Suse
Monthly
Web origin policy bypass in Google Chrome's ReadingList component on Windows enables a renderer-compromised attacker to cross origin boundaries via a crafted HTML page. Affected are all Chrome for Windows versions prior to 152.0.7977.65. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), and Chromium's own security team rates this as Low severity despite the NVD CVSS score of 6.5.
Incorrect reference resolution in the WebView component of Google Chrome on Android (versions prior to 152.0.7977.65) enables a remote attacker to potentially bypass the web origin policy by delivering a crafted HTML page. The flaw carries a Chromium-internal severity of Low, consistent with the limited confidentiality-only impact (C:L/I:N/A:N) reflected in the CVSS 4.3 score. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) confirms negligible current exploitation probability.
Memory disclosure via uninitialized GPU resource in Google Chrome on Android (prior to 152.0.7977.65) allows a remote attacker to read memory outside the browser sandbox by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a low-complexity network attack requiring no privileges but dependent on user interaction. No public exploit code has been identified at time of analysis, and the low EPSS score of 0.31% corroborates a currently low exploitation probability despite Chrome's enormous Android deployment footprint.
Memory disclosure in Google Chrome for Android (prior to 152.0.7977.65) exposes sandbox-contained memory via an uninitialized GPU resource, triggered when a victim loads a crafted HTML page. The flaw is platform-specific to Android and carries confidentiality-only impact bounded by Chrome's GPU sandbox isolation - no integrity or availability exposure. No public exploit code is identified at time of analysis, and EPSS at 0.31% (24th percentile) aligns with the vendor's own 'Low' Chromium severity rating, indicating low near-term exploitation probability.
Incorrect authorization in the Controls component of Google Chrome prior to version 152.0.7977.65 enables web origin policy bypass via a crafted HTML page, requiring only that a user visit the attacker-controlled page. The flaw (CWE-863) allows limited cross-origin integrity manipulation with no confidentiality or availability impact, as reflected in the CVSS integrity-only impact score. No public exploit has been identified at time of analysis, EPSS stands at 0.19% (8th percentile), and the Chromium team internally rated severity as Low - all signals consistent with a narrow-impact, user-interaction-dependent authorization gap.
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
UI spoofing in Google Chrome's Transactions Platform prior to version 152.0.7977.65 enables remote attackers to misrepresent UI elements - such as payment confirmation dialogs or security indicators - through a crafted HTML page, relying on social engineering for delivery. Classified under CWE-451 (UI Misrepresentation of Critical Information), the flaw requires user interaction and carries no confidentiality or availability impact, confining harm to integrity via deception. No active exploitation is confirmed and EPSS probability is very low (0.29%), but the ubiquitous deployment footprint of Chrome means the absolute population of potential targets is large.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
Skia, the 2D graphics library embedded in Google Chrome prior to 152.0.7977.65, leaks sensitive information when an attacker who has already compromised the renderer process delivers a crafted HTML page to a victim. This CWE-200 flaw functions as a chaining component in a multi-stage exploit rather than a standalone entry point - it amplifies the impact of a prior renderer compromise rather than providing initial access. No public exploit code exists, EPSS is 0.17% (7th percentile), and Chrome's own severity classification is Low, all consistent with the mandatory pre-condition of a pre-compromised renderer.
Race condition in Google Chrome's Transactions Platform on Android (prior to 152.0.7977.65) enables remote attackers to bypass system access restrictions with high integrity impact. Exploitation requires social engineering the victim into visiting a crafted HTML page, and the race window makes reliable triggering difficult (AC:H per CVSS). Chromium's own severity rating is Low; EPSS at 0.18% (7th percentile) confirms minimal real-world exploitation pressure, and no public exploit or KEV listing has been identified.
Missing authorization in the BrowserTag component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by distributing a crafted Chrome extension via social engineering. The flaw bypasses authorization checks within BrowserTag, allowing the malicious extension to access data it should not be permitted to read. No active exploitation has been identified (CISA KEV absent), EPSS sits at 0.23% (13th percentile), and Chromium's own severity classification is 'Low' - all consistent with the UI:R prerequisite of tricking a user into installing a hostile extension.
Out-of-bounds memory read in Google Chrome's FileSystem component (versions prior to 152.0.7977.65) allows a remote unauthenticated attacker to leak memory contents from outside the browser's renderer sandbox by directing a victim to a specially crafted HTML page via social engineering. Exploitation is contingent on user interaction, limiting opportunistic or automated mass exploitation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), though the Confidentiality impact is rated High, meaning successful exploitation could expose sensitive data from browser memory. Vendor-released patch is available in Chrome 152.0.7977.65.
Web origin policy bypass in Google Chrome Extensions affects all desktop versions prior to 152.0.7977.65, exploitable only by an attacker who has already compromised the renderer process. The incorrect authorization flaw (CWE-863) in the Extensions subsystem allows the renderer-level attacker to cross Same-Origin Policy boundaries via a specially crafted HTML page, potentially reading data from origins the renderer should not access. No public exploit code and no CISA KEV listing exist; EPSS is 0.19% (8th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Observable discrepancy in Chrome's Glic component allows remote information disclosure against users running versions prior to 152.0.7977.65. An attacker who persuades a victim to visit a crafted HTML page can exploit a behavioral or timing side-channel in the Glic AI-integration subsystem to extract sensitive information with high confidentiality impact, despite the medium overall CVSS score. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) indicates very low current exploitation probability.
Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Improper input validation in Chrome's DeviceBoundSessionCredentials (DBSC) component allows remote attackers to bypass the web origin policy by delivering crafted network traffic, contingent on social engineering the user into triggering the request. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the low-to-medium CVSS 4.3 rating and the user-interaction prerequisite.
Race condition in Google Chrome's Editing component prior to version 152.0.7977.65 enables remote attackers who successfully socially engineer a victim to visit a crafted HTML page to extract sensitive information from the browser. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) shows the attack is network-delivered but requires high complexity timing and explicit user interaction, limiting real-world exploitability. No public exploit identified at time of analysis, and the extremely low EPSS score of 0.14% (4th percentile) corroborates the vendor's own Low Chromium severity designation.
Incorrect authorization in Chrome's WebProtect component (CWE-863) allows a remote attacker to bypass system access restrictions via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms impact is limited to partial integrity loss with no confidentiality or availability consequence, and exploitation is gated on the victim actively navigating to attacker-controlled content. No active exploitation is confirmed - CISA KEV status is absent and EPSS stands at 0.19% (8th percentile), consistent with the Low severity rating assigned by the Chromium security team.
Bluetooth information disclosure in Google Chrome on macOS (versions prior to 152.0.7977.65) enables a remote attacker - who has already compromised the renderer process - to extract sensitive Bluetooth-related information by combining a crafted HTML page with social engineering. This is a chained, multi-prerequisite vulnerability: successful exploitation requires a prior renderer compromise and active victim interaction, which the CVSS AC:H rating reflects. No public exploit code exists and no active exploitation has been observed (SSVC: Exploitation none; EPSS 0.29%), placing real-world risk substantially below what the C:H confidentiality impact alone might suggest. A vendor patch is available in Chrome 152.0.7977.65.
