fix in the stable channel update.
Cross-origin data leakage in the WebXR implementation of Google Chrome on Android (versions prior to 150.0.7871.47) allows remote unauthenticated attackers to exfiltrate sensitive cross-origin information by enticing a victim to visit a crafted HTML page. The flaw is rooted in CWE-693 (Protection Mechanism Failure), where WebXR fails to enforce cross-origin isolation policies on Android specifically. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating low observed exploitation probability; the vulnerability is not listed in the CISA KEV catalog.
Navigation restriction bypass in Google Chrome's Omnibox on iOS (prior to 150.0.7871.47) enables a remote attacker to circumvent address bar security controls through insufficient input validation, contingent on user interaction with specific UI gestures during exposure to malicious network traffic. The integrity impact is rated High (I:H) with no confidentiality or availability impact, consistent with a content/navigation spoofing class of vulnerability. No public exploit code or CISA KEV listing has been identified; EPSS score of 0.20% (10th percentile) indicates low observed exploitation probability at time of analysis.
Out-of-bounds read in Google Chrome's Codecs component (prior to 150.0.7871.47) enables remote attackers to leak sensitive data from renderer process memory by delivering a crafted HTML page. The CVSS C:H rating reflects meaningful exposure of in-process data such as session tokens or credentials, though Chromium's own team assessed this as Medium severity, and the sandbox boundary (S:U) limits blast radius to the renderer. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition exploitation in Google Chrome for iOS (prior to 150.0.7871.47) exposes potentially sensitive data from process memory to a local attacker with physical device access. The flaw is rooted in improper synchronization (CWE-362) and requires high attack complexity to successfully win the timing window. No public exploit has been identified and the vulnerability is not listed in CISA KEV; the vendor has released a patching fix in the 150.0.7871.47 stable channel update.
Navigation restriction bypass in Google Chrome's Safe Browsing implementation on iOS allows a remote, unauthenticated attacker to circumvent phishing and malicious-site protections via a specially crafted HTML page, affecting all Chrome for iOS versions prior to 150.0.7871.47. The flaw is classified as CWE-693 (Protection Mechanism Failure), meaning the Safe Browsing guard can be rendered ineffective rather than defeated through cryptographic or authentication means. No public exploit or CISA KEV listing has been identified, and the EPSS score of 0.23% (14th percentile) signals low current exploitation probability - but the zero-prerequisite network delivery and high integrity impact make this a meaningful risk for iOS users who have not updated.
UI spoofing in Google Chrome for iOS prior to version 150.0.7871.47 enables remote attackers to misrepresent browser interface elements - such as address bars or security indicators - by delivering a crafted HTML page to a victim on an iOS device. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw exploits an inappropriate implementation specific to Chrome's iOS code path, which differs from desktop Chrome due to WKWebView constraints imposed by Apple. No public exploit code exists, CISA SSVC rates exploitation as none, and EPSS sits at the 12th percentile, indicating minimal real-world threat at time of analysis.
Navigation restriction bypass in Google Chrome's Chromecast implementation (versions prior to 150.0.7871.47) allows a remote attacker who has already compromised the renderer process to circumvent navigation restrictions via a specially crafted HTML page. This is a post-compromise escalation primitive rather than a standalone entry point - the renderer must already be under attacker control, making this a link in an exploit chain rather than an initial access vector. No public exploit has been identified at time of analysis; EPSS at 0.23% (14th percentile) reflects very low observed exploitation probability, consistent with the chained-exploit requirement.
Navigation restriction bypass in Google Chrome's Glic feature (versions prior to 150.0.7871.47) enables remote attackers to circumvent policy enforcement controls by delivering a crafted HTML page that triggers insufficient validation logic. The flaw maps to CWE-602, meaning security enforcement intended to be authoritative is implemented client-side in a bypassable manner, resulting in high integrity impact with no confidentiality or availability consequence. No public exploit or active exploitation has been identified at time of analysis, and EPSS at 0.22% (13th percentile) reflects low current exploitation probability.
