Suse
Monthly
Missing authorization in Chrome's DOM implementation prior to version 153.0.8010.36 allows remote attackers to potentially leak sensitive information by luring a victim to a crafted HTML page. Rooted in CWE-862 (Missing Authorization), the flaw permits script or page contexts to access DOM nodes or properties without proper access-control enforcement, potentially bypassing intended cross-context isolation. No public exploit code exists and CISA has not listed this in KEV; EPSS of 0.22% (12th percentile) and SSVC Exploitation:none confirm negligible current threat activity.
Cross-origin data leakage in Google Chrome's Core component (all versions prior to 153.0.8010.36) enables a remote attacker to exfiltrate data from origins other than the attacker-controlled context via a specially crafted Chrome extension. The extension acts as the delivery mechanism, causing Chrome's Core to expose cross-origin content it should otherwise isolate. EPSS sits at 0.15% and Chromium's own severity rating is Low, consistent with the limited, read-only confidentiality impact and the user-interaction requirement for extension installation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Let me synthesize. CVE-2026-87473: Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. CWE-863. Note the inconsistency: Chromium severity Low vs CVSS 6.5 medium. No KEV, no POC mentioned. EPSS 0.27% (low, 20th percentile). Patch available. Affected versions: EUVD says ["Chrome 153.0.8010.36 <153.0.8010.36"] which is weird/nonsensical — version range malformed. Should flag? That's a data quality thing but "Do NOT flag severity/CVSS/version disagreements here". Hmm, malformed version range — it's about version disagreement. I'll mention in confidence_notes but not flag as data_quality_flag (the types allowed are mislabeled_tag/wrong_vendor/wrong_product/missing_tag). So version issues go to confidence_notes. Tags: "Authentication Bypass, Google". CWE-863 is incorrect authorization — "Authentication Bypass" is arguably a mislabeled tag but it's close... Actually CWE-863 is Incorrect Authorization, not authentication bypass. Is this a "mislabeled_tag"? The allowed types: mislabeled_tag with target being exact wrong value and suggested correct slug. Hmm, "Authentication Bypass" — the CVE is an authorization bypass, which is similar. I'd say it's borderline; the instructions say only emit when clearly wrong and verifiable. I think I should be cautious — leave it empty or flag it? The tag "Authentication Bypass" for a CWE-863 incorrect authorization... "Authorization Bypass" would be more accurate. But it's arguably acceptable colloquially. Also "Google" is the vendor which is correct for Chrome. Missing tag: "chrome" or "google-chrome"? The product is Chrome. Tags list has "Google" which is vendor. Could flag missing_tag for "Chrome" → suggested "chrome". That's plausible and high confidence. Hmm, is "chrome" tag clearly applicable? The product is Google Chrome; tags
UI spoofing in Google Chrome's Passwords component on Android (prior to 153.0.8010.36) enables a remote attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. The CVSS 5.4 (Medium) rating contrasts with Chromium's own 'Low' severity classification, a common divergence for UI-redressing issues. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS of 0.16% (6th percentile) confirms negligible near-term exploitation probability.
Sensitive information disclosure in Google Chrome's Transactions Platform component prior to version 153.0.8010.36 enables remote attackers to extract unspecified sensitive data by directing a user to a crafted HTML page. The Transactions Platform is likely tied to Chrome's Web Payments API or payment handler subsystem, making transaction-context data a plausible disclosure surface. No public exploit code exists and EPSS sits at 0.16% (6th percentile); however, the vendor-assigned CVSS C:H metric indicates the leaked data carries meaningful sensitivity, creating a tension with Chromium's own 'Low' internal severity classification.
Missing authorization in the Contacts component of Google Chrome before 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to extract sensitive contact data by delivering a crafted HTML page through social engineering. This is a secondary, post-renderer-compromise vulnerability - not an initial access vector - and Chromium's own team rates it 'Low' severity, reflecting the elevated prerequisite chain. No public exploit has been identified, EPSS sits at 0.16% (5th percentile), and CISA SSVC rates exploitation likelihood as none, collectively indicating minimal real-world risk at this time.
UI spoofing in the Passwords component of Google Chrome on Android (versions prior to 153.0.8010.36) enables an attacker who has already compromised the renderer process to display falsified password-manager interface elements via a crafted HTML page. Exploitation is constrained by a hard prerequisite - a separate renderer compromise must precede this attack - and requires user interaction with the malicious page. No public exploit code exists and EPSS sits at 0.16% (6th percentile), in line with Chromium's own 'Low' severity classification.
Address bar spoofing in Google Chrome's CustomTabs feature on Android (prior to 153.0.8010.36) allows a remote attacker to display a falsified URL by leveraging a co-installed application on the victim's device. The flaw, rooted in CWE-451 (User Interface Misrepresentation of Critical Information), enables phishing attacks where users are deceived into believing they are visiting a trusted origin while interacting with attacker-controlled content. Chromium rates this 'Low' severity; EPSS is 0.16% (6th percentile), no public exploits are identified, and no active exploitation is confirmed.
Sensitive credential information leak in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36) enables a remote unauthenticated attacker to extract password data by luring a victim to a crafted HTML page. Despite Chromium classifying the severity as 'Low', the NVD CVSS vector assigns C:H reflecting that full credential disclosure is possible. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.21% (11th percentile) signals low automated exploitation pressure at time of analysis.
Information disclosure in Google Chrome's DataTransfer API via a TOCTOU race condition allows a remote attacker to obtain sensitive data from a victim's browser session. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. Exploitation requires social engineering to induce user interaction with a crafted HTML page - no active exploitation has been identified and EPSS sits at the 9th percentile, indicating very low real-world exploitation probability at this time.
Sensitive information disclosure in Google Chrome's Mobile component on iOS (versions prior to 153.0.8010.36) allows remote unauthenticated attackers to leak confidential browser data by luring victims to a crafted HTML page through social engineering. The flaw is platform-specific - affecting only the iOS Mobile code path, not desktop or Android - and is fixed in the 153.0.8010.36 stable channel release. No active exploitation is confirmed (not in CISA KEV) and EPSS probability is 0.17% (7th percentile), consistent with Chromium's own 'Low' severity rating, which contrasts with the NVD CVSS 6.5 Medium score.
Clickjacking via UI spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to overlay deceptive UI elements through a crafted HTML page, requiring additional social engineering to complete the attack. The vulnerability (CWE-1021) affects all desktop Chrome builds before the September 2026 stable-channel release. No public exploit code exists and no active exploitation has been identified; EPSS of 0.20% (10th percentile) reflects the low probability of opportunistic exploitation given the demanding prerequisites.
Incorrect type conversion (CWE-704) in Chrome's Safebrowsing component on macOS allows remote attackers to bypass system access restrictions by delivering a specially crafted file, requiring user interaction to trigger. All Chrome for Mac versions prior to 153.0.8010.36 are affected; Google released the fix in the September 2026 stable channel update. No public exploit code exists and EPSS sits at 0.17% (7th percentile), consistent with Chromium's own 'Low' severity designation.
Address bar spoofing in Google Chrome for Android (all versions before 153.0.8010.36) exploits incorrect certificate authorization logic (CWE-863), allowing a remote attacker who can deliver crafted network traffic - such as via a man-in-the-middle position - to cause the browser to display a false origin in the address bar. The primary risk is phishing: users who trust the spoofed address bar may submit credentials or sensitive data to an attacker-controlled endpoint. Chromium's own team rated this Low severity, consistent with its CVSS 4.8 score and AC:H rating; no public exploit code and no active exploitation have been identified, and the EPSS score of 0.12% (2nd percentile) confirms very low real-world exploitation probability at time of analysis.
Cross-origin information leakage in Google Chrome's Select element (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to infer sensitive user state by observing behavioral discrepancies in how the `<select>` element renders when a victim browses to a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), a classic browser side-channel class that enables cross-site information inference - for example, whether a user is authenticated to a third-party origin or has visited specific URLs. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with the Chromium team's own 'Low' severity rating despite NVD's CVSS 6.5.
UI spoofing via a confused deputy flaw in Google Chrome's Fullscreen API (all versions prior to 153.0.8010.36) enables a remote attacker who has already compromised the renderer process to impersonate browser-trusted UI elements using a crafted HTML page and social engineering. This is a secondary exploitation step - it does not provide initial access - and becomes relevant only after a separate, higher-severity renderer compromise has been achieved. No public exploit code or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects very low automated exploitation probability consistent with the chained, human-dependent attack path.
Observable SVG discrepancy in Google Chrome prior to 153.0.8010.36 enables remote attackers to infer sensitive cross-origin information by inducing measurable rendering behavioral differences via a crafted HTML page. The root cause is CWE-203, a side-channel class where an attacker observes system behavior variations to deduce protected state. No public exploit code or active exploitation is identified; Chromium's own 'Low' severity designation and an EPSS of 0.17% (7th percentile) together indicate limited real-world exploitation likelihood despite the NVD's C:H confidentiality metric.
Out-of-bounds read in the Tint WGSL shader compiler in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to read limited memory contents within the browser's renderer sandbox by directing a victim to a crafted HTML page. Scope is confined to the sandbox (S:U/C:L), with no integrity or availability impact and no sandbox escape; Chromium rates this 'Low' severity, consistent with the CVSS 4.3 score. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), indicating low exploitation probability; a vendor-released patch is available in Chrome 153.0.8010.36.
An interpretation conflict (CWE-436) in Google Chrome's Safe Browsing handling on macOS allows a remote attacker to bypass system access restrictions by convincing a victim to open a crafted file, all the way up to and including Chrome 153.0.8010.36. Exploitation requires the victim to interact with the file (CVSS UI:R) and yields an integrity-only impact (C:N/I:H/A:N), which is consistent with Chromium's own 'Low' severity rating despite the 6.5 base score. There is no CISA KEV listing and no public exploit identified; EPSS is only 0.17% (7th percentile), and Google has shipped a fix in version 153.0.8010.36.
Missing authorization checking in the DevTools component of Google Chrome before 153.0.8010.36 lets a crafted Chrome extension read cross-origin data that should be protected by the browser's same-origin policy. Only confidentiality is affected (CVSS 4.3, C:L/I:N/A:N), and exploitation requires the victim to install the malicious extension (UI:R), so impact is limited to information disclosure from other sites the user has open. Google has shipped a fix in the 153.0.8010.36 stable channel release; EPSS is 0.21% (12th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a low-priority hardening update rather than an emergency patch.
Safebrowsing in Google Chrome prior to 153.0.8010.36 fails to properly validate internal state transitions (CWE-754), enabling a remote attacker to bypass the browser's URL-based access restriction mechanism via a crafted HTML page. Successful exploitation requires the victim to visit the attacker-controlled page (UI:R) and yields limited confidentiality and integrity impacts (C:L/I:L) with no availability impact. Chromium's own severity rating of 'Low' is consistent with the constrained impact scope; no public exploit code and no KEV listing have been identified at time of analysis.