Missing authorization in Chrome's Preload subsystem (CWE-862) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. The bypass results in limited cross-origin data disclosure (confidentiality impact only). No public exploit code has been identified and the CVE is absent from the CISA KEV catalog; EPSS stands at 0.22% (13th percentile), consistent with low real-world exploitation activity.
Sensitive information exposure in Google Chrome for Android (versions prior to 152.0.7977.65) via the Android Intents mechanism allows a remote attacker to leak confidential browser or device data by delivering a crafted HTML page to the victim. The vulnerability requires user interaction - the target must visit the malicious page - limiting opportunistic mass exploitation despite the network-accessible attack vector. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.17%, consistent with Chromium's own 'Low' severity classification, though the CVSS C:H rating reflects a meaningful confidentiality impact if triggered.
Chrome's Sharing feature on Android leaks sensitive information to local attackers in all versions prior to 152.0.7977.65, exploitable only when a malicious co-installed app is present on the target device combined with social engineering. Despite a High confidentiality impact in the CVSS vector, the overall score of 5.1 reflects severe practical constraints: local access, high complexity, and a social engineering dependency. No public exploit code has been identified, EPSS probability is 0.15% (4th percentile), and Chromium's own severity rating is Low - signals that align to suggest low near-term operational risk.
UI misrepresentation in Google Chrome's Linux Toolkit Theming component enables remote attackers to bypass system access restrictions through a crafted HTML page, relying on social engineering to complete the attack. All Chrome versions prior to 152.0.7977.65 on Linux are affected; Google shipped the fix in stable channel release 152.0.7977.65. No active exploitation has been confirmed (absent from CISA KEV), and an EPSS of 0.30% at the 23rd percentile reflects low automated exploitation probability.
Incorrect authorization in Google Chrome's browser component prior to version 152.0.7977.65 allows web origin policy bypass via a crafted HTML page. Remote unauthenticated attackers can exploit this flaw by inducing a user to visit a malicious page, resulting in limited cross-origin data reads - a breach of the same-origin policy, which is a foundational browser security boundary. No public exploit identified at time of analysis and not listed in CISA KEV; EPSS of 0.19% (8th percentile) confirms low exploitation probability in the current threat landscape.
System access restriction bypass in Google Chrome's Workers subsystem affects all versions prior to 152.0.7977.65, functioning as the second link in an exploit chain where an attacker must first compromise the renderer process. Improper input validation in Workers then allows a crafted HTML page to circumvent Chrome's sandbox-enforced access controls, yielding limited confidentiality and integrity impact on the host. EPSS is 0.22% (12th percentile) with no confirmed active exploitation via CISA KEV, placing this squarely in the category of a chained, low-probability threat rather than a mass-exploitation vector.
DOM information leak in Google Chrome before version 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy by luring a victim to a crafted HTML page, potentially exposing cross-origin data to the attacker. The CVSS 4.3 Medium score reflects network-exploitable, unauthenticated delivery limited to confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and an EPSS probability of 0.22% (12th percentile) indicates low near-term exploitation likelihood despite the broad affected product footprint.
Cross-origin data exposure in Google Chrome's Extensions subsystem prior to version 152.0.7977.65 allows a remote attacker who successfully socially engineers a victim into installing a crafted malicious extension to read data from web origins the extension should not have access to. The high confidentiality impact (C:H) is real, but exploitation is gated on user interaction - the victim must install the malicious extension - which substantially limits opportunistic mass exploitation. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.27% (18th percentile) reflects low current exploitation probability consistent with no observed in-the-wild use.
Information disclosure in Google Chrome's Geolocation component prior to version 152.0.7977.65 allows a remote attacker to obtain the victim's sensitive geolocation data by tricking them into visiting a crafted HTML page. The attack relies on social engineering as the delivery mechanism and results in a high-confidentiality-impact leak of physical location information, which may expose home or workplace addresses. No public exploit code or active exploitation has been identified; EPSS at 0.21% (11th percentile) confirms low automated exploitation probability at time of analysis.
Memory disclosure in Google Chrome's Dawn WebGPU component exposes uninitialized memory contents to remote attackers who can lure a user to a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on desktop platforms, per the EUVD and Chrome release advisory. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage via an uninitialized resource in the WebXR API affects Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker who can socially engineer a user into visiting a crafted HTML page may trigger a read of uninitialized memory, potentially exposing data from other browser origins. Google has rated this Medium severity; a patched release (152.0.7977.65) is available, and no public exploit or active exploitation has been identified at time of analysis.
Cross-origin data exposure via a ServiceWorker flaw in Google Chrome prior to 152.0.7977.65 permits remote attackers to read data from origins they do not control. An attacker can exploit this by delivering a crafted HTML page to a victim user, leveraging Chrome's ServiceWorker API to bypass same-origin isolation and exfiltrate cross-origin responses. No public exploit code is identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation activity; the mandatory user-interaction requirement further constrains automated abuse.
Incorrect USB authorization in Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass system USB access restrictions by socially engineering a user into visiting a crafted HTML page. The flaw (CWE-863) in Chrome's USB subsystem grants unauthorized access without proper permission verification, resulting in a limited integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS is very low at 0.21% (11th percentile), consistent with Chromium's own Medium severity rating; a vendor patch has been released.
Incorrect authorization in Google Chrome's WebXR implementation prior to version 152.0.7977.65 enables cross-origin data exfiltration via a crafted HTML page, requiring attacker-driven social engineering to direct a victim to the malicious page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5, reflecting high confidentiality impact but no integrity or availability loss, and user interaction is a necessary prerequisite. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog at time of analysis, with EPSS at 0.21% (11th percentile) confirming low observed exploitation activity.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.
Code injection in Google Chrome's Bisection component allows remote attackers to exfiltrate sensitive information by enticing a user to open a crafted file. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The vulnerability carries a CVSS 6.5 Medium rating with high confidentiality impact; no public exploit has been identified and EPSS sits at 0.19% (8th percentile), indicating minimal active exploitation pressure at time of analysis. Vendor patch is confirmed available.
Network-layer information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive data by directing a victim to a crafted HTML page. The attack is a multi-stage chain: the renderer compromise is a hard prerequisite not satisfied by this CVE alone, which materially constrains real-world exploitability. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) corroborates low observed exploitation probability; no CISA KEV listing exists.
Incorrect authorization in the Device component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions - specifically controls governing device-level API access - through a crafted HTML page delivered via social engineering. Exploitation requires user interaction, limiting opportunistic mass exploitation, and EPSS at 0.29% (21st percentile) reflects low real-world exploitation probability. No public exploit identified and no CISA KEV listing; a vendor patch is available.
Incorrect authorization in Chrome's GetUserMedia API allows remote attackers to obtain sensitive information - specifically unauthorized access to a user's camera or microphone feed - by luring the victim to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the High confidentiality impact warrants timely patching given Chrome's ubiquitous deployment.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) grants a remote attacker who has already compromised the renderer process the ability to circumvent Same-Origin Policy restrictions via a crafted HTML page, leaking limited confidential data from cross-origin contexts. This is a second-stage exploitation primitive - it is only dangerous when chained with a separate renderer compromise vulnerability. No public exploit identified at time of analysis, and the low EPSS score of 0.26% (18th percentile) reflects minimal current exploitation interest.