UI spoofing via Chrome's Autofill component affects all desktop installations prior to version 150.0.7871.47, enabling a remote attacker to misrepresent interface elements through a crafted HTML page. Exploitation requires both navigating to an attacker-controlled page and performing specific UI gestures, reflected in CVSS AC:H and UI:R - passive browsing is insufficient. No public exploit code has been identified and the vulnerability is not listed in CISA KEV; the CVSS 4.2 Medium score reflects limited integrity and availability impact with no confidentiality loss.
Navigation restriction bypass in Google Chrome prior to 150.0.7871.47 enables a network-positioned attacker to circumvent browser-enforced navigation policies via a crafted HTML page. The attacker must occupy a privileged network position (e.g., man-in-the-middle) and requires user interaction with the malicious page, per the CVSS UI:R and the description's explicit network-position prerequisite. With an EPSS of 0.15% at the 5th percentile, no public exploit code, and no CISA KEV listing, exploitation probability is low - this is a medium-severity issue with a meaningful but situational attack barrier.
Cross-origin data exfiltration in Google Chrome's WebUI component (versions prior to 150.0.7871.47) enables remote attackers to leak sensitive data across origin boundaries by delivering crafted malicious network traffic to an unpatched browser. The flaw arises from insufficient input validation (CWE-20) within the WebUI layer, undermining same-origin policy protections and exposing data from isolated origins to attacker-controlled contexts. No active exploitation is confirmed - the vulnerability is absent from CISA KEV, EPSS sits at 0.20% (10th percentile), and no public POC has been identified; a vendor-released patch is available in Chrome 150.0.7871.47.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 exposes sensitive information from other origins when a remote attacker convinces a victim to perform specific UI gestures on a crafted HTML page. The flaw stems from an inappropriate implementation in the iOS-specific Chrome browser layer, classified under CWE-451 (UI Misrepresentation), and enables confidentiality compromise without requiring attacker privileges. No public exploit code has been identified at time of analysis, and EPSS at 0.22% (12th percentile) signals low near-term automated exploitation risk.
Out-of-bounds read in the Chromecast component of Google Chrome prior to 150.0.7871.47 enables a remote attacker, who has already achieved renderer process compromise, to exfiltrate potentially sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - it cannot be exploited in isolation and requires a prior renderer compromise as a prerequisite. Google has released a patch in Chrome 150.0.7871.47; no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data leakage in Google Chrome's NFC implementation on Android exposes sensitive information to attackers who have already compromised the renderer process. Chrome versions prior to 150.0.7871.47 on Android fail to properly validate origins when handling NFC interactions, allowing a renderer-level attacker to read data across origin boundaries via a crafted HTML page. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at the 11th percentile, indicating low observed exploitation probability despite the theoretical confidentiality impact.
Content Security Policy bypass in Google Chrome's Isolated Web Apps (IWA) subsystem allows remote attackers to circumvent enforcement mechanisms via a specially crafted HTML page, resulting in high-integrity impact with no confidentiality or availability consequence. Affected versions are all Chrome releases prior to 150.0.7871.47. User interaction is required - the victim must visit the attacker-controlled page - and no public exploit or CISA KEV listing has been identified at time of analysis. The low EPSS score of 0.22% (13th percentile) reinforces that active exploitation is not currently observed.
Same-origin policy bypass in Google Chrome's WebAppInstalls component allows remote attackers to compromise cross-origin integrity via a crafted HTML page, affecting all Chrome versions prior to 150.0.7871.47. The flaw stems from an inappropriate implementation (CWE-346, Origin Validation Error) in the PWA installation subsystem, enabling an attacker to perform unauthorized cross-origin writes or manipulations when a user visits attacker-controlled content. No public exploit identified at time of analysis, and the EPSS score of 0.23% (14th percentile) indicates low near-term exploitation probability, though the ubiquitous deployment of Chrome elevates aggregate exposure.