UI spoofing in Google Chrome prior to 153.0.8010.36 permits a remote attacker who has already compromised the renderer process to present falsified browser interface elements to the user through crafted network traffic. The root cause is improper input validation (CWE-20) in the Chromium rendering engine, allowing a compromised renderer to influence UI presentation in ways the browser should reject. No public exploit or CISA KEV listing exists; an EPSS of 0.16% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a second-stage, chained capability rather than a standalone high-risk flaw.
Missing authorization (CWE-862) in Chrome's WebView component on Android prior to 153.0.8010.36 allows remote attackers to bypass Android system access restrictions through crafted network traffic. Exploitation is gated behind social engineering - the attacker must trick a user into interacting with malicious content, yielding a high integrity impact but no confidentiality or availability consequence. Chromium's own team rated this 'Low' severity, a notable divergence from the NVD CVSS 6.5, and no public exploit or active exploitation has been identified.
Site isolation bypass in Google Chrome Core prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to cross site isolation boundaries via a crafted HTML page. This is not a standalone exploit - it is a post-renderer-compromise escalation step that leverages a missing authorization check (CWE-862) in Chrome's Core component to violate the cross-origin process separation that site isolation guarantees. No public exploit code exists and EPSS is 0.18% (7th percentile), consistent with Chromium's own 'Low' severity rating; the practical bar for exploitation is high.
Incorrect authorization in Chrome's Safebrowsing component allows a remote, unauthenticated attacker to bypass system access restrictions by tricking a user into visiting a crafted HTML page via social engineering. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. No public exploit code has been identified, EPSS sits at 0.25%, and CISA SSVC rates exploitation as none - consistent with Chromium's own 'Low' severity designation, which contrasts with the NVD CVSS 6.5 Medium rating.
ServiceWorker incorrect authorization in Google Chrome prior to 153.0.8010.36 permits remote attackers to bypass the web origin policy by delivering a crafted HTML page to a target user. The root cause is CWE-863 (Incorrect Authorization) within Chrome's ServiceWorker subsystem, which fails to properly enforce cross-origin access boundaries. No active exploitation has been identified; Chrome's own security team rated the severity Low, consistent with the limited confidentiality-only impact reflected in the CVSS 4.3 score.
Incorrect authorization in the Web Authentication (WebAuthn) API implementation of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension. The bypass permits unauthorized cross-origin interaction with WebAuthn credentials, resulting in limited integrity impact. Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit code exists and EPSS stands at 0.21% (11th percentile), indicating minimal exploitation activity.
Cross-origin data leakage in Google Chrome's Prefetch subsystem (versions prior to 153.0.8010.36) enables a remote attacker to infer information about cross-origin resources via an observable discrepancy side-channel triggered by a crafted HTML page. The vulnerability affects unauthenticated users who visit the malicious page, requiring only passive user interaction (browsing). Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit or active exploitation has been identified at time of analysis.
ServiceWorker missing authorization in Google Chrome prior to 153.0.8010.36 enables a renderer-compromised attacker to bypass system access restrictions via a crafted HTML page. The flaw (CWE-862) sits as the second step in a chained exploit: an attacker who has already achieved renderer process compromise leverages the ServiceWorker authorization gap to escalate beyond the renderer sandbox and tamper with integrity-sensitive system resources. Chromium internally rated this 'Low' severity, contrasting with the NVD CVSS base score of 6.5; no public exploit or CISA KEV listing exists at time of analysis.
UI misrepresentation in Google Chrome's FullScreen mode on Windows allows a remote attacker to spoof browser chrome and security-relevant UI elements by directing a victim to a crafted HTML page. Affected are all Chrome versions on Windows prior to 153.0.8010.36. This is a phishing-class attack vector: by hijacking the fullscreen rendering to simulate trusted UI (OS dialogs, address bar, lock icons, or other sites), an attacker can deceive users into performing unsafe actions or disclosing credentials. No public exploit has been identified and EPSS is 0.22%, reflecting low near-term exploitation probability.
Sensitive information disclosure in Google Chrome's Sources component exposes arbitrary sensitive data to remote attackers who can direct a user to a crafted HTML page. The flaw, fixed in Chrome 153.0.8010.36, stems from incorrect authorization checks (CWE-863) in the Sources subsystem - notably the same release that patched a cluster of higher-severity sandbox-escape RCEs. Despite the NVD CVSS score of 6.5 and C:H confidentiality rating, Chromium's own team rates this as Low severity, suggesting limited real-world exposure or constrained scope of the leaked data. No public exploit or active exploitation has been identified at time of analysis.
Incorrect authorization in the DeviceBoundSessionCredentials component of Google Chrome prior to 153.0.8010.36 allows remote attackers to bypass the web origin policy via crafted network traffic, producing a high-integrity impact with no confidentiality or availability effect. The DeviceBoundSessionCredentials feature, which binds authentication sessions to specific devices to reduce credential theft, fails to correctly enforce origin restrictions under this condition. No public exploit code exists and no active exploitation has been confirmed; the Chromium team rated this 'Medium' and EPSS stands at 0.21%.
Incorrect authorization in Chrome's Omnibox (address bar) prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions and gain unauthorized access to privileged browser pages. Exploitation requires luring a victim to visit a crafted HTML page, making this a social-engineering-dependent integrity attack. No public exploit code has been identified and EPSS sits at 0.18%, consistent with Chromium's own 'Medium' severity rating despite the NVD CVSS score of 6.5.
Incorrect authorization in Google Chrome's Extensions subsystem (prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension to a victim who interacts with it. The flaw, rooted in CWE-863 (Incorrect Authorization), enables integrity violations - specifically circumventing the permissions and access controls that govern what extension code can do on the host system. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% (9th percentile), consistent with Chromium's own 'Medium' severity classification.
Observable discrepancy in Chrome's Layout engine prior to version 153.0.8010.36 allows a remote attacker to infer sensitive cross-origin information by measuring rendering differences triggered by a crafted HTML page. The CWE-203 root cause - an attacker-observable behavioral difference that correlates with secret state - places this in the browser side-channel (XSLeak) family, where layout timing or geometry variations can reveal whether a user is authenticated to a third-party origin or whether specific cross-origin resources exist. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest.
Observable DOM discrepancy in Google Chrome prior to 153.0.8010.36 enables cross-origin information leakage via a CWE-203 side-channel, allowing a remote attacker to infer sensitive data from a victim's browser state. Exploitation requires social engineering to lure the target to a crafted HTML page, satisfying the required user interaction. No public exploit code or CISA KEV listing is associated with this vulnerability, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest at time of analysis.
Cross-site scripting in Google Chrome's SanitizerAPI (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to bypass the browser's web origin policy by serving a crafted HTML page to a victim. The SanitizerAPI is Chrome's browser-native HTML sanitization interface; a flaw in its processing allows certain crafted inputs to violate same-origin restrictions, enabling limited cross-origin data exposure. With CVSS 4.3 (Medium), an EPSS of 0.27%, no KEV listing, and no public exploit code identified, this is a low-urgency but confirmed patch target.
Incorrect authorization in Chrome's WebUI component allows a remote unauthenticated attacker to bypass system access restrictions and gain unauthorized access to privileged internal Chrome pages by luring a victim to visit a crafted HTML page. All Chrome desktop versions prior to 153.0.8010.36 are affected; Google patched this in the stable channel released September 2026. No public exploit has been identified at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects minimal current exploitation pressure.
Out-of-bounds read in ANGLE (Chrome's OpenGL ES translation layer) in Google Chrome prior to 153.0.8010.36 enables a remote unauthenticated attacker to read limited memory content outside the renderer sandbox by luring a user to a crafted HTML page. Unlike co-patched ANGLE issues in the same Chrome 153.0.8010.36 release that achieve full sandbox escape and remote code execution, this flaw is bounded to confidentiality impact only with no scope change - the read does not escape the renderer process. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.17% reflects minimal current attacker interest.
ControlledFrame in Google Chrome prior to 153.0.8010.36 exposes sensitive information to an attacker who has already achieved renderer process compromise, exploitable via a crafted HTML page (UI:R). This is a chained post-exploitation primitive rather than an initial access vector: it extends the damage of a separate renderer exploit by enabling cross-origin data exfiltration from the victim's session. No public exploit code exists, EPSS stands at 0.29% (21st percentile), and no CISA KEV listing is present, consistent with the high effective exploitation barrier imposed by the renderer pre-compromise requirement.
Cross-origin data disclosure in Google Chrome's Paint rendering component (versions prior to 153.0.8010.36) enables a remote attacker to read data belonging to a different web origin by directing a victim to a crafted HTML page. The root cause is an origin validation error (CWE-346) in the Paint pipeline, which under certain rendering conditions fails to enforce the Same-Origin Policy, leaking partial cross-origin data to the attacker-controlled page. EPSS is 0.14% (3rd percentile), Chromium rates this 'Medium,' and no public exploit or CISA KEV listing exists at time of analysis - placing this squarely in standard patch-cadence rather than emergency response territory.
Site isolation bypass in Google Chrome prior to 153.0.8010.36 allows a remote attacker to subvert cross-origin integrity guarantees by directing a victim to visit a crafted HTML page, exploiting incorrect authorization checks (CWE-863) in Chrome's Isolated component. The CVSS score rates integrity impact as High with no privileges required, but user interaction is necessary and confidentiality impact is assessed as none. No public exploit code exists and SSVC marks exploitation as none; EPSS stands at 0.18%, suggesting low observed threat activity despite the patch being available.
Missing authorization in Chrome's FileSystem component allows a remote attacker to bypass system access restrictions via a crafted HTML page, requiring social engineering to achieve user interaction. Affects all Chrome versions prior to 153.0.8010.36 across desktop platforms. With PR:N and I:H in the CVSS vector, an unauthenticated attacker who tricks a user into visiting a malicious page can achieve high-integrity impact against the local filesystem without confidentiality or availability consequences.
Race condition in the Browser component of Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by inducing a victim to visit a crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L) reflects limited, non-scope-changing impact - this is not a sandbox escape but a partial access-control bypass within the Browser process. EPSS at 0.20% (10th percentile), Chromium's own 'Medium' severity rating, and the absence of KEV listing or public exploit code all converge on low near-term exploitation risk.
UI misrepresentation in Google Chrome's Payments component prior to 153.0.8010.36 allows a remote attacker to spoof payment-related interface elements by serving a crafted HTML page. The spoofed UI can deceive users into believing they are interacting with legitimate Chrome payment dialogs, potentially facilitating credential or payment-data disclosure. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), placing real-world exploitation risk as low at this time.