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. No public exploit code and no CISA KEV listing are present; EPSS places exploitation probability at 0.24% (15th percentile), consistent with a low-priority but broadly applicable patch.
Improper resource exposure in Google Chrome's StreamsAPI (versions prior to 152.0.7977.65) enables remote attackers to partially bypass the web origin policy and read limited data from privileged browser pages via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - consistent with CVSS UI:R and S:U, confining impact to the victim's own browser context. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.18% (8th percentile) indicates very low real-world exploitation probability at time of analysis.
DevTools Missing Authorization in Google Chrome prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers who socially engineer victims into performing specific UI interactions. The CWE-862 root cause indicates the DevTools component lacks proper authorization checks on certain UI-driven data access paths, allowing an attacker-controlled page to extract information the browser context holds. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.15% at the 5th percentile confirms minimal near-term exploitation probability despite the C:H CVSS impact rating.
Incorrect authorization in Google Chrome's Web Authentication subsystem (Passkeys and Security Keys) allows a remote attacker to bypass the web origin policy by inducing a user to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop platforms are affected. The impact is limited to partial confidentiality - origin policy bypass could expose authentication context or credential associations across origins - with no integrity or availability impact confirmed.
CSS injection in Google Chrome prior to version 152.0.7977.65 enables a remote attacker to extract sensitive information from a victim's browser session by delivering a crafted HTML page. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N vector confirms unauthenticated network delivery requiring only that the victim navigate to attacker-controlled content, with high confidentiality impact and no integrity or availability consequences. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% at the 10th percentile indicates very low observed exploitation probability; this is not listed in the CISA KEV catalog.
Chrome's FileSystem API prior to version 152.0.7977.65 improperly handles case sensitivity when enforcing access restrictions, enabling a remote attacker to bypass system-level file access controls via a crafted HTML page delivered through social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms a network-reachable, unauthenticated path with high integrity impact, though the mandatory user interaction requirement limits mass exploitation. No public exploit has been identified at time of analysis, and an EPSS of 0.33% at the 26th percentile reflects limited observed exploitation activity.
Incorrect authorization in Google Chrome's Network component prior to version 152.0.7977.65 allows a remote, unauthenticated attacker to bypass the browser's web origin policy by delivering a crafted HTML page to a victim. The bypass yields limited confidentiality exposure, consistent with the CVSS C:L rating, and requires the target user to interact with attacker-controlled content. No public exploit code has been identified and EPSS stands at 0.19% (8th percentile), indicating low current exploitation probability despite the broad deployment footprint of Chrome.
Web origin policy bypass in Google Chrome's cache component affects all versions prior to 152.0.7977.65, exploitable by a remote unauthenticated attacker who tricks a user into visiting a crafted HTML page. The incorrect reference resolution (CWE-706) in the cache layer allows cross-origin data to be read, constituting a Same-Origin Policy bypass with limited confidentiality impact. No active exploitation is confirmed and EPSS sits at 0.20% (10th percentile), indicating low real-world exploitation pressure at this time.
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
CSS information leak in Google Chrome before 152.0.7977.65 enables remote attackers to exfiltrate sensitive browser data by luring victims to a crafted HTML page. The flaw resides in Chrome's CSS rendering subsystem (CWE-200: Information Exposure) and carries a CVSS C:H rating, meaning confidentiality impact is assessed as high despite the medium-severity label. No public exploit code has been identified and EPSS probability sits at 0.17% (7th percentile), indicating very low observed exploitation activity; the vulnerability is not listed in the CISA KEV catalog.
Incorrect authorization in Chrome's ServiceWorker component (CWE-863) allows remote unauthenticated attackers who can socially engineer a user into installing a crafted Chrome extension to bypass the web origin policy, resulting in limited cross-origin data exposure. All Chrome releases prior to 152.0.7977.65 are affected across platforms; a vendor patch is available. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) indicates very low current exploitation probability, consistent with the absence of a CISA KEV listing.
Cross-origin data leakage through the CustomTabs component in Google Chrome for Android (versions prior to 152.0.7977.65) enables a local attacker to extract sensitive browsing data belonging to other origins via a co-installed application. The flaw is classified CWE-200 and carries a CVSS Medium score of 5.5, reflecting meaningful confidentiality impact constrained by a local-only attack vector and required user interaction. No public exploit code or active exploitation via CISA KEV has been identified; the vendor-released patch is available in Chrome 152.0.7977.65.
Incorrect authorization in Chrome's Editing component (prior to 152.0.7977.65) permits remote attackers to read sensitive information by enticing a user to visit a specially crafted HTML page. The flaw (CWE-863) affects all Chrome versions across all platforms below the fixed release, with a high confidentiality impact but no integrity or availability consequence. No public exploit code or active exploitation is confirmed; EPSS stands at 0.36% (28th percentile), indicating low real-world exploitation probability at time of analysis.
Information leak in the Animation component of Google Chrome prior to 152.0.7977.65 allows remote unauthenticated attackers to obtain sensitive browser data by inducing a user to visit a crafted HTML page. The flaw is classified CWE-200 (Exposure of Sensitive Information) and carries a CVSS confidentiality impact of High, though Chromium's internal team rated it Medium severity. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.22% (13th percentile) confirms very low observed exploitation probability, making this a normal patch-cycle priority rather than an emergency.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
Observable discrepancy in HTML rendering in Google Chrome prior to 152.0.7977.65 enables a remote attacker to extract sensitive information when a victim visits a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), where Chrome's handling of specific HTML constructs produces measurable behavioral differences - such as timing variations or rendering side-channels - that leak protected state. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating low opportunistic risk despite the High confidentiality impact rating in the CVSS vector.
Cross-origin data leakage in Google Chrome's Canvas API (versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to read pixel-level data from cross-origin resources rendered in a canvas element via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - and impact is limited to partial confidentiality loss (C:L), with no integrity or availability consequences. No public exploit code has been identified and EPSS sits at 0.27% (18th percentile), indicating low real-world exploitation probability; vendor-released patch is available.
ServiceWorker in Google Chrome versions prior to 152.0.7977.65 leaks sensitive information to remote attackers via a crafted HTML page, exploiting CWE-200 (Exposure of Sensitive Information to Unauthorized Actor). The vulnerability requires no attacker-side authentication (PR:N per CVSS) but does require user interaction - a victim must visit the malicious page. With CVSS C:H and no integrity or availability impact, the primary threat is data exfiltration; no public exploit has been identified at time of analysis and EPSS sits at a low 0.27%.
Missing authorization in Google Chrome's Network component prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions with high integrity impact by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-reachable exploitation requiring no attacker-side privileges, though a single user interaction gates the attack. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.23% (13th percentile) reflects low observed exploitation probability despite broad product exposure.