Use-after-free in Google Chrome's Bluetooth subsystem (all versions prior to 150.0.7871.47) enables an unauthenticated attacker within Bluetooth radio range to leak sensitive data from Chrome's process memory by operating a malicious Bluetooth peripheral. The CVSS vector (AV:A/PR:N/UI:N/C:H) confirms no attacker-side authentication is required and impact is confidentiality-only, with no integrity or availability loss. No public exploit code has been identified at time of analysis and CISA has not listed this in KEV; the Chromium security team rated this Medium severity, consistent with the bounded adjacency-only attack vector.
Process memory disclosure in Google Chrome's ANGLE graphics abstraction layer (versions prior to 150.0.7871.47) enables a renderer-compromised attacker to read potentially sensitive data from process memory via a crafted HTML page. This is a post-exploitation, second-stage vulnerability: it cannot be triggered without a prior renderer process compromise, functioning as a chaining component rather than a standalone entry point. No public exploit code or CISA KEV listing has been identified at time of analysis; Chromium's own team rates it Medium severity, consistent with the prerequisite attack complexity.
Content Security Policy bypass in Google Chrome prior to 150.0.7871.47 is achievable by an attacker holding a privileged network position who can manipulate traffic between the victim's browser and a server. The flaw originates in Chrome's Network component (CWE-693: Protection Mechanism Failure), where an inappropriate implementation allows CSP enforcement to be circumvented via crafted network traffic, yielding a High Integrity impact. No active exploitation is confirmed - the vulnerability is absent from CISA KEV and carries an EPSS score of 0.15% (4th percentile) - but the attack vector is unauthenticated and the integrity impact is significant for high-value targets on adversarial networks.
Memory disclosure in Google Chrome's GPU component on Windows enables a remote attacker - who has already established renderer process compromise - to extract sensitive data from process memory via a crafted HTML page. Affected versions are all Chrome for Windows releases prior to 150.0.7871.47. This is a second-stage exploit component: it does not independently achieve remote code execution but can be chained with a renderer exploit to leak process memory contents, potentially exposing credentials, tokens, or other in-memory sensitive data. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Race condition in the DataTransfer API in Google Chrome prior to 150.0.7871.47 allows a remote attacker to read potentially sensitive data from renderer process memory by luring a user to a specially crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) confirms the impact is limited to confidentiality - no integrity or availability loss - and that reliable exploitation requires winning a timing race (AC:H) combined with user interaction. No public exploit identified at time of analysis; Google has shipped a patch in the stable channel update dated June 2026.
Out-of-bounds read in Chrome's Layout engine prior to 150.0.7871.47 allows remote attackers to leak potentially sensitive data from the renderer process memory by serving a crafted HTML page. User interaction is required - the victim must visit the malicious page - limiting automated mass exploitation. No public exploit code has been identified at time of analysis, and CISA SSVC rates exploitation status as none with partial technical impact, placing real-world urgency below what the CVSS 6.5 score alone might suggest.
GuestView policy enforcement in Google Chrome prior to 150.0.7871.47 can be subverted by an attacker who has already achieved renderer process compromise, allowing site isolation to be bypassed via a crafted HTML page. The flaw (CWE-602: Client-Side Enforcement of Server-Side Security) enables manipulation of cross-origin content or policy in embedded browsing contexts that Chrome's site isolation architecture is designed to protect. No public exploit code has been identified and EPSS places exploitation probability at 0.22% (13th percentile), consistent with the elevated prerequisite of a prior renderer compromise required to trigger this vulnerability.
Site isolation bypass in Google Chrome on Android prior to 150.0.7871.47 enables a remote attacker - who has already achieved renderer process compromise via a separate exploit - to break cross-origin security boundaries using a crafted HTML page. The root cause is CWE-346 (Origin Validation Error) in Chrome's Android-specific network implementation, meaning the network layer fails to enforce origin checks when requests originate from a compromised renderer context. No active exploitation is confirmed (not in CISA KEV), and the EPSS score of 0.22% at the 13th percentile reflects the high chaining complexity required.