Safebrowsing information omission in Google Chrome on macOS prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by delivering a crafted HTML page that causes Chrome's Safe Browsing subsystem to silently suppress or lose security-relevant signals. The CVSS vector (PR:N/UI:R/I:H) reflects that a victim need only visit a malicious page, after which Safebrowsing protections fail to surface warnings - exposing users to malicious downloads or sites without Chrome's normal safety guardrails. No public exploit code exists and EPSS is very low (0.20%, 10th percentile); no CISA KEV listing at time of analysis.
Sensitive information disclosure in the Enterprise component of Google Chrome on Windows allows a remote attacker to obtain protected data by luring a user to a crafted HTML page. All Chrome releases on Windows prior to 153.0.8010.36 are affected. No public exploit has been identified at the time of analysis, and with an EPSS of 0.17% (7th percentile), opportunistic mass exploitation is unlikely in the near term despite the high confidentiality impact rating.
Incorrect authorization in Google Chrome's Browser component on Android allows a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. Affected versions are all Chrome for Android releases prior to 153.0.8010.36. The vulnerability carries a CVSS score of 6.5 (Medium), consistent with Chromium's own 'Medium' severity classification, and no public exploit code or active exploitation has been identified at time of analysis.
CSS output encoding failure in Google Chrome prior to 153.0.8010.36 allows an unauthenticated remote attacker to potentially bypass the same-origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin information disclosure. The CVSS score of 4.3 aligns with Chromium's own 'Medium' severity classification, reflecting that the impact is scoped to partial confidentiality loss with no integrity or availability consequence. No active exploitation has been confirmed and EPSS remains low at 0.26%, indicating this is currently a theoretical risk addressed by the September 2026 stable channel update.
UI misrepresentation in Google Chrome's Geometry component (versions prior to 153.0.8010.36) enables remote attackers to spoof browser interface elements through a crafted HTML page, requiring social engineering to achieve user interaction. The flaw (CWE-451) permits an attacker to visually deceive victims about the true origin or nature of displayed content, creating a pathway for phishing and credential harvesting. No public exploit has been identified at time of analysis; vendor-released patch is available in the September 2026 stable channel update.
SiteIsolation incorrect authorization in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to bypass cross-origin access restrictions via a crafted HTML page. The flaw (CWE-863) carries a CVSS 6.5 with high integrity impact and no confidentiality or availability dimension, consistent with a second-stage sandbox-escape component rather than a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects very low observed exploitation probability; Chromium's own severity rating of 'Medium' aligns with this assessment.
Observable discrepancy (CWE-203) in the Safebrowsing component of Google Chrome on iOS prior to 153.0.8010.36 enables a remote attacker with a pre-compromised renderer process to leak sensitive information through behavioral differences when processing a crafted HTML page. The vulnerability is iOS-platform-specific and is chained after renderer compromise rather than exploited standalone. No public exploit exists and EPSS probability is 0.24%, consistent with the multi-stage exploitation requirement.
Incorrect authorization in Chrome's DataTransfer API (prior to 153.0.8010.36) permits an attacker who has already achieved renderer process compromise to read sensitive data via a crafted HTML page. The flaw (CWE-863) bypasses intended access-control checks on clipboard or drag-and-drop data within the renderer context, enabling information disclosure rather than code execution. No public exploit code exists and EPSS sits at 0.17% (6th percentile), reflecting this as a chained, second-stage attack primitive rather than a standalone initial-access vector.
Incorrect authorization in Chrome's Isolated component (all versions prior to 153.0.8010.36) enables remote attackers to spoof UI elements by directing users to a crafted HTML page. The flaw stems from CWE-863 authorization failures within Chrome's isolation architecture, allowing cross-boundary deception without requiring attacker authentication. No public exploit exists and EPSS is 0.17% (6th percentile), placing this firmly in the routine-patching tier despite the network-accessible attack vector.
Missing authorization in Google Chrome's FedCM (Federated Credential Management) component, versions prior to 153.0.8010.36, enables a remote attacker to bypass the web origin policy by luring a user to a crafted HTML page. The flaw (CWE-862) results in limited confidentiality impact - an origin-policy bypass that could expose data scoped to that cross-origin context. No public exploit exists and EPSS sits at 0.19% (9th percentile), consistent with Chromium's own 'Medium' severity rating and the requirement for user interaction.
ServiceWorker information leak in Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to extract sensitive information via a crafted HTML page. This is a chained exploitation technique rather than a standalone attack - requiring prior renderer process control as a hard prerequisite, making it a second-stage capability within a broader browser exploit chain. No public exploit code exists and EPSS sits at 0.29% (21st percentile), indicating low observed exploitation activity; the vulnerability is not listed in CISA KEV.
Safebrowsing in Google Chrome prior to 153.0.8010.36 can be bypassed through improper state validation (CWE-754), enabling a remote attacker to suppress Chrome's phishing and malware protection warnings by delivering a crafted HTML page to a victim. The integrity-only impact (CVSS I:H, C:N, A:N) reflects that successful exploitation undermines Chrome's access restriction enforcement rather than directly exfiltrating data, but it clears the path for downstream malware delivery or credential harvesting that Safebrowsing would otherwise have blocked. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.18% (8th percentile) corroborates low current weaponization probability.
Improper input validation in the Safebrowsing component of Google Chrome on Android prior to 153.0.8010.36 enables a remote attacker to bypass system access restrictions through a crafted HTML page. Exploitation requires social engineering to direct an Android Chrome user to the malicious page (UI:R), limiting opportunistic attack surface. No public exploit code has been identified and EPSS is very low (0.22%, 13th percentile), though the integrity-only CVSS 6.5 accurately reflects a meaningful access restriction bypass on a ubiquitously deployed browser. Vendor-released patch is available in Chrome 153.0.8010.36.
Uninitialized GPU resource use in Google Chrome on Android (prior to 153.0.8010.36) allows remote attackers to read process memory across the sandbox boundary via a crafted HTML page. The CVSS S:C (scope changed) metric confirms the vulnerability crosses Chrome's GPU sandbox, leaking partial memory contents outside the sandboxed GPU process to a network-positioned attacker. No public exploit or CISA KEV listing exists; EPSS of 0.31% (24th percentile) indicates low observed exploitation probability, consistent with Chromium's 'Medium' severity rating.
Navigation component information leak in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass site isolation and exfiltrate cross-origin data via a crafted HTML page. This is a second-stage exploit component: it cannot be chained without a prior renderer compromise, which significantly elevates the effective attack complexity despite the AV:N/AC:L CVSS surface reading. Chromium's own severity rating is 'Medium', consistent with the prerequisite constraint. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) reflects the elevated bar for exploitation.
Cross-origin data exposure in Google Chrome's Scroll component (all versions prior to 153.0.8010.36) enables an attacker who has already achieved renderer process compromise to exfiltrate sensitive data from other web origins via a crafted HTML page. This is a secondary-stage vulnerability - it does not provide initial access but extends an existing renderer compromise into a cross-origin information leak. Chromium rated this Medium severity, consistent with the 4.3 CVSS score; no public exploit exists and EPSS at 0.17% (7th percentile) reflects the narrow, chained exploitation scenario.
Cross-origin data leakage via Google Chrome's ServiceWorker implementation allows remote attackers to obtain information from other origins by serving a crafted HTML page to a victim. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.21% reflects low real-world exploitation activity.
UI element spoofing in Google Chrome's Geometry rendering component (versions prior to 153.0.8010.36) enables a remote attacker to misrepresent browser chrome and UI elements through a crafted HTML page, requiring the victim to visit the malicious page via social engineering. The vulnerability, classified under CWE-451 (User Interface Misrepresentation of Critical Information), allows an attacker to render fake address bars, security dialogs, or browser-level indicators in a way that deceives users into disclosing credentials or taking unintended actions. No public exploit code has been identified and no CISA KEV listing exists; EPSS at 0.21% (11th percentile) reflects negligible observed exploitation activity.
Incomplete cleanup in the Downloads component of Google Chrome prior to 153.0.8010.36 enables remote attackers to bypass system-level access restrictions, achieving high integrity impact without requiring any privileges. Exploitation requires social engineering: the victim must be lured to a crafted HTML page that triggers leftover state or residual artifacts from the Downloads subsystem, which Chrome fails to fully sanitize. EPSS is low (0.28%, 20th percentile) and no confirmed active exploitation or public proof-of-concept has been identified at time of analysis; Chromium's own internal severity rating of 'Medium' aligns with the NVD CVSS 6.5 score.
Missing authorization in the Downloads component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system-level access restrictions using a crafted Chrome extension. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects that user interaction is required to trigger the flaw, limiting automated mass exploitation. No public exploit has been identified, EPSS sits at 0.27% (19th percentile), and the Chromium team independently rates this as 'Medium' severity - all signals consistent with no confirmed active exploitation.
Google Chrome's browser UI component (all versions prior to 153.0.8010.36) is vulnerable to visual spoofing attacks where an attacker can manipulate how the browser presents security-critical interface elements to users. By serving a specially crafted HTML page combined with social engineering, a remote unauthenticated attacker can make Chrome display misleading UI indicators - such as deceptive origin representations or manipulated security signals - potentially enabling credential theft or unauthorized permission grants. No public exploit code exists and the EPSS score of 0.21% (11th percentile) indicates low near-term exploitation probability, consistent with Chromium's own Medium severity classification.
Address bar spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker to misrepresent the displayed URL via a specially crafted domain name, exploiting a flaw in the UrlFormatting subsystem. The attack requires social engineering to direct a victim to the attacker-controlled domain, after which the browser renders a deceptive address bar that masks the true origin. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low observed exploitation interest, consistent with the medium severity and UI:R requirement.
UI spoofing in Google Chrome's Session component (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent browser UI elements - such as session state indicators or security context - by delivering a crafted HTML page to a victim. The impact is deception-oriented: a user can be misled about the true security or session context of an interaction, enabling downstream phishing or session confusion attacks. No public exploit code has been identified and EPSS probability is 0.29% (21st percentile), consistent with no active exploitation at time of analysis.
UI misrepresentation in Google Chrome's Downloads component prior to 153.0.8010.36 allows remote attackers to bypass system access restrictions by deceiving users through a crafted HTML page. The flaw (CWE-451) causes Chrome to display misleading information about files being downloaded, enabling social-engineering attacks that trick users into accepting or executing content they would otherwise reject. Chromium rates this Medium severity, consistent with the CVSS 5.4; no public exploit code exists and EPSS at 0.24% (15th percentile) reflects low exploitation probability at time of analysis.