Improper privilege management in Google Chrome's FileSystem subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by tricking a user into loading a specially crafted HTML page. The flaw is rated CVSS 4.3 (Medium) with impact limited to low integrity bypass - no confidentiality or availability impact - and carries an EPSS of 0.23% (13th percentile), indicating minimal observed exploitation interest. Vendor patch is available in stable channel 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis.
Web origin policy bypass in Google Chrome's StorageAccessAPI enables an attacker who has already compromised the renderer process to exfiltrate cross-origin storage data via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The vulnerability is rated medium severity (CVSS 4.3) and requires both user interaction and a pre-existing renderer compromise, making it a second-stage chained exploit component rather than a standalone initial access vector. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.
Race condition in Google Chrome's Workers implementation before version 152.0.7977.65 allows a remote attacker to bypass system access restrictions, resulting in high integrity impact. Exploitation requires a victim to visit a crafted HTML page, placing this in the social-engineering-dependent threat category. No public exploit has been identified, and the EPSS score of 0.19% (9th percentile) indicates negligible observed exploitation in the wild at time of analysis.
Observable discrepancy in the Forms component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by serving a crafted HTML page that induces measurable behavioral side-channel differences. The CVSS vector (AC:H/UI:R) confirms exploitation requires both high attack complexity - precise timing or environmental control to reliably observe the discrepancy - and active user interaction to visit the malicious page. No public exploit has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) signals limited automated exploitation interest despite the high confidentiality impact designation.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to exfiltrate sensitive information by luring a user to a crafted HTML page. The flaw (CWE-863) bypasses DOM-level permission checks, resulting in High confidentiality impact with no integrity or availability consequences. No public exploit has been identified at time of analysis, and EPSS at 0.36% (28th percentile) indicates minimal observed exploitation pressure despite the patch now being available from Google.
Incorrect authorization in Google Chrome's Network subsystem (all versions before 152.0.7977.65) permits remote unauthenticated attackers to bypass system access restrictions by inducing a user to visit a crafted HTML page. Classified as CWE-863, the flaw allows a limited integrity violation against the affected system without confidentiality or availability impact. No public exploit has been identified at time of analysis, and the low EPSS score (0.38%, 31st percentile) indicates minimal current exploitation pressure.
Improper input validation in Google Chrome's Safebrowsing component prior to version 152.0.7977.65 allows remote attackers to bypass system access restrictions via a crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is network-reachable without authentication but requires user interaction, constraining opportunistic or automated exploitation at scale. EPSS at 0.22% (12th percentile) and absence from CISA KEV indicate low real-world exploitation probability at time of analysis; no public exploit code has been identified.
Memory read outside Chrome's sandbox via an uninitialized resource in ANGLE affects Google Chrome prior to 152.0.7977.65, enabling an attacker who has already compromised the renderer process to exfiltrate memory beyond sandbox boundaries using a crafted HTML page. This is a chained exploit component - it does not enable initial access but extends an attacker's reach post-renderer-compromise, making it a meaningful escalation primitive in a multi-stage browser exploit chain. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.29% (21st percentile), consistent with its role as a secondary exploit stage.
Web origin policy bypass in Google Chrome's Preload component (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a specially crafted HTML page. Classified as CWE-20 (Improper Input Validation) with a vendor-assigned CVSS score of 4.3 (Medium), the vulnerability is a second-stage attack primitive rather than a standalone exploit - requiring prior renderer compromise as a hard prerequisite. No public exploit code or active exploitation has been confirmed at time of analysis; Google has released a fix in Chrome 152.0.7977.65.
Missing authorization in Google Chrome's BFCache (Back/Forward Cache) component allows a remote attacker who has already compromised the renderer process to bypass system access restrictions via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. The integrity impact is rated High, enabling unauthorized writes or modifications to protected resources beyond the renderer sandbox. EPSS is low at 0.38% (31st percentile), and no active exploitation or public POC has been identified, but the vulnerability is noteworthy as a sandbox-escape primitive in a chained attack.
Out-of-bounds memory read in the GPU component of Google Chrome on Android (prior to 152.0.7977.65) exposes process memory outside the renderer sandbox when a victim visits a crafted HTML page. The flaw targets Android-specific GPU code paths in Chrome's rendering pipeline, producing a high confidentiality impact limited to the GPU process memory space, with no integrity or availability consequence. No public exploit has been identified at time of analysis, and an EPSS probability of 0.24% at the 15th percentile indicates low near-term opportunistic exploitation likelihood.
Chrome's FileSystem API implementation prior to version 152.0.7977.65 contains incorrect authorization logic (CWE-863) that permits a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page via social engineering. The bypass produces a limited integrity impact - unauthorized write or access to filesystem-restricted resources - with no confidentiality or availability consequence per the CVSS vector (I:L, C:N, A:N). No public exploit code exists and the vulnerability is absent from CISA KEV; EPSS of 0.27% (19th percentile) reflects low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Performance API implementation prior to version 152.0.7977.65 enables remote information disclosure via observable timing discrepancies. By serving a crafted HTML page, a remote unauthenticated attacker can exploit CWE-203 side-channel behavior to infer or extract data belonging to other web origins, violating the browser Same-Origin Policy. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.37% (30th percentile), indicating low near-term exploitation probability despite the high confidentiality impact rating in CVSS.
UI misrepresentation in Google Chrome prior to 152.0.7977.65 enables remote attackers to spoof browser interface elements via a crafted HTML page, potentially deceiving users about the identity or security state of a site they are visiting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) confirms network delivery with no attacker authentication required, though user interaction is a hard prerequisite. No public exploit code and no active exploitation have been identified; the EPSS score of 0.22% at the 13th percentile reflects very low near-term exploitation probability.
UI spoofing in Google Chrome on macOS prior to version 152.0.7977.65 enables a remote attacker to misrepresent input UI elements by serving a crafted HTML page, classified under CWE-451 (UI Misrepresentation of Critical Information). Victims who visit the malicious page may be deceived by falsified browser UI elements - such as address bar content, form fields, or security indicators - potentially leading to credential theft or other social engineering outcomes. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.22%; a vendor patch is available at 152.0.7977.65.
Incorrect authorization in Google Chrome Mobile on iOS (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw stems from improper authorization enforcement (CWE-863) within the iOS-specific mobile browser code path, permitting limited integrity violations without confidentiality or availability impact. No public exploit has been identified and EPSS sits at a low 0.23% (13th percentile), consistent with a medium-severity, user-interaction-dependent issue not yet seeing active targeting.
Address bar spoofing in Google Chrome prior to version 152.0.7977.65 enables remote attackers to deceive users about the true origin of a page they are visiting via a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information) in the browser's navigation subsystem. The practical impact is phishing amplification: a victim visiting the attacker's page may see a trusted domain displayed in the address bar and submit credentials or sensitive information to an attacker-controlled site. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS at 0.22% (13th percentile) confirms low automated exploitation probability, though the social-engineering utility of address bar spoofing makes targeted abuse plausible.