UI spoofing via Chrome's Geolocation implementation (versions prior to 150.0.7871.47) allows a remote, unauthenticated attacker to deceive users about the origin or context of geolocation permission requests through a crafted HTML page. Exploitation requires user interaction with the malicious page, limiting automated attack potential. With EPSS at 0.21% (11th percentile), no CISA KEV listing, and no public exploit identified, real-world exploitation risk is low despite the broad deployment footprint of Chrome.
Site isolation bypass in Google Chrome for Android (prior to 150.0.7871.47) allows a remote attacker who has already achieved renderer process compromise to cross origin boundaries using a crafted HTML page, enabling high-integrity impact against other open sites. The root cause is CWE-20 (Improper Input Validation) within Chrome's Input subsystem on Android - an input handling implementation flaw that fails to enforce cross-origin separation once the renderer is under adversary control. No public exploit has been identified at time of analysis and EPSS sits at 0.22% (13th percentile), placing this firmly in the category of a meaningful escalation primitive rather than a standalone mass-exploitation risk.
UI spoofing in Google Chrome Enterprise prior to version 150.0.7871.47 allows unauthenticated remote attackers to deceive users into believing they are interacting with legitimate browser UI by serving a crafted HTML page. The root cause is insufficient validation of untrusted HTML input within Chrome's Enterprise component (CWE-20), enabling an attacker to manipulate visual elements such as address bars, dialog prompts, or permission requests. No public exploit has been identified at time of analysis and EPSS sits at 0.21% (11th percentile), indicating low current exploitation probability despite a network-accessible attack vector.
Insufficient Web Authentication (WebAuthn/Passkeys) policy enforcement in Google Chrome on iOS prior to 150.0.7871.47 enables cross-origin data leakage to an attacker controlling a privileged network position. The flaw stems from CWE-693 (Protection Mechanism Failure) in the browser's WebAuthn subsystem, which fails to enforce origin isolation correctly when processing crafted HTML pages. No public exploit code exists and CISA has not listed this in KEV, but the high confidentiality impact (C:H) and the specificity of Chrome-on-iOS as the attack surface make this a targeted patching priority for organizations with a managed iOS fleet.
UI spoofing in Google Chrome's Autofill component on Windows (all versions prior to 150.0.7871.47) allows a remote unauthenticated attacker to mislead users into interacting with forged security UI elements by convincing them to perform specific on-page gestures against a crafted HTML page. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an adversary to obscure or fabricate Autofill security indicators, potentially tricking users into submitting saved credentials or personal data to attacker-controlled destinations. No public exploit or CISA KEV listing has been confirmed; Google has released a fix in stable channel version 150.0.7871.47.
Out-of-bounds read in Chrome's bundled FFmpeg video decoding component (all versions prior to 150.0.7871.47) allows a remote attacker to leak renderer process memory contents via a crafted video file. The CVSS vector confirms network reachability with no required privileges (PR:N) but mandates user interaction (UI:R), meaning the victim must process the malicious video. SSVC assessment rates exploitation as none and the attack non-automatable, and no public exploit has been identified at time of analysis; Google has released a patched build at 150.0.7871.47.
UI spoofing via crafted HTML in Google Chrome's Geometry component (versions prior to 150.0.7871.47) enables remote attackers to misrepresent security-critical interface elements to users who are socially engineered into performing specific UI gestures. The flaw stems from an inappropriate implementation in Chrome's Geometry subsystem (CWE-451), affecting the integrity and availability of the browser interface at low impact levels. No public exploit or active exploitation has been identified; Google has released a confirmed patch in version 150.0.7871.47.
Cross-origin data leakage in Google Chrome for iOS prior to 150.0.7871.47 enables remote attackers to exfiltrate sensitive information from other origins by luring victims to a crafted HTML page that exploits insufficient input validation. The vulnerability carries a CVSS 6.5 with high confidentiality impact (AV:N/PR:N/C:H) but requires user interaction and is iOS-platform-specific, constraining the realistic attack surface. No public exploit or active exploitation has been identified at time of analysis; EPSS is 0.22% at the 12th percentile and SSVC rates exploitation as none.