UI misrepresentation in Google Chrome's FedCM (Federated Credential Management) API prior to 153.0.8010.36 enables remote attackers to spoof identity-provider sign-in dialogs via crafted HTML pages, requiring user interaction. The flaw (CWE-451) allows a malicious page to manipulate how FedCM presents credential prompts, potentially misleading users into authorizing the wrong identity provider or disclosing credential context to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified; EPSS is 0.17%, consistent with Chromium's 'Medium' severity classification.
Clickjacking in Google Chrome's Downloads component (all versions prior to 153.0.8010.36) enables a remote attacker to spoof Chrome's download UI elements by luring a victim to a crafted HTML page. Through UI overlay or frame-stacking techniques, the attacker can make a user believe they are interacting with legitimate Chrome download controls while actually triggering attacker-defined actions. No public exploit code exists and EPSS of 0.24% (15th percentile) reflects low real-world exploitation probability; Chromium's own severity rating of Medium aligns with the CVSS 5.4 score.
Clickjacking via TrustedWebActivities (TWA) in Google Chrome on Android prior to 153.0.8010.36 allows a local attacker with a co-installed malicious app to spoof the browser address bar, enabling deceptive phishing scenarios where the user believes they are on a trusted domain. The attack leverages CWE-1021 (UI layer redressing) in Chrome's TWA feature, which is designed to let Android apps surface web content with reduced browser chrome. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), consistent with the local-access requirement and high attack complexity. Google has released the fix in the stable channel update to 153.0.8010.36.
UI spoofing in Google Chrome's FedCM (Federated Credential Management) implementation allows an attacker who has already compromised the renderer process to inject malformed identity-provider dialog elements via a crafted HTML page, potentially deceiving users into submitting credentials to an attacker-controlled endpoint. All Chrome desktop versions prior to 153.0.8010.36 are affected. The attack is two-stage: an independent renderer-compromise vulnerability must first be exploited, making this a chained post-exploitation capability rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
UI misrepresentation in Google Chrome prior to 153.0.8010.36 allows a remote attacker to spoof browser UI elements - such as the address bar, security indicators, or permission dialogs - via a specially crafted HTML page, requiring social engineering to lure the victim. Exploiting CWE-451, the attacker can deceive users into trusting a malicious or phishing page as legitimate, potentially leading to credential theft or other user-driven disclosures. No public exploit code has been identified and EPSS is 0.24% (15th percentile), consistent with the Chromium team's 'Medium' severity rating and the high-complexity social engineering prerequisite.
UI misrepresentation in Google Chrome's Downloads panel prior to version 153.0.8010.36 allows a remote attacker to spoof download-related UI elements, potentially deceiving users into accepting or running malicious content they believe to be legitimate. The vulnerability is triggered by a crafted HTML page and requires social engineering to lure a victim into visiting the attacker-controlled page. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) places real-world exploitation risk low; however, Chrome's ubiquitous deployment keeps the absolute exposure surface significant.
Improper input validation in Chrome's Interstitials component - the full-page security warning screens shown for SSL errors, Safe Browsing alerts, and download warnings - allows a remote attacker to spoof UI elements by delivering a crafted HTML page to an unsuspecting user. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No public exploit code has been identified and EPSS stands at 0.17% (7th percentile), reflecting low near-term exploitation probability, though successful abuse could undermine user trust in browser security indicators and facilitate phishing or credential harvesting.
Cross-origin data leakage in Google Chrome's Navigation component prior to version 153.0.8010.36 exposes partial information about cross-origin resources through an observable behavioral discrepancy (CWE-203 side-channel). Remote unauthenticated attackers can exploit this by serving a crafted HTML page that a victim visits, allowing inference of cross-origin data that should be protected by the Same-Origin Policy. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS at the 15th percentile confirms limited real-world exploitation pressure. Vendor-released patch is available as Chrome 153.0.8010.36.
UI spoofing in Google Chrome's Passwords component (versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. Classified as CWE-451 (UI Misrepresentation of Critical Information), this flaw could deceive users into believing they are interacting with a legitimate password prompt or credential management interface when they are not, potentially facilitating credential phishing or confusion attacks. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Improper state validation in Google Chrome's Installer component (prior to 153.0.8010.36) allows remote attackers to bypass system access restrictions by serving a crafted HTML page to a user. The vulnerability carries a Chromium-assigned severity of Medium and an NVD CVSS base score of 4.3, with limited integrity impact and no confidentiality or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places exploitation probability at a low 0.30%.
Web origin policy bypass in Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to circumvent Same-Origin Policy (SOP) restrictions by exploiting improper input validation in the Network component via a crafted HTML page. The CVSS 4.3 Medium rating is consistent with Chromium's own 'Medium' severity classification, with impact limited to partial confidentiality loss and no integrity or availability consequence. No public exploit code is identified and EPSS sits at 0.18% (8th percentile), indicating very low near-term exploitation probability.
Web origin policy bypass in Google Chrome's Loader component (versions prior to 153.0.8010.36) lets a remote attacker circumvent same-origin protections by serving a crafted HTML page, potentially reading cross-origin resources the attacker should not have access to. The CVSS score of 4.3 and Chromium's own 'Medium' severity rating are consistent, reflecting a confidentiality-only impact with no integrity or availability consequence and no sandbox escape. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS places exploitation probability at 0.26% (18th percentile), indicating low real-world exploitation likelihood.
Missing authorization in Google Chrome's Browser component (prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions via a crafted HTML page. The CWE-862 root cause - an absent authorization check rather than a broken one - means the Browser component fails to enforce expected access control boundaries when processing certain HTML content. Chromium rated this 'Medium' severity, consistent with the CVSS 4.3 score reflecting limited integrity-only impact and a requirement for user interaction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
UI spoofing in Google Chrome's Accessibility subsystem on macOS (all versions prior to 153.0.8010.36) stems from incorrect reference resolution (CWE-706), enabling a remote unauthenticated attacker to mislead users into perceiving fraudulent UI elements via a crafted HTML page. The attack requires a user to visit a malicious page, and no active exploitation or public proof-of-concept code has been identified at time of analysis. Vendor-released patch 153.0.8010.36 is available via the Chrome stable channel update published on the Chrome Releases blog.
Missing authorization in Google Chrome's Browser component (versions prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions by directing users to a crafted HTML page. The flaw, classified as CWE-862 (Missing Authorization), carries a CVSS 4.3 Medium score with a limited integrity impact and no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.19% (9th percentile), placing real-world exploitation risk well below the threshold warranting emergency response.
Incorrect authorization in Chrome's Navigation component (versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to spoof browser UI elements - such as the address bar or security indicators - via a crafted HTML page. This is a chained exploit step, not a standalone vulnerability: renderer-level code execution via a separate flaw is a hard prerequisite. Chromium classifies severity as 'Medium,' consistent with the CVSS 4.2 score; no public exploit code and no active exploitation (CISA KEV) have been identified.
Missing authorization in Chrome's ControlledFrame component allows remote unauthenticated attackers to bypass system access restrictions by socially engineering a victim into visiting a crafted HTML page. Versions prior to 153.0.8010.36 are affected across desktop platforms; Google shipped a fix in the stable channel update. No public exploit or CISA KEV listing exists, and an EPSS of 0.29% confirms low real-world exploitation probability consistent with Chromium's own 'Medium' severity rating.
Incomplete cleanup in Google Chrome's Browser component (all versions prior to 153.0.8010.36) enables a remote attacker to bypass the web same-origin policy via a crafted Chrome extension, contingent on social engineering the victim into installing it. The integrity impact is high - a successful attacker can tamper with cross-origin web content - while confidentiality and availability are unaffected per the CVSS vector (C:N/A:N). No public exploit code or CISA KEV listing exists at time of analysis, and an EPSS score of 0.28% at the 21st percentile reflects low observed exploitation probability.
Omnibox in Google Chrome prior to 153.0.8010.36 permits a remote unauthenticated attacker to bypass system access restrictions and navigate into privileged internal browser pages through a crafted HTML page delivered via social engineering. The root cause is missing authorization (CWE-862) in the Omnibox component, meaning Chrome fails to enforce access controls before allowing navigation to restricted page contexts. No public exploit or active exploitation has been identified; Chromium rates this Medium, consistent with the CVSS 6.5 score and mandatory user interaction requirement.
Incorrect authorization in the Loader component of Google Chrome prior to 153.0.8010.36 enables a remote attacker to obtain sensitive information by luring a victim to a crafted HTML page. The CVSS base score of 6.5 and Chromium's own 'Medium' severity rating are consistent, reflecting the high confidentiality impact constrained by mandatory user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.23% places this in the 14th percentile for near-term exploitation likelihood.
Uninitialized memory in the Codecs component of Google Chrome before 153.0.8010.36 leaks sandbox-internal memory to a remote attacker via a crafted HTML page. The vulnerability stems from CWE-908 (use of uninitialized resource) where codec processing exposes arbitrary memory contents that happen to reside in uninitialized buffers - but exploitation is constrained entirely within the Chrome sandbox (S:U). No active exploitation is confirmed and no public exploit code exists; EPSS stands at 0.19% (9th percentile), consistent with a low-priority medium-severity disclosure issue.
Missing authorization in Chrome's DOM implementation prior to version 153.0.8010.36 allows remote attackers to potentially leak sensitive information by luring a victim to a crafted HTML page. Rooted in CWE-862 (Missing Authorization), the flaw permits script or page contexts to access DOM nodes or properties without proper access-control enforcement, potentially bypassing intended cross-context isolation. No public exploit code exists and CISA has not listed this in KEV; EPSS of 0.22% (12th percentile) and SSVC Exploitation:none confirm negligible current threat activity.
Cross-origin data leakage in Google Chrome's Core component (all versions prior to 153.0.8010.36) enables a remote attacker to exfiltrate data from origins other than the attacker-controlled context via a specially crafted Chrome extension. The extension acts as the delivery mechanism, causing Chrome's Core to expose cross-origin content it should otherwise isolate. EPSS sits at 0.15% and Chromium's own severity rating is Low, consistent with the limited, read-only confidentiality impact and the user-interaction requirement for extension installation. No public exploit code and no active exploitation (CISA KEV) have been identified at time of analysis.