Cross-origin data disclosure in Google Chrome's ANGLE graphics layer on Windows allows a remote unauthenticated attacker to read data from other origins by serving a crafted HTML page to a victim user. The flaw is rooted in an uninitialized resource (CWE-908) within ANGLE, Chrome's graphics abstraction layer, affecting all Chrome versions on Windows prior to 152.0.7977.65. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS of 0.29% (21st percentile) corroborates low observed exploitation activity, though the C:H confidentiality rating reflects the severity of cross-origin data leakage if exploited.
Web origin policy bypass in Google Chrome's Loader component (all versions prior to 152.0.7977.65) enables remote unauthenticated attackers to read limited cross-origin data by luring a user to a crafted HTML page. The flaw stems from incorrect authorization (CWE-863) in how the Loader enforces origin boundaries, allowing an attacker-controlled page to extract content from another origin the victim is browsing. EPSS is 0.34% (26th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, placing this in the lower tier of active exploitation risk despite broad product prevalence.
Improper access control in Chrome's Workers subsystem allows a remote unauthenticated attacker to bypass the web origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin data leakage. Affected versions span all Chrome releases prior to 152.0.7977.65 across desktop platforms. No public exploit identified at time of analysis and EPSS probability stands at 0.24% (15th percentile), indicating this is a low-urgency but real boundary-enforcement gap in the browser's sandboxing model.
Incorrect reference resolution in Google Chrome's Passwords feature (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by delivering a crafted file that a user must open. The integrity impact is limited (CVSS I:L), and no confidentiality or availability loss is indicated. With EPSS at 0.36% (29th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low despite the network-accessible attack vector.
Network-layer information disclosure in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive network-layer data by delivering a crafted HTML page to a victim. The CVSS score of 5.3 reflects constrained real-world risk: high confidentiality impact is offset by the requirement for a prior renderer compromise and active user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low anticipated exploitation activity.
Sensitive information disclosure in Google Chrome's Sync component (versions prior to 152.0.7977.65) allows remote unauthenticated attackers to extract synchronized user data via crafted network traffic. The flaw stems from improper input validation (CWE-20) in the Sync subsystem, which handles cross-device synchronization of browser data including passwords, history, and tokens. No public exploit code or CISA KEV listing exists; EPSS of 0.34% (27th percentile) reflects low real-world exploitation probability, though CVSS C:H signals potentially severe data exposure if exploited.
Incorrect authorization in Chrome's Network component allows remote unauthenticated attackers to bypass system access restrictions via a crafted HTML page, resulting in low-integrity impact. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS at 0.23% (13th percentile) reflects low real-world exploitation probability; a vendor patch has been issued in the stable channel.
Information disclosure in Google Chrome's SignIn component (versions prior to 152.0.7977.65) allows remote, unauthenticated attackers to obtain sensitive user information by sending crafted network traffic during the sign-in flow. The CVSS vector assigns High complexity (AC:H), indicating exploitation is not straightforward and requires specific network conditions to be met. No public exploit code has been identified, and EPSS places exploitation probability at just 0.21%, reinforcing that real-world opportunistic exploitation is unlikely at this time.
Missing authorization in the Payments component of Google Chrome on Android (prior to 152.0.7977.65) allows remote attackers to potentially bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw is classified as CWE-862 and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to integrity. No public exploit code has been identified at time of analysis, and EPSS scoring of 0.32% (24th percentile) indicates statistically low exploitation probability at scale.
Origin policy bypass in Google Chrome prior to 152.0.7977.65 exposes users to potential cross-site data leakage when a victim visits an attacker-controlled page. The Network component fails to properly validate input (CWE-20), enabling circumvention of the browser's web origin policy - a fundamental Same-Origin Policy enforcement mechanism - allowing a remote attacker to read data from origins other than the page's own. No public exploit has been identified and EPSS stands at 0.24% (15th percentile), indicating low current exploitation probability, though Chrome's ubiquitous global deployment amplifies the aggregate exposure.
Missing authorization in Google Chrome's HTTP/2 implementation prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers via crafted network traffic. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication is required but high attack complexity, consistent with a need for specific network positioning or traffic crafting. No public exploit code or active exploitation has been identified; EPSS at 0.20% (10th percentile) confirms low current exploitation probability.
Safebrowsing in Google Chrome prior to 152.0.7977.65 fails to properly validate input from crafted files, permitting remote attackers to bypass system access restrictions that the component is designed to enforce. The attack requires user interaction - specifically opening a crafted file - and results in limited integrity impact with no confidentiality or availability compromise. No public exploit code or CISA KEV listing has been identified; EPSS exploitation probability is very low at 0.22% (12th percentile), consistent with the Chromium team's Medium severity classification.
Incorrect authorization in Chrome's WebAppInstalls component on Android (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. The flaw (CWE-863) results in a low-integrity impact with no confidentiality or availability consequence, consistent with CVSS 4.3 Medium. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS of 0.24% (15th percentile) signals low current exploitation interest.
Missing authorization in Google Chrome's Network component, prior to version 152.0.7977.65, allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by serving a crafted HTML page to a user. This is effectively a second-stage sandbox-bypass vulnerability requiring a pre-compromised renderer as a prerequisite, making it a chained exploit component rather than a standalone critical flaw. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.23% (13th percentile), consistent with low near-term exploitation probability. A vendor patch is available in stable channel release 152.0.7977.65.
Web origin policy bypass in Google Chrome's ReadingList component on Windows enables a renderer-compromised attacker to cross origin boundaries via a crafted HTML page. Affected are all Chrome for Windows versions prior to 152.0.7977.65. No public exploit code or active exploitation has been identified; EPSS sits at 0.18% (8th percentile), and Chromium's own security team rates this as Low severity despite the NVD CVSS score of 6.5.
Incorrect reference resolution in the WebView component of Google Chrome on Android (versions prior to 152.0.7977.65) enables a remote attacker to potentially bypass the web origin policy by delivering a crafted HTML page. The flaw carries a Chromium-internal severity of Low, consistent with the limited confidentiality-only impact (C:L/I:N/A:N) reflected in the CVSS 4.3 score. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% (10th percentile) confirms negligible current exploitation probability.
Memory disclosure via uninitialized GPU resource in Google Chrome on Android (prior to 152.0.7977.65) allows a remote attacker to read memory outside the browser sandbox by directing a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) reflects a low-complexity network attack requiring no privileges but dependent on user interaction. No public exploit code has been identified at time of analysis, and the low EPSS score of 0.31% corroborates a currently low exploitation probability despite Chrome's enormous Android deployment footprint.
Memory disclosure in Google Chrome for Android (prior to 152.0.7977.65) exposes sandbox-contained memory via an uninitialized GPU resource, triggered when a victim loads a crafted HTML page. The flaw is platform-specific to Android and carries confidentiality-only impact bounded by Chrome's GPU sandbox isolation - no integrity or availability exposure. No public exploit code is identified at time of analysis, and EPSS at 0.31% (24th percentile) aligns with the vendor's own 'Low' Chromium severity rating, indicating low near-term exploitation probability.
Incorrect authorization in the Controls component of Google Chrome prior to version 152.0.7977.65 enables web origin policy bypass via a crafted HTML page, requiring only that a user visit the attacker-controlled page. The flaw (CWE-863) allows limited cross-origin integrity manipulation with no confidentiality or availability impact, as reflected in the CVSS integrity-only impact score. No public exploit has been identified at time of analysis, EPSS stands at 0.19% (8th percentile), and the Chromium team internally rated severity as Low - all signals consistent with a narrow-impact, user-interaction-dependent authorization gap.