Omnibox spoofing in Google Chrome for iOS prior to 150.0.7871.47 enables remote unauthenticated attackers to display a falsified URL in the browser address bar by delivering a crafted HTML page to an iOS user. The flaw is classified CWE-451 (UI misrepresentation of critical information) and is iOS-platform-specific, with no impact on Chrome for Android, Windows, macOS, or Linux. No active exploitation is confirmed - the vulnerability is not listed in CISA KEV and EPSS sits at 0.22% (12th percentile) - but the spoofing primitive is a classic enabler of targeted phishing campaigns against mobile users.
Cross-origin data leakage in Google Chrome's Canvas component prior to version 150.0.7871.47 exposes sensitive cross-origin content to remote attackers via a crafted HTML page. The flaw bypasses Same-Origin Policy protections enforced at the Canvas API layer, enabling pixel-level or structured data extraction from cross-origin resources rendered in a canvas context. With CVSS 6.5, EPSS at 0.21% (11th percentile), and no CISA KEV listing or public exploit identified at time of analysis, real-world exploitation is low-probability but credible given the zero-privilege, network-accessible attack path requiring only a single user visit.
Same-origin policy bypass in Google Chrome's CSS engine allows a remote, unauthenticated attacker to undermine web isolation guarantees by serving a crafted HTML page to an unsuspecting user. All Chrome releases prior to 150.0.7871.47 are affected. No public exploit code or active exploitation has been confirmed; SSVC rates exploitation as 'none' and EPSS sits at the 13th percentile, placing real-world urgency below what the I:H CVSS score alone might suggest.
Same-origin policy bypass in Google Chrome's CSS implementation allows a remote, unauthenticated attacker to violate cross-origin integrity protections by luring a user to a crafted HTML page. All Chrome versions prior to 150.0.7871.47 are affected. Google has released a patch; no active exploitation is confirmed (not listed in CISA KEV), and the EPSS score of 0.22% at the 13th percentile indicates low current exploitation probability.
UI spoofing in Google Chrome before 150.0.7871.47 allows remote unauthenticated attackers to visually deceive users by serving a crafted HTML page that exploits a flaw in Chrome's CSS implementation. The flaw (CWE-451: UI Misrepresentation of Critical Information) enables attacker-controlled content to obscure or mimic trusted browser UI elements such as the address bar or security indicators, creating a credible phishing surface. No public exploit has been identified at time of analysis, and the EPSS score of 0.22% (12th percentile) indicates minimal observed exploitation activity; however, Google's internal Chromium severity rating of 'High' reflects the significant phishing and credential-theft potential inherent in convincing browser UI spoofing.
Universal Cross-Site Scripting (UXSS) in Google Chrome's CSS implementation prior to version 150.0.7871.47 allows a remote attacker to inject arbitrary scripts or HTML across origin boundaries by luring a victim to a crafted HTML page. The flaw exploits an inappropriate handling of CSS that causes Chrome's renderer to break the same-origin policy, enabling script execution in the context of other origins. No public exploit or CISA KEV listing has been identified; EPSS probability is very low (0.21%, 12th percentile), suggesting limited active exploitation at time of analysis.
Cross-origin data leakage in Google Chrome's ANGLE graphics library on macOS allows a remote attacker to exfiltrate sensitive cross-origin data by luring a victim to a crafted HTML page. Affected are all Chrome versions on Mac prior to 150.0.7871.47. The flaw stems from uninitialized memory use within ANGLE, Chrome's graphics abstraction layer, enabling residual memory contents from other security origins to be read and potentially returned to an attacker-controlled page. No public exploit code or active exploitation has been identified at time of analysis; EPSS is low at 0.23% (13th percentile), consistent with a high-CVSS flaw constrained by both user-interaction and platform requirements.
Memory disclosure in Google Chrome's Enterprise policy implementation exposes sensitive process memory contents to remote attackers who can direct victims to a crafted HTML page. All Chrome desktop releases prior to 150.0.7871.47 are affected. No public exploit code exists and CISA SSVC classifies exploitation status as none, but the high confidentiality impact and zero-privilege-required attack path make prompt patching advisable for enterprise-managed Chrome deployments.