Let me synthesize. CVE-2026-87473: Incorrect authorization in FileHandling in Google Chrome prior to 153.0.8010.36. Remote attacker leveraging social engineering to bypass system access restrictions via crafted HTML page. Chromium severity Low. CVSS 6.5 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N. CWE-863. Note the inconsistency: Chromium severity Low vs CVSS 6.5 medium. No KEV, no POC mentioned. EPSS 0.27% (low, 20th percentile). Patch available. Affected versions: EUVD says ["Chrome 153.0.8010.36 <153.0.8010.36"] which is weird/nonsensical — version range malformed. Should flag? That's a data quality thing but "Do NOT flag severity/CVSS/version disagreements here". Hmm, malformed version range — it's about version disagreement. I'll mention in confidence_notes but not flag as data_quality_flag (the types allowed are mislabeled_tag/wrong_vendor/wrong_product/missing_tag). So version issues go to confidence_notes. Tags: "Authentication Bypass, Google". CWE-863 is incorrect authorization — "Authentication Bypass" is arguably a mislabeled tag but it's close... Actually CWE-863 is Incorrect Authorization, not authentication bypass. Is this a "mislabeled_tag"? The allowed types: mislabeled_tag with target being exact wrong value and suggested correct slug. Hmm, "Authentication Bypass" — the CVE is an authorization bypass, which is similar. I'd say it's borderline; the instructions say only emit when clearly wrong and verifiable. I think I should be cautious — leave it empty or flag it? The tag "Authentication Bypass" for a CWE-863 incorrect authorization... "Authorization Bypass" would be more accurate. But it's arguably acceptable colloquially. Also "Google" is the vendor which is correct for Chrome. Missing tag: "chrome" or "google-chrome"? The product is Chrome. Tags list has "Google" which is vendor. Could flag missing_tag for "Chrome" → suggested "chrome". That's plausible and high confidence. Hmm, is "chrome" tag clearly applicable? The product is Google Chrome; tags
UI spoofing in Google Chrome's Passwords component on Android (prior to 153.0.8010.36) enables a remote attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. The CVSS 5.4 (Medium) rating contrasts with Chromium's own 'Low' severity classification, a common divergence for UI-redressing issues. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS of 0.16% (6th percentile) confirms negligible near-term exploitation probability.
Sensitive information disclosure in Google Chrome's Transactions Platform component prior to version 153.0.8010.36 enables remote attackers to extract unspecified sensitive data by directing a user to a crafted HTML page. The Transactions Platform is likely tied to Chrome's Web Payments API or payment handler subsystem, making transaction-context data a plausible disclosure surface. No public exploit code exists and EPSS sits at 0.16% (6th percentile); however, the vendor-assigned CVSS C:H metric indicates the leaked data carries meaningful sensitivity, creating a tension with Chromium's own 'Low' internal severity classification.
Missing authorization in the Contacts component of Google Chrome before 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to extract sensitive contact data by delivering a crafted HTML page through social engineering. This is a secondary, post-renderer-compromise vulnerability - not an initial access vector - and Chromium's own team rates it 'Low' severity, reflecting the elevated prerequisite chain. No public exploit has been identified, EPSS sits at 0.16% (5th percentile), and CISA SSVC rates exploitation likelihood as none, collectively indicating minimal real-world risk at this time.
UI spoofing in the Passwords component of Google Chrome on Android (versions prior to 153.0.8010.36) enables an attacker who has already compromised the renderer process to display falsified password-manager interface elements via a crafted HTML page. Exploitation is constrained by a hard prerequisite - a separate renderer compromise must precede this attack - and requires user interaction with the malicious page. No public exploit code exists and EPSS sits at 0.16% (6th percentile), in line with Chromium's own 'Low' severity classification.
Address bar spoofing in Google Chrome's CustomTabs feature on Android (prior to 153.0.8010.36) allows a remote attacker to display a falsified URL by leveraging a co-installed application on the victim's device. The flaw, rooted in CWE-451 (User Interface Misrepresentation of Critical Information), enables phishing attacks where users are deceived into believing they are visiting a trusted origin while interacting with attacker-controlled content. Chromium rates this 'Low' severity; EPSS is 0.16% (6th percentile), no public exploits are identified, and no active exploitation is confirmed.
Sensitive credential information leak in the Passwords component of Google Chrome on Android (prior to 153.0.8010.36) enables a remote unauthenticated attacker to extract password data by luring a victim to a crafted HTML page. Despite Chromium classifying the severity as 'Low', the NVD CVSS vector assigns C:H reflecting that full credential disclosure is possible. No public exploit code or active exploitation (CISA KEV) has been identified, and the EPSS score of 0.21% (11th percentile) signals low automated exploitation pressure at time of analysis.
Information disclosure in Google Chrome's DataTransfer API via a TOCTOU race condition allows a remote attacker to obtain sensitive data from a victim's browser session. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. Exploitation requires social engineering to induce user interaction with a crafted HTML page - no active exploitation has been identified and EPSS sits at the 9th percentile, indicating very low real-world exploitation probability at this time.
Sensitive information disclosure in Google Chrome's Mobile component on iOS (versions prior to 153.0.8010.36) allows remote unauthenticated attackers to leak confidential browser data by luring victims to a crafted HTML page through social engineering. The flaw is platform-specific - affecting only the iOS Mobile code path, not desktop or Android - and is fixed in the 153.0.8010.36 stable channel release. No active exploitation is confirmed (not in CISA KEV) and EPSS probability is 0.17% (7th percentile), consistent with Chromium's own 'Low' severity rating, which contrasts with the NVD CVSS 6.5 Medium score.
Clickjacking via UI spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to overlay deceptive UI elements through a crafted HTML page, requiring additional social engineering to complete the attack. The vulnerability (CWE-1021) affects all desktop Chrome builds before the September 2026 stable-channel release. No public exploit code exists and no active exploitation has been identified; EPSS of 0.20% (10th percentile) reflects the low probability of opportunistic exploitation given the demanding prerequisites.
Incorrect type conversion (CWE-704) in Chrome's Safebrowsing component on macOS allows remote attackers to bypass system access restrictions by delivering a specially crafted file, requiring user interaction to trigger. All Chrome for Mac versions prior to 153.0.8010.36 are affected; Google released the fix in the September 2026 stable channel update. No public exploit code exists and EPSS sits at 0.17% (7th percentile), consistent with Chromium's own 'Low' severity designation.
Address bar spoofing in Google Chrome for Android (all versions before 153.0.8010.36) exploits incorrect certificate authorization logic (CWE-863), allowing a remote attacker who can deliver crafted network traffic - such as via a man-in-the-middle position - to cause the browser to display a false origin in the address bar. The primary risk is phishing: users who trust the spoofed address bar may submit credentials or sensitive data to an attacker-controlled endpoint. Chromium's own team rated this Low severity, consistent with its CVSS 4.8 score and AC:H rating; no public exploit code and no active exploitation have been identified, and the EPSS score of 0.12% (2nd percentile) confirms very low real-world exploitation probability at time of analysis.
Cross-origin information leakage in Google Chrome's Select element (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to infer sensitive user state by observing behavioral discrepancies in how the `<select>` element renders when a victim browses to a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), a classic browser side-channel class that enables cross-site information inference - for example, whether a user is authenticated to a third-party origin or has visited specific URLs. No public exploit has been identified at time of analysis, and EPSS sits at 0.17% (7th percentile), consistent with the Chromium team's own 'Low' severity rating despite NVD's CVSS 6.5.
UI spoofing via a confused deputy flaw in Google Chrome's Fullscreen API (all versions prior to 153.0.8010.36) enables a remote attacker who has already compromised the renderer process to impersonate browser-trusted UI elements using a crafted HTML page and social engineering. This is a secondary exploitation step - it does not provide initial access - and becomes relevant only after a separate, higher-severity renderer compromise has been achieved. No public exploit code or CISA KEV listing exists; EPSS of 0.17% (6th percentile) reflects very low automated exploitation probability consistent with the chained, human-dependent attack path.
Observable SVG discrepancy in Google Chrome prior to 153.0.8010.36 enables remote attackers to infer sensitive cross-origin information by inducing measurable rendering behavioral differences via a crafted HTML page. The root cause is CWE-203, a side-channel class where an attacker observes system behavior variations to deduce protected state. No public exploit code or active exploitation is identified; Chromium's own 'Low' severity designation and an EPSS of 0.17% (7th percentile) together indicate limited real-world exploitation likelihood despite the NVD's C:H confidentiality metric.
Out-of-bounds read in the Tint WGSL shader compiler in Google Chrome prior to 153.0.8010.36 allows a remote, unauthenticated attacker to read limited memory contents within the browser's renderer sandbox by directing a victim to a crafted HTML page. Scope is confined to the sandbox (S:U/C:L), with no integrity or availability impact and no sandbox escape; Chromium rates this 'Low' severity, consistent with the CVSS 4.3 score. No public exploit code exists and EPSS is negligible at 0.17% (7th percentile), indicating low exploitation probability; a vendor-released patch is available in Chrome 153.0.8010.36.
An interpretation conflict (CWE-436) in Google Chrome's Safe Browsing handling on macOS allows a remote attacker to bypass system access restrictions by convincing a victim to open a crafted file, all the way up to and including Chrome 153.0.8010.36. Exploitation requires the victim to interact with the file (CVSS UI:R) and yields an integrity-only impact (C:N/I:H/A:N), which is consistent with Chromium's own 'Low' severity rating despite the 6.5 base score. There is no CISA KEV listing and no public exploit identified; EPSS is only 0.17% (7th percentile), and Google has shipped a fix in version 153.0.8010.36.
Missing authorization checking in the DevTools component of Google Chrome before 153.0.8010.36 lets a crafted Chrome extension read cross-origin data that should be protected by the browser's same-origin policy. Only confidentiality is affected (CVSS 4.3, C:L/I:N/A:N), and exploitation requires the victim to install the malicious extension (UI:R), so impact is limited to information disclosure from other sites the user has open. Google has shipped a fix in the 153.0.8010.36 stable channel release; EPSS is 0.21% (12th percentile), there is no CISA KEV listing and no public exploit code identified at time of analysis, making this a low-priority hardening update rather than an emergency patch.
Safebrowsing in Google Chrome prior to 153.0.8010.36 fails to properly validate internal state transitions (CWE-754), enabling a remote attacker to bypass the browser's URL-based access restriction mechanism via a crafted HTML page. Successful exploitation requires the victim to visit the attacker-controlled page (UI:R) and yields limited confidentiality and integrity impacts (C:L/I:L) with no availability impact. Chromium's own severity rating of 'Low' is consistent with the constrained impact scope; no public exploit code and no KEV listing have been identified at time of analysis.
UI spoofing in Google Chrome prior to 153.0.8010.36 permits a remote attacker who has already compromised the renderer process to present falsified browser interface elements to the user through crafted network traffic. The root cause is improper input validation (CWE-20) in the Chromium rendering engine, allowing a compromised renderer to influence UI presentation in ways the browser should reject. No public exploit or CISA KEV listing exists; an EPSS of 0.16% (6th percentile) and Chromium's own 'Low' severity rating confirm this is a second-stage, chained capability rather than a standalone high-risk flaw.