Address bar spoofing in Google Chrome for Android's CustomTabs feature enables remote unauthenticated attackers to misrepresent the displayed URL to users through a crafted HTML page. All Chrome for Android versions prior to 152.0.7977.65 are affected on the Android platform only; desktop Chrome is not impacted. No public exploit identified at time of analysis, and the EPSS score of 0.17% (7th percentile) combined with Chromium's own 'Low' severity rating reflect limited real-world exploitation probability, though the phishing-enablement potential makes it worth patching promptly.
UI spoofing in Google Chrome's Transactions Platform prior to version 152.0.7977.65 enables remote attackers to misrepresent UI elements - such as payment confirmation dialogs or security indicators - through a crafted HTML page, relying on social engineering for delivery. Classified under CWE-451 (UI Misrepresentation of Critical Information), the flaw requires user interaction and carries no confidentiality or availability impact, confining harm to integrity via deception. No active exploitation is confirmed and EPSS probability is very low (0.29%), but the ubiquitous deployment footprint of Chrome means the absolute population of potential targets is large.
Chrome's PermissionElement component can be visually spoofed via a crafted HTML page, allowing a remote attacker to mislead users into granting browser permissions they did not intend to approve. All Chrome desktop versions prior to 152.0.7977.65 are affected, as confirmed by the vendor's Stable Channel advisory and EUVD-2026-66037. No public exploit code has been identified at time of analysis, and EPSS at 0.17% reflects negligible observed exploitation interest.
Skia, the 2D graphics library embedded in Google Chrome prior to 152.0.7977.65, leaks sensitive information when an attacker who has already compromised the renderer process delivers a crafted HTML page to a victim. This CWE-200 flaw functions as a chaining component in a multi-stage exploit rather than a standalone entry point - it amplifies the impact of a prior renderer compromise rather than providing initial access. No public exploit code exists, EPSS is 0.17% (7th percentile), and Chrome's own severity classification is Low, all consistent with the mandatory pre-condition of a pre-compromised renderer.
Race condition in Google Chrome's Transactions Platform on Android (prior to 152.0.7977.65) enables remote attackers to bypass system access restrictions with high integrity impact. Exploitation requires social engineering the victim into visiting a crafted HTML page, and the race window makes reliable triggering difficult (AC:H per CVSS). Chromium's own severity rating is Low; EPSS at 0.18% (7th percentile) confirms minimal real-world exploitation pressure, and no public exploit or KEV listing has been identified.
Missing authorization in the BrowserTag component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by distributing a crafted Chrome extension via social engineering. The flaw bypasses authorization checks within BrowserTag, allowing the malicious extension to access data it should not be permitted to read. No active exploitation has been identified (CISA KEV absent), EPSS sits at 0.23% (13th percentile), and Chromium's own severity classification is 'Low' - all consistent with the UI:R prerequisite of tricking a user into installing a hostile extension.
Out-of-bounds memory read in Google Chrome's FileSystem component (versions prior to 152.0.7977.65) allows a remote unauthenticated attacker to leak memory contents from outside the browser's renderer sandbox by directing a victim to a specially crafted HTML page via social engineering. Exploitation is contingent on user interaction, limiting opportunistic or automated mass exploitation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), though the Confidentiality impact is rated High, meaning successful exploitation could expose sensitive data from browser memory. Vendor-released patch is available in Chrome 152.0.7977.65.
Web origin policy bypass in Google Chrome Extensions affects all desktop versions prior to 152.0.7977.65, exploitable only by an attacker who has already compromised the renderer process. The incorrect authorization flaw (CWE-863) in the Extensions subsystem allows the renderer-level attacker to cross Same-Origin Policy boundaries via a specially crafted HTML page, potentially reading data from origins the renderer should not access. No public exploit code and no CISA KEV listing exist; EPSS is 0.19% (8th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Observable discrepancy in Chrome's Glic component allows remote information disclosure against users running versions prior to 152.0.7977.65. An attacker who persuades a victim to visit a crafted HTML page can exploit a behavioral or timing side-channel in the Glic AI-integration subsystem to extract sensitive information with high confidentiality impact, despite the medium overall CVSS score. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) indicates very low current exploitation probability.
Race condition in Google Chrome's Core component on Windows (all versions prior to 152.0.7977.65) enables a remote attacker to bypass the browser's web origin policy via a crafted HTML page, requiring social engineering to induce user interaction. Exploitation allows partial cross-origin data disclosure (C:L), with no integrity or availability impact. No public exploit code has been identified and no active exploitation is confirmed; EPSS sits at 0.24% (15th percentile), consistent with Chromium's own 'Low' severity rating for this issue.
Improper input validation in Chrome's DeviceBoundSessionCredentials (DBSC) component allows remote attackers to bypass the web origin policy by delivering crafted network traffic, contingent on social engineering the user into triggering the request. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS sits at 0.28% (20th percentile), consistent with the low-to-medium CVSS 4.3 rating and the user-interaction prerequisite.
Race condition in Google Chrome's Editing component prior to version 152.0.7977.65 enables remote attackers who successfully socially engineer a victim to visit a crafted HTML page to extract sensitive information from the browser. The CVSS vector (AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N) shows the attack is network-delivered but requires high complexity timing and explicit user interaction, limiting real-world exploitability. No public exploit identified at time of analysis, and the extremely low EPSS score of 0.14% (4th percentile) corroborates the vendor's own Low Chromium severity designation.
Incorrect authorization in Chrome's WebProtect component (CWE-863) allows a remote attacker to bypass system access restrictions via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms impact is limited to partial integrity loss with no confidentiality or availability consequence, and exploitation is gated on the victim actively navigating to attacker-controlled content. No active exploitation is confirmed - CISA KEV status is absent and EPSS stands at 0.19% (8th percentile), consistent with the Low severity rating assigned by the Chromium security team.
Bluetooth information disclosure in Google Chrome on macOS (versions prior to 152.0.7977.65) enables a remote attacker - who has already compromised the renderer process - to extract sensitive Bluetooth-related information by combining a crafted HTML page with social engineering. This is a chained, multi-prerequisite vulnerability: successful exploitation requires a prior renderer compromise and active victim interaction, which the CVSS AC:H rating reflects. No public exploit code exists and no active exploitation has been observed (SSVC: Exploitation none; EPSS 0.29%), placing real-world risk substantially below what the C:H confidentiality impact alone might suggest. A vendor patch is available in Chrome 152.0.7977.65.
Missing authorization in Chrome's Preload subsystem (CWE-862) allows an attacker who has already compromised the renderer process to bypass the web origin policy via a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. The bypass results in limited cross-origin data disclosure (confidentiality impact only). No public exploit code has been identified and the CVE is absent from the CISA KEV catalog; EPSS stands at 0.22% (13th percentile), consistent with low real-world exploitation activity.