Missing authorization (CWE-862) in Chrome's WebView component on Android prior to 153.0.8010.36 allows remote attackers to bypass Android system access restrictions through crafted network traffic. Exploitation is gated behind social engineering - the attacker must trick a user into interacting with malicious content, yielding a high integrity impact but no confidentiality or availability consequence. Chromium's own team rated this 'Low' severity, a notable divergence from the NVD CVSS 6.5, and no public exploit or active exploitation has been identified.
Site isolation bypass in Google Chrome Core prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to cross site isolation boundaries via a crafted HTML page. This is not a standalone exploit - it is a post-renderer-compromise escalation step that leverages a missing authorization check (CWE-862) in Chrome's Core component to violate the cross-origin process separation that site isolation guarantees. No public exploit code exists and EPSS is 0.18% (7th percentile), consistent with Chromium's own 'Low' severity rating; the practical bar for exploitation is high.
Incorrect authorization in Chrome's Safebrowsing component allows a remote, unauthenticated attacker to bypass system access restrictions by tricking a user into visiting a crafted HTML page via social engineering. Affected versions are all Chrome releases prior to 153.0.8010.36 on desktop platforms. No public exploit code has been identified, EPSS sits at 0.25%, and CISA SSVC rates exploitation as none - consistent with Chromium's own 'Low' severity designation, which contrasts with the NVD CVSS 6.5 Medium rating.
ServiceWorker incorrect authorization in Google Chrome prior to 153.0.8010.36 permits remote attackers to bypass the web origin policy by delivering a crafted HTML page to a target user. The root cause is CWE-863 (Incorrect Authorization) within Chrome's ServiceWorker subsystem, which fails to properly enforce cross-origin access boundaries. No active exploitation has been identified; Chrome's own security team rated the severity Low, consistent with the limited confidentiality-only impact reflected in the CVSS 4.3 score.
Incorrect authorization in the Web Authentication (WebAuthn) API implementation of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass the web origin policy via a crafted Chrome extension. The bypass permits unauthorized cross-origin interaction with WebAuthn credentials, resulting in limited integrity impact. Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit code exists and EPSS stands at 0.21% (11th percentile), indicating minimal exploitation activity.
Cross-origin data leakage in Google Chrome's Prefetch subsystem (versions prior to 153.0.8010.36) enables a remote attacker to infer information about cross-origin resources via an observable discrepancy side-channel triggered by a crafted HTML page. The vulnerability affects unauthenticated users who visit the malicious page, requiring only passive user interaction (browsing). Chromium's own severity rating of 'Low' aligns with the CVSS 4.3 score; no public exploit or active exploitation has been identified at time of analysis.
ServiceWorker missing authorization in Google Chrome prior to 153.0.8010.36 enables a renderer-compromised attacker to bypass system access restrictions via a crafted HTML page. The flaw (CWE-862) sits as the second step in a chained exploit: an attacker who has already achieved renderer process compromise leverages the ServiceWorker authorization gap to escalate beyond the renderer sandbox and tamper with integrity-sensitive system resources. Chromium internally rated this 'Low' severity, contrasting with the NVD CVSS base score of 6.5; no public exploit or CISA KEV listing exists at time of analysis.
UI misrepresentation in Google Chrome's FullScreen mode on Windows allows a remote attacker to spoof browser chrome and security-relevant UI elements by directing a victim to a crafted HTML page. Affected are all Chrome versions on Windows prior to 153.0.8010.36. This is a phishing-class attack vector: by hijacking the fullscreen rendering to simulate trusted UI (OS dialogs, address bar, lock icons, or other sites), an attacker can deceive users into performing unsafe actions or disclosing credentials. No public exploit has been identified and EPSS is 0.22%, reflecting low near-term exploitation probability.
Sensitive information disclosure in Google Chrome's Sources component exposes arbitrary sensitive data to remote attackers who can direct a user to a crafted HTML page. The flaw, fixed in Chrome 153.0.8010.36, stems from incorrect authorization checks (CWE-863) in the Sources subsystem - notably the same release that patched a cluster of higher-severity sandbox-escape RCEs. Despite the NVD CVSS score of 6.5 and C:H confidentiality rating, Chromium's own team rates this as Low severity, suggesting limited real-world exposure or constrained scope of the leaked data. No public exploit or active exploitation has been identified at time of analysis.
Incorrect authorization in the DeviceBoundSessionCredentials component of Google Chrome prior to 153.0.8010.36 allows remote attackers to bypass the web origin policy via crafted network traffic, producing a high-integrity impact with no confidentiality or availability effect. The DeviceBoundSessionCredentials feature, which binds authentication sessions to specific devices to reduce credential theft, fails to correctly enforce origin restrictions under this condition. No public exploit code exists and no active exploitation has been confirmed; the Chromium team rated this 'Medium' and EPSS stands at 0.21%.
Incorrect authorization in Chrome's Omnibox (address bar) prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions and gain unauthorized access to privileged browser pages. Exploitation requires luring a victim to visit a crafted HTML page, making this a social-engineering-dependent integrity attack. No public exploit code has been identified and EPSS sits at 0.18%, consistent with Chromium's own 'Medium' severity rating despite the NVD CVSS score of 6.5.
Incorrect authorization in Google Chrome's Extensions subsystem (prior to 153.0.8010.36) allows a remote attacker to bypass system access restrictions by delivering a crafted Chrome extension to a victim who interacts with it. The flaw, rooted in CWE-863 (Incorrect Authorization), enables integrity violations - specifically circumventing the permissions and access controls that govern what extension code can do on the host system. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.20% (9th percentile), consistent with Chromium's own 'Medium' severity classification.
Observable discrepancy in Chrome's Layout engine prior to version 153.0.8010.36 allows a remote attacker to infer sensitive cross-origin information by measuring rendering differences triggered by a crafted HTML page. The CWE-203 root cause - an attacker-observable behavioral difference that correlates with secret state - places this in the browser side-channel (XSLeak) family, where layout timing or geometry variations can reveal whether a user is authenticated to a third-party origin or whether specific cross-origin resources exist. No public exploit has been identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest.
Observable DOM discrepancy in Google Chrome prior to 153.0.8010.36 enables cross-origin information leakage via a CWE-203 side-channel, allowing a remote attacker to infer sensitive data from a victim's browser state. Exploitation requires social engineering to lure the target to a crafted HTML page, satisfying the required user interaction. No public exploit code or CISA KEV listing is associated with this vulnerability, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation interest at time of analysis.
Cross-site scripting in Google Chrome's SanitizerAPI (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to bypass the browser's web origin policy by serving a crafted HTML page to a victim. The SanitizerAPI is Chrome's browser-native HTML sanitization interface; a flaw in its processing allows certain crafted inputs to violate same-origin restrictions, enabling limited cross-origin data exposure. With CVSS 4.3 (Medium), an EPSS of 0.27%, no KEV listing, and no public exploit code identified, this is a low-urgency but confirmed patch target.
Incorrect authorization in Chrome's WebUI component allows a remote unauthenticated attacker to bypass system access restrictions and gain unauthorized access to privileged internal Chrome pages by luring a victim to visit a crafted HTML page. All Chrome desktop versions prior to 153.0.8010.36 are affected; Google patched this in the stable channel released September 2026. No public exploit has been identified at time of analysis, and the EPSS score of 0.19% (9th percentile) reflects minimal current exploitation pressure.
Out-of-bounds read in ANGLE (Chrome's OpenGL ES translation layer) in Google Chrome prior to 153.0.8010.36 enables a remote unauthenticated attacker to read limited memory content outside the renderer sandbox by luring a user to a crafted HTML page. Unlike co-patched ANGLE issues in the same Chrome 153.0.8010.36 release that achieve full sandbox escape and remote code execution, this flaw is bounded to confidentiality impact only with no scope change - the read does not escape the renderer process. No public exploit code or active exploitation has been identified at time of analysis, and the EPSS score of 0.17% reflects minimal current attacker interest.
ControlledFrame in Google Chrome prior to 153.0.8010.36 exposes sensitive information to an attacker who has already achieved renderer process compromise, exploitable via a crafted HTML page (UI:R). This is a chained post-exploitation primitive rather than an initial access vector: it extends the damage of a separate renderer exploit by enabling cross-origin data exfiltration from the victim's session. No public exploit code exists, EPSS stands at 0.29% (21st percentile), and no CISA KEV listing is present, consistent with the high effective exploitation barrier imposed by the renderer pre-compromise requirement.
Cross-origin data disclosure in Google Chrome's Paint rendering component (versions prior to 153.0.8010.36) enables a remote attacker to read data belonging to a different web origin by directing a victim to a crafted HTML page. The root cause is an origin validation error (CWE-346) in the Paint pipeline, which under certain rendering conditions fails to enforce the Same-Origin Policy, leaking partial cross-origin data to the attacker-controlled page. EPSS is 0.14% (3rd percentile), Chromium rates this 'Medium,' and no public exploit or CISA KEV listing exists at time of analysis - placing this squarely in standard patch-cadence rather than emergency response territory.
Site isolation bypass in Google Chrome prior to 153.0.8010.36 allows a remote attacker to subvert cross-origin integrity guarantees by directing a victim to visit a crafted HTML page, exploiting incorrect authorization checks (CWE-863) in Chrome's Isolated component. The CVSS score rates integrity impact as High with no privileges required, but user interaction is necessary and confidentiality impact is assessed as none. No public exploit code exists and SSVC marks exploitation as none; EPSS stands at 0.18%, suggesting low observed threat activity despite the patch being available.
Missing authorization in Chrome's FileSystem component allows a remote attacker to bypass system access restrictions via a crafted HTML page, requiring social engineering to achieve user interaction. Affects all Chrome versions prior to 153.0.8010.36 across desktop platforms. With PR:N and I:H in the CVSS vector, an unauthenticated attacker who tricks a user into visiting a malicious page can achieve high-integrity impact against the local filesystem without confidentiality or availability consequences.
Race condition in the Browser component of Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by inducing a victim to visit a crafted HTML page. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L) reflects limited, non-scope-changing impact - this is not a sandbox escape but a partial access-control bypass within the Browser process. EPSS at 0.20% (10th percentile), Chromium's own 'Medium' severity rating, and the absence of KEV listing or public exploit code all converge on low near-term exploitation risk.
UI misrepresentation in Google Chrome's Payments component prior to 153.0.8010.36 allows a remote attacker to spoof payment-related interface elements by serving a crafted HTML page. The spoofed UI can deceive users into believing they are interacting with legitimate Chrome payment dialogs, potentially facilitating credential or payment-data disclosure. No public exploit code has been identified and EPSS sits at 0.27% (19th percentile), placing real-world exploitation risk as low at this time.