Sensitive information exposure in Google Chrome for Android (versions prior to 152.0.7977.65) via the Android Intents mechanism allows a remote attacker to leak confidential browser or device data by delivering a crafted HTML page to the victim. The vulnerability requires user interaction - the target must visit the malicious page - limiting opportunistic mass exploitation despite the network-accessible attack vector. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.17%, consistent with Chromium's own 'Low' severity classification, though the CVSS C:H rating reflects a meaningful confidentiality impact if triggered.
Chrome's Sharing feature on Android leaks sensitive information to local attackers in all versions prior to 152.0.7977.65, exploitable only when a malicious co-installed app is present on the target device combined with social engineering. Despite a High confidentiality impact in the CVSS vector, the overall score of 5.1 reflects severe practical constraints: local access, high complexity, and a social engineering dependency. No public exploit code has been identified, EPSS probability is 0.15% (4th percentile), and Chromium's own severity rating is Low - signals that align to suggest low near-term operational risk.
UI misrepresentation in Google Chrome's Linux Toolkit Theming component enables remote attackers to bypass system access restrictions through a crafted HTML page, relying on social engineering to complete the attack. All Chrome versions prior to 152.0.7977.65 on Linux are affected; Google shipped the fix in stable channel release 152.0.7977.65. No active exploitation has been confirmed (absent from CISA KEV), and an EPSS of 0.30% at the 23rd percentile reflects low automated exploitation probability.
Incorrect authorization in Google Chrome's browser component prior to version 152.0.7977.65 allows web origin policy bypass via a crafted HTML page. Remote unauthenticated attackers can exploit this flaw by inducing a user to visit a malicious page, resulting in limited cross-origin data reads - a breach of the same-origin policy, which is a foundational browser security boundary. No public exploit identified at time of analysis and not listed in CISA KEV; EPSS of 0.19% (8th percentile) confirms low exploitation probability in the current threat landscape.
System access restriction bypass in Google Chrome's Workers subsystem affects all versions prior to 152.0.7977.65, functioning as the second link in an exploit chain where an attacker must first compromise the renderer process. Improper input validation in Workers then allows a crafted HTML page to circumvent Chrome's sandbox-enforced access controls, yielding limited confidentiality and integrity impact on the host. EPSS is 0.22% (12th percentile) with no confirmed active exploitation via CISA KEV, placing this squarely in the category of a chained, low-probability threat rather than a mass-exploitation vector.
DOM information leak in Google Chrome before version 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy by luring a victim to a crafted HTML page, potentially exposing cross-origin data to the attacker. The CVSS 4.3 Medium score reflects network-exploitable, unauthenticated delivery limited to confidentiality impact with no integrity or availability consequences. No public exploit code has been identified at time of analysis, and an EPSS probability of 0.22% (12th percentile) indicates low near-term exploitation likelihood despite the broad affected product footprint.
Cross-origin data exposure in Google Chrome's Extensions subsystem prior to version 152.0.7977.65 allows a remote attacker who successfully socially engineers a victim into installing a crafted malicious extension to read data from web origins the extension should not have access to. The high confidentiality impact (C:H) is real, but exploitation is gated on user interaction - the victim must install the malicious extension - which substantially limits opportunistic mass exploitation. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.27% (18th percentile) reflects low current exploitation probability consistent with no observed in-the-wild use.
Information disclosure in Google Chrome's Geolocation component prior to version 152.0.7977.65 allows a remote attacker to obtain the victim's sensitive geolocation data by tricking them into visiting a crafted HTML page. The attack relies on social engineering as the delivery mechanism and results in a high-confidentiality-impact leak of physical location information, which may expose home or workplace addresses. No public exploit code or active exploitation has been identified; EPSS at 0.21% (11th percentile) confirms low automated exploitation probability at time of analysis.
Memory disclosure in Google Chrome's Dawn WebGPU component exposes uninitialized memory contents to remote attackers who can lure a user to a crafted HTML page. Affected are all Chrome versions prior to 152.0.7977.65 on desktop platforms, per the EUVD and Chrome release advisory. No public exploit code has been identified and EPSS sits at 0.19% (9th percentile), indicating low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Cross-origin data leakage via an uninitialized resource in the WebXR API affects Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker who can socially engineer a user into visiting a crafted HTML page may trigger a read of uninitialized memory, potentially exposing data from other browser origins. Google has rated this Medium severity; a patched release (152.0.7977.65) is available, and no public exploit or active exploitation has been identified at time of analysis.
Cross-origin data exposure via a ServiceWorker flaw in Google Chrome prior to 152.0.7977.65 permits remote attackers to read data from origins they do not control. An attacker can exploit this by delivering a crafted HTML page to a victim user, leveraging Chrome's ServiceWorker API to bypass same-origin isolation and exfiltrate cross-origin responses. No public exploit code is identified at time of analysis, and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation activity; the mandatory user-interaction requirement further constrains automated abuse.
Incorrect USB authorization in Google Chrome prior to 152.0.7977.65 allows a remote attacker to bypass system USB access restrictions by socially engineering a user into visiting a crafted HTML page. The flaw (CWE-863) in Chrome's USB subsystem grants unauthorized access without proper permission verification, resulting in a limited integrity impact with no confidentiality or availability consequences. No public exploit code exists and EPSS is very low at 0.21% (11th percentile), consistent with Chromium's own Medium severity rating; a vendor patch has been released.
Incorrect authorization in Google Chrome's WebXR implementation prior to version 152.0.7977.65 enables cross-origin data exfiltration via a crafted HTML page, requiring attacker-driven social engineering to direct a victim to the malicious page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) scores 6.5, reflecting high confidentiality impact but no integrity or availability loss, and user interaction is a necessary prerequisite. No public exploit code exists and the vulnerability is absent from the CISA KEV catalog at time of analysis, with EPSS at 0.21% (11th percentile) confirming low observed exploitation activity.
Incomplete cleanup in Chrome's GetUserMedia API exposes sensitive information to remote attackers who have already compromised the renderer process. Affected versions are all Chrome releases prior to 152.0.7977.65 on desktop platforms. An attacker with an established renderer foothold and the ability to socially engineer a user into visiting a crafted HTML page can exploit this residual-data flaw to extract sensitive media or stream-related information - an information-disclosure step that may support privilege escalation or lateral movement within a broader attack chain. No public exploit code has been identified and EPSS sits at 0.23%, reflecting the high prerequisite bar.
Code injection in Google Chrome's Bisection component allows remote attackers to exfiltrate sensitive information by enticing a user to open a crafted file. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The vulnerability carries a CVSS 6.5 Medium rating with high confidentiality impact; no public exploit has been identified and EPSS sits at 0.19% (8th percentile), indicating minimal active exploitation pressure at time of analysis. Vendor patch is confirmed available.
Network-layer information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive data by directing a victim to a crafted HTML page. The attack is a multi-stage chain: the renderer compromise is a hard prerequisite not satisfied by this CVE alone, which materially constrains real-world exploitability. No public exploit code has been identified and the EPSS score of 0.21% (11th percentile) corroborates low observed exploitation probability; no CISA KEV listing exists.