Safebrowsing information omission in Google Chrome on macOS prior to 153.0.8010.36 allows a remote unauthenticated attacker to bypass system access restrictions by delivering a crafted HTML page that causes Chrome's Safe Browsing subsystem to silently suppress or lose security-relevant signals. The CVSS vector (PR:N/UI:R/I:H) reflects that a victim need only visit a malicious page, after which Safebrowsing protections fail to surface warnings - exposing users to malicious downloads or sites without Chrome's normal safety guardrails. No public exploit code exists and EPSS is very low (0.20%, 10th percentile); no CISA KEV listing at time of analysis.
Sensitive information disclosure in the Enterprise component of Google Chrome on Windows allows a remote attacker to obtain protected data by luring a user to a crafted HTML page. All Chrome releases on Windows prior to 153.0.8010.36 are affected. No public exploit has been identified at the time of analysis, and with an EPSS of 0.17% (7th percentile), opportunistic mass exploitation is unlikely in the near term despite the high confidentiality impact rating.
Incorrect authorization in Google Chrome's Browser component on Android allows a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. Affected versions are all Chrome for Android releases prior to 153.0.8010.36. The vulnerability carries a CVSS score of 6.5 (Medium), consistent with Chromium's own 'Medium' severity classification, and no public exploit code or active exploitation has been identified at time of analysis.
CSS output encoding failure in Google Chrome prior to 153.0.8010.36 allows an unauthenticated remote attacker to potentially bypass the same-origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin information disclosure. The CVSS score of 4.3 aligns with Chromium's own 'Medium' severity classification, reflecting that the impact is scoped to partial confidentiality loss with no integrity or availability consequence. No active exploitation has been confirmed and EPSS remains low at 0.26%, indicating this is currently a theoretical risk addressed by the September 2026 stable channel update.
UI misrepresentation in Google Chrome's Geometry component (versions prior to 153.0.8010.36) enables remote attackers to spoof browser interface elements through a crafted HTML page, requiring social engineering to achieve user interaction. The flaw (CWE-451) permits an attacker to visually deceive victims about the true origin or nature of displayed content, creating a pathway for phishing and credential harvesting. No public exploit has been identified at time of analysis; vendor-released patch is available in the September 2026 stable channel update.
SiteIsolation incorrect authorization in Google Chrome prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to bypass cross-origin access restrictions via a crafted HTML page. The flaw (CWE-863) carries a CVSS 6.5 with high integrity impact and no confidentiality or availability dimension, consistent with a second-stage sandbox-escape component rather than a standalone entry point. No public exploit has been identified at time of analysis, and the EPSS score of 0.18% (7th percentile) reflects very low observed exploitation probability; Chromium's own severity rating of 'Medium' aligns with this assessment.
Observable discrepancy (CWE-203) in the Safebrowsing component of Google Chrome on iOS prior to 153.0.8010.36 enables a remote attacker with a pre-compromised renderer process to leak sensitive information through behavioral differences when processing a crafted HTML page. The vulnerability is iOS-platform-specific and is chained after renderer compromise rather than exploited standalone. No public exploit exists and EPSS probability is 0.24%, consistent with the multi-stage exploitation requirement.
Incorrect authorization in Chrome's DataTransfer API (prior to 153.0.8010.36) permits an attacker who has already achieved renderer process compromise to read sensitive data via a crafted HTML page. The flaw (CWE-863) bypasses intended access-control checks on clipboard or drag-and-drop data within the renderer context, enabling information disclosure rather than code execution. No public exploit code exists and EPSS sits at 0.17% (6th percentile), reflecting this as a chained, second-stage attack primitive rather than a standalone initial-access vector.
Incorrect authorization in Chrome's Isolated component (all versions prior to 153.0.8010.36) enables remote attackers to spoof UI elements by directing users to a crafted HTML page. The flaw stems from CWE-863 authorization failures within Chrome's isolation architecture, allowing cross-boundary deception without requiring attacker authentication. No public exploit exists and EPSS is 0.17% (6th percentile), placing this firmly in the routine-patching tier despite the network-accessible attack vector.
Missing authorization in Google Chrome's FedCM (Federated Credential Management) component, versions prior to 153.0.8010.36, enables a remote attacker to bypass the web origin policy by luring a user to a crafted HTML page. The flaw (CWE-862) results in limited confidentiality impact - an origin-policy bypass that could expose data scoped to that cross-origin context. No public exploit exists and EPSS sits at 0.19% (9th percentile), consistent with Chromium's own 'Medium' severity rating and the requirement for user interaction.
ServiceWorker information leak in Google Chrome prior to 153.0.8010.36 enables a remote attacker who has already compromised the renderer process to extract sensitive information via a crafted HTML page. This is a chained exploitation technique rather than a standalone attack - requiring prior renderer process control as a hard prerequisite, making it a second-stage capability within a broader browser exploit chain. No public exploit code exists and EPSS sits at 0.29% (21st percentile), indicating low observed exploitation activity; the vulnerability is not listed in CISA KEV.
Safebrowsing in Google Chrome prior to 153.0.8010.36 can be bypassed through improper state validation (CWE-754), enabling a remote attacker to suppress Chrome's phishing and malware protection warnings by delivering a crafted HTML page to a victim. The integrity-only impact (CVSS I:H, C:N, A:N) reflects that successful exploitation undermines Chrome's access restriction enforcement rather than directly exfiltrating data, but it clears the path for downstream malware delivery or credential harvesting that Safebrowsing would otherwise have blocked. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog; EPSS at 0.18% (8th percentile) corroborates low current weaponization probability.
Improper input validation in the Safebrowsing component of Google Chrome on Android prior to 153.0.8010.36 enables a remote attacker to bypass system access restrictions through a crafted HTML page. Exploitation requires social engineering to direct an Android Chrome user to the malicious page (UI:R), limiting opportunistic attack surface. No public exploit code has been identified and EPSS is very low (0.22%, 13th percentile), though the integrity-only CVSS 6.5 accurately reflects a meaningful access restriction bypass on a ubiquitously deployed browser. Vendor-released patch is available in Chrome 153.0.8010.36.
Uninitialized GPU resource use in Google Chrome on Android (prior to 153.0.8010.36) allows remote attackers to read process memory across the sandbox boundary via a crafted HTML page. The CVSS S:C (scope changed) metric confirms the vulnerability crosses Chrome's GPU sandbox, leaking partial memory contents outside the sandboxed GPU process to a network-positioned attacker. No public exploit or CISA KEV listing exists; EPSS of 0.31% (24th percentile) indicates low observed exploitation probability, consistent with Chromium's 'Medium' severity rating.
Navigation component information leak in Google Chrome prior to 153.0.8010.36 enables an attacker who has already compromised the renderer process to bypass site isolation and exfiltrate cross-origin data via a crafted HTML page. This is a second-stage exploit component: it cannot be chained without a prior renderer compromise, which significantly elevates the effective attack complexity despite the AV:N/AC:L CVSS surface reading. Chromium's own severity rating is 'Medium', consistent with the prerequisite constraint. No public exploit identified at time of analysis; EPSS at 0.18% (8th percentile) reflects the elevated bar for exploitation.
Cross-origin data exposure in Google Chrome's Scroll component (all versions prior to 153.0.8010.36) enables an attacker who has already achieved renderer process compromise to exfiltrate sensitive data from other web origins via a crafted HTML page. This is a secondary-stage vulnerability - it does not provide initial access but extends an existing renderer compromise into a cross-origin information leak. Chromium rated this Medium severity, consistent with the 4.3 CVSS score; no public exploit exists and EPSS at 0.17% (7th percentile) reflects the narrow, chained exploitation scenario.
Cross-origin data leakage via Google Chrome's ServiceWorker implementation allows remote attackers to obtain information from other origins by serving a crafted HTML page to a victim. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No active exploitation is confirmed (absent from CISA KEV), and EPSS at 0.21% reflects low real-world exploitation activity.
UI element spoofing in Google Chrome's Geometry rendering component (versions prior to 153.0.8010.36) enables a remote attacker to misrepresent browser chrome and UI elements through a crafted HTML page, requiring the victim to visit the malicious page via social engineering. The vulnerability, classified under CWE-451 (User Interface Misrepresentation of Critical Information), allows an attacker to render fake address bars, security dialogs, or browser-level indicators in a way that deceives users into disclosing credentials or taking unintended actions. No public exploit code has been identified and no CISA KEV listing exists; EPSS at 0.21% (11th percentile) reflects negligible observed exploitation activity.
Incomplete cleanup in the Downloads component of Google Chrome prior to 153.0.8010.36 enables remote attackers to bypass system-level access restrictions, achieving high integrity impact without requiring any privileges. Exploitation requires social engineering: the victim must be lured to a crafted HTML page that triggers leftover state or residual artifacts from the Downloads subsystem, which Chrome fails to fully sanitize. EPSS is low (0.28%, 20th percentile) and no confirmed active exploitation or public proof-of-concept has been identified at time of analysis; Chromium's own internal severity rating of 'Medium' aligns with the NVD CVSS 6.5 score.
Missing authorization in the Downloads component of Google Chrome prior to 153.0.8010.36 allows a remote attacker to bypass system-level access restrictions using a crafted Chrome extension. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) reflects that user interaction is required to trigger the flaw, limiting automated mass exploitation. No public exploit has been identified, EPSS sits at 0.27% (19th percentile), and the Chromium team independently rates this as 'Medium' severity - all signals consistent with no confirmed active exploitation.
Google Chrome's browser UI component (all versions prior to 153.0.8010.36) is vulnerable to visual spoofing attacks where an attacker can manipulate how the browser presents security-critical interface elements to users. By serving a specially crafted HTML page combined with social engineering, a remote unauthenticated attacker can make Chrome display misleading UI indicators - such as deceptive origin representations or manipulated security signals - potentially enabling credential theft or unauthorized permission grants. No public exploit code exists and the EPSS score of 0.21% (11th percentile) indicates low near-term exploitation probability, consistent with Chromium's own Medium severity classification.
Address bar spoofing in Google Chrome prior to 153.0.8010.36 allows a remote attacker to misrepresent the displayed URL via a specially crafted domain name, exploiting a flaw in the UrlFormatting subsystem. The attack requires social engineering to direct a victim to the attacker-controlled domain, after which the browser renders a deceptive address bar that masks the true origin. No public exploit has been identified at time of analysis, and EPSS at 0.16% (6th percentile) reflects low observed exploitation interest, consistent with the medium severity and UI:R requirement.
UI spoofing in Google Chrome's Session component (all versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent browser UI elements - such as session state indicators or security context - by delivering a crafted HTML page to a victim. The impact is deception-oriented: a user can be misled about the true security or session context of an interaction, enabling downstream phishing or session confusion attacks. No public exploit code has been identified and EPSS probability is 0.29% (21st percentile), consistent with no active exploitation at time of analysis.
UI misrepresentation in Google Chrome's Downloads component prior to 153.0.8010.36 allows remote attackers to bypass system access restrictions by deceiving users through a crafted HTML page. The flaw (CWE-451) causes Chrome to display misleading information about files being downloaded, enabling social-engineering attacks that trick users into accepting or executing content they would otherwise reject. Chromium rates this Medium severity, consistent with the CVSS 5.4; no public exploit code exists and EPSS at 0.24% (15th percentile) reflects low exploitation probability at time of analysis.
UI misrepresentation in Google Chrome's FedCM (Federated Credential Management) API prior to 153.0.8010.36 enables remote attackers to spoof identity-provider sign-in dialogs via crafted HTML pages, requiring user interaction. The flaw (CWE-451) allows a malicious page to manipulate how FedCM presents credential prompts, potentially misleading users into authorizing the wrong identity provider or disclosing credential context to an attacker-controlled endpoint. No public exploit code or active exploitation has been identified; EPSS is 0.17%, consistent with Chromium's 'Medium' severity classification.
Clickjacking in Google Chrome's Downloads component (all versions prior to 153.0.8010.36) enables a remote attacker to spoof Chrome's download UI elements by luring a victim to a crafted HTML page. Through UI overlay or frame-stacking techniques, the attacker can make a user believe they are interacting with legitimate Chrome download controls while actually triggering attacker-defined actions. No public exploit code exists and EPSS of 0.24% (15th percentile) reflects low real-world exploitation probability; Chromium's own severity rating of Medium aligns with the CVSS 5.4 score.
Clickjacking via TrustedWebActivities (TWA) in Google Chrome on Android prior to 153.0.8010.36 allows a local attacker with a co-installed malicious app to spoof the browser address bar, enabling deceptive phishing scenarios where the user believes they are on a trusted domain. The attack leverages CWE-1021 (UI layer redressing) in Chrome's TWA feature, which is designed to let Android apps surface web content with reduced browser chrome. No public exploit code has been identified and EPSS sits at 0.18% (8th percentile), consistent with the local-access requirement and high attack complexity. Google has released the fix in the stable channel update to 153.0.8010.36.
UI spoofing in Google Chrome's FedCM (Federated Credential Management) implementation allows an attacker who has already compromised the renderer process to inject malformed identity-provider dialog elements via a crafted HTML page, potentially deceiving users into submitting credentials to an attacker-controlled endpoint. All Chrome desktop versions prior to 153.0.8010.36 are affected. The attack is two-stage: an independent renderer-compromise vulnerability must first be exploited, making this a chained post-exploitation capability rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing are confirmed at time of analysis.
UI misrepresentation in Google Chrome prior to 153.0.8010.36 allows a remote attacker to spoof browser UI elements - such as the address bar, security indicators, or permission dialogs - via a specially crafted HTML page, requiring social engineering to lure the victim. Exploiting CWE-451, the attacker can deceive users into trusting a malicious or phishing page as legitimate, potentially leading to credential theft or other user-driven disclosures. No public exploit code has been identified and EPSS is 0.24% (15th percentile), consistent with the Chromium team's 'Medium' severity rating and the high-complexity social engineering prerequisite.
UI misrepresentation in Google Chrome's Downloads panel prior to version 153.0.8010.36 allows a remote attacker to spoof download-related UI elements, potentially deceiving users into accepting or running malicious content they believe to be legitimate. The vulnerability is triggered by a crafted HTML page and requires social engineering to lure a victim into visiting the attacker-controlled page. No public exploit has been identified at time of analysis, and EPSS at 0.24% (15th percentile) places real-world exploitation risk low; however, Chrome's ubiquitous deployment keeps the absolute exposure surface significant.
Improper input validation in Chrome's Interstitials component - the full-page security warning screens shown for SSL errors, Safe Browsing alerts, and download warnings - allows a remote attacker to spoof UI elements by delivering a crafted HTML page to an unsuspecting user. Affected versions are all Chrome releases prior to 153.0.8010.36 across desktop platforms. No public exploit code has been identified and EPSS stands at 0.17% (7th percentile), reflecting low near-term exploitation probability, though successful abuse could undermine user trust in browser security indicators and facilitate phishing or credential harvesting.
Cross-origin data leakage in Google Chrome's Navigation component prior to version 153.0.8010.36 exposes partial information about cross-origin resources through an observable behavioral discrepancy (CWE-203 side-channel). Remote unauthenticated attackers can exploit this by serving a crafted HTML page that a victim visits, allowing inference of cross-origin data that should be protected by the Same-Origin Policy. No public exploit code exists and the vulnerability is not listed in CISA KEV; EPSS at the 15th percentile confirms limited real-world exploitation pressure. Vendor-released patch is available as Chrome 153.0.8010.36.
UI spoofing in Google Chrome's Passwords component (versions prior to 153.0.8010.36) allows a remote unauthenticated attacker to misrepresent password-related UI elements by delivering a crafted HTML page to a victim. Classified as CWE-451 (UI Misrepresentation of Critical Information), this flaw could deceive users into believing they are interacting with a legitimate password prompt or credential management interface when they are not, potentially facilitating credential phishing or confusion attacks. No public exploit or active exploitation (CISA KEV) has been identified; EPSS is 0.17% (7th percentile), consistent with Chromium's own 'Medium' severity rating.
Improper state validation in Google Chrome's Installer component (prior to 153.0.8010.36) allows remote attackers to bypass system access restrictions by serving a crafted HTML page to a user. The vulnerability carries a Chromium-assigned severity of Medium and an NVD CVSS base score of 4.3, with limited integrity impact and no confidentiality or availability consequences. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS places exploitation probability at a low 0.30%.
Web origin policy bypass in Google Chrome prior to 153.0.8010.36 allows a remote unauthenticated attacker to circumvent Same-Origin Policy (SOP) restrictions by exploiting improper input validation in the Network component via a crafted HTML page. The CVSS 4.3 Medium rating is consistent with Chromium's own 'Medium' severity classification, with impact limited to partial confidentiality loss and no integrity or availability consequence. No public exploit code is identified and EPSS sits at 0.18% (8th percentile), indicating very low near-term exploitation probability.
Web origin policy bypass in Google Chrome's Loader component (versions prior to 153.0.8010.36) lets a remote attacker circumvent same-origin protections by serving a crafted HTML page, potentially reading cross-origin resources the attacker should not have access to. The CVSS score of 4.3 and Chromium's own 'Medium' severity rating are consistent, reflecting a confidentiality-only impact with no integrity or availability consequence and no sandbox escape. No public exploit code and no CISA KEV listing exist at time of analysis; EPSS places exploitation probability at 0.26% (18th percentile), indicating low real-world exploitation likelihood.
Missing authorization in Google Chrome's Browser component (prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions via a crafted HTML page. The CWE-862 root cause - an absent authorization check rather than a broken one - means the Browser component fails to enforce expected access control boundaries when processing certain HTML content. Chromium rated this 'Medium' severity, consistent with the CVSS 4.3 score reflecting limited integrity-only impact and a requirement for user interaction. No active exploitation has been confirmed and no public exploit code has been identified at time of analysis.
UI spoofing in Google Chrome's Accessibility subsystem on macOS (all versions prior to 153.0.8010.36) stems from incorrect reference resolution (CWE-706), enabling a remote unauthenticated attacker to mislead users into perceiving fraudulent UI elements via a crafted HTML page. The attack requires a user to visit a malicious page, and no active exploitation or public proof-of-concept code has been identified at time of analysis. Vendor-released patch 153.0.8010.36 is available via the Chrome stable channel update published on the Chrome Releases blog.
Missing authorization in Google Chrome's Browser component (versions prior to 153.0.8010.36) permits remote attackers to bypass system access restrictions by directing users to a crafted HTML page. The flaw, classified as CWE-862 (Missing Authorization), carries a CVSS 4.3 Medium score with a limited integrity impact and no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.19% (9th percentile), placing real-world exploitation risk well below the threshold warranting emergency response.
Incorrect authorization in Chrome's Navigation component (versions prior to 153.0.8010.36) allows a remote attacker who has already compromised the renderer process to spoof browser UI elements - such as the address bar or security indicators - via a crafted HTML page. This is a chained exploit step, not a standalone vulnerability: renderer-level code execution via a separate flaw is a hard prerequisite. Chromium classifies severity as 'Medium,' consistent with the CVSS 4.2 score; no public exploit code and no active exploitation (CISA KEV) have been identified.
Missing authorization in Chrome's ControlledFrame component allows remote unauthenticated attackers to bypass system access restrictions by socially engineering a victim into visiting a crafted HTML page. Versions prior to 153.0.8010.36 are affected across desktop platforms; Google shipped a fix in the stable channel update. No public exploit or CISA KEV listing exists, and an EPSS of 0.29% confirms low real-world exploitation probability consistent with Chromium's own 'Medium' severity rating.
Incomplete cleanup in Google Chrome's Browser component (all versions prior to 153.0.8010.36) enables a remote attacker to bypass the web same-origin policy via a crafted Chrome extension, contingent on social engineering the victim into installing it. The integrity impact is high - a successful attacker can tamper with cross-origin web content - while confidentiality and availability are unaffected per the CVSS vector (C:N/A:N). No public exploit code or CISA KEV listing exists at time of analysis, and an EPSS score of 0.28% at the 21st percentile reflects low observed exploitation probability.
Omnibox in Google Chrome prior to 153.0.8010.36 permits a remote unauthenticated attacker to bypass system access restrictions and navigate into privileged internal browser pages through a crafted HTML page delivered via social engineering. The root cause is missing authorization (CWE-862) in the Omnibox component, meaning Chrome fails to enforce access controls before allowing navigation to restricted page contexts. No public exploit or active exploitation has been identified; Chromium rates this Medium, consistent with the CVSS 6.5 score and mandatory user interaction requirement.
Incorrect authorization in the Loader component of Google Chrome prior to 153.0.8010.36 enables a remote attacker to obtain sensitive information by luring a victim to a crafted HTML page. The CVSS base score of 6.5 and Chromium's own 'Medium' severity rating are consistent, reflecting the high confidentiality impact constrained by mandatory user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.23% places this in the 14th percentile for near-term exploitation likelihood.
Uninitialized memory in the Codecs component of Google Chrome before 153.0.8010.36 leaks sandbox-internal memory to a remote attacker via a crafted HTML page. The vulnerability stems from CWE-908 (use of uninitialized resource) where codec processing exposes arbitrary memory contents that happen to reside in uninitialized buffers - but exploitation is constrained entirely within the Chrome sandbox (S:U). No active exploitation is confirmed and no public exploit code exists; EPSS stands at 0.19% (9th percentile), consistent with a low-priority medium-severity disclosure issue.