Incorrect authorization in the Device component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions - specifically controls governing device-level API access - through a crafted HTML page delivered via social engineering. Exploitation requires user interaction, limiting opportunistic mass exploitation, and EPSS at 0.29% (21st percentile) reflects low real-world exploitation probability. No public exploit identified and no CISA KEV listing; a vendor patch is available.
Incorrect authorization in Chrome's GetUserMedia API allows remote attackers to obtain sensitive information - specifically unauthorized access to a user's camera or microphone feed - by luring the victim to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop are affected. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the High confidentiality impact warrants timely patching given Chrome's ubiquitous deployment.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) grants a remote attacker who has already compromised the renderer process the ability to circumvent Same-Origin Policy restrictions via a crafted HTML page, leaking limited confidential data from cross-origin contexts. This is a second-stage exploitation primitive - it is only dangerous when chained with a separate renderer compromise vulnerability. No public exploit identified at time of analysis, and the low EPSS score of 0.26% (18th percentile) reflects minimal current exploitation interest.
Uninitialized resource use in Chrome's ANGLE graphics abstraction layer (versions prior to 152.0.7977.65) enables remote attackers to potentially bypass the web origin policy via a crafted HTML page, resulting in limited cross-origin information disclosure. Exploitation requires user interaction - a victim must visit the attacker-controlled page - which constrains real-world impact despite the network-accessible attack vector. No public exploit code and no CISA KEV listing are present; EPSS places exploitation probability at 0.24% (15th percentile), consistent with a low-priority but broadly applicable patch.
Improper resource exposure in Google Chrome's StreamsAPI (versions prior to 152.0.7977.65) enables remote attackers to partially bypass the web origin policy and read limited data from privileged browser pages via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - consistent with CVSS UI:R and S:U, confining impact to the victim's own browser context. No active exploitation is confirmed (not in CISA KEV), and an EPSS score of 0.18% (8th percentile) indicates very low real-world exploitation probability at time of analysis.
DevTools Missing Authorization in Google Chrome prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers who socially engineer victims into performing specific UI interactions. The CWE-862 root cause indicates the DevTools component lacks proper authorization checks on certain UI-driven data access paths, allowing an attacker-controlled page to extract information the browser context holds. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.15% at the 5th percentile confirms minimal near-term exploitation probability despite the C:H CVSS impact rating.
Incorrect authorization in Google Chrome's Web Authentication subsystem (Passkeys and Security Keys) allows a remote attacker to bypass the web origin policy by inducing a user to visit a crafted HTML page. All Chrome versions prior to 152.0.7977.65 on desktop platforms are affected. The impact is limited to partial confidentiality - origin policy bypass could expose authentication context or credential associations across origins - with no integrity or availability impact confirmed.
CSS injection in Google Chrome prior to version 152.0.7977.65 enables a remote attacker to extract sensitive information from a victim's browser session by delivering a crafted HTML page. The CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N vector confirms unauthenticated network delivery requiring only that the victim navigate to attacker-controlled content, with high confidentiality impact and no integrity or availability consequences. No public exploit has been identified at time of analysis, and the EPSS score of 0.20% at the 10th percentile indicates very low observed exploitation probability; this is not listed in the CISA KEV catalog.
Chrome's FileSystem API prior to version 152.0.7977.65 improperly handles case sensitivity when enforcing access restrictions, enabling a remote attacker to bypass system-level file access controls via a crafted HTML page delivered through social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms a network-reachable, unauthenticated path with high integrity impact, though the mandatory user interaction requirement limits mass exploitation. No public exploit has been identified at time of analysis, and an EPSS of 0.33% at the 26th percentile reflects limited observed exploitation activity.
Incorrect authorization in Google Chrome's Network component prior to version 152.0.7977.65 allows a remote, unauthenticated attacker to bypass the browser's web origin policy by delivering a crafted HTML page to a victim. The bypass yields limited confidentiality exposure, consistent with the CVSS C:L rating, and requires the target user to interact with attacker-controlled content. No public exploit code has been identified and EPSS stands at 0.19% (8th percentile), indicating low current exploitation probability despite the broad deployment footprint of Chrome.
Web origin policy bypass in Google Chrome's cache component affects all versions prior to 152.0.7977.65, exploitable by a remote unauthenticated attacker who tricks a user into visiting a crafted HTML page. The incorrect reference resolution (CWE-706) in the cache layer allows cross-origin data to be read, constituting a Same-Origin Policy bypass with limited confidentiality impact. No active exploitation is confirmed and EPSS sits at 0.20% (10th percentile), indicating low real-world exploitation pressure at this time.
UI misrepresentation in Google Chrome's Geometry rendering component allows remote attackers to spoof browser interface elements by delivering a crafted HTML page to an unaware user. Versions prior to 152.0.7977.65 are affected across all desktop platforms where Chrome is installed. With CVSS 5.4, a low EPSS of 0.17% (7th percentile), and no CISA KEV listing, this is a moderate-severity phishing and social-engineering amplifier rather than a code-execution vector - but Chrome's near-ubiquitous deployment means the aggregate exposure is broad.
CSS information leak in Google Chrome before 152.0.7977.65 enables remote attackers to exfiltrate sensitive browser data by luring victims to a crafted HTML page. The flaw resides in Chrome's CSS rendering subsystem (CWE-200: Information Exposure) and carries a CVSS C:H rating, meaning confidentiality impact is assessed as high despite the medium-severity label. No public exploit code has been identified and EPSS probability sits at 0.17% (7th percentile), indicating very low observed exploitation activity; the vulnerability is not listed in the CISA KEV catalog.
Incorrect authorization in Chrome's ServiceWorker component (CWE-863) allows remote unauthenticated attackers who can socially engineer a user into installing a crafted Chrome extension to bypass the web origin policy, resulting in limited cross-origin data exposure. All Chrome releases prior to 152.0.7977.65 are affected across platforms; a vendor patch is available. No public exploit code has been identified and the EPSS score of 0.17% (7th percentile) indicates very low current exploitation probability, consistent with the absence of a CISA KEV listing.
Cross-origin data leakage through the CustomTabs component in Google Chrome for Android (versions prior to 152.0.7977.65) enables a local attacker to extract sensitive browsing data belonging to other origins via a co-installed application. The flaw is classified CWE-200 and carries a CVSS Medium score of 5.5, reflecting meaningful confidentiality impact constrained by a local-only attack vector and required user interaction. No public exploit code or active exploitation via CISA KEV has been identified; the vendor-released patch is available in Chrome 152.0.7977.65.
Incorrect authorization in Chrome's Editing component (prior to 152.0.7977.65) permits remote attackers to read sensitive information by enticing a user to visit a specially crafted HTML page. The flaw (CWE-863) affects all Chrome versions across all platforms below the fixed release, with a high confidentiality impact but no integrity or availability consequence. No public exploit code or active exploitation is confirmed; EPSS stands at 0.36% (28th percentile), indicating low real-world exploitation probability at time of analysis.
Information leak in the Animation component of Google Chrome prior to 152.0.7977.65 allows remote unauthenticated attackers to obtain sensitive browser data by inducing a user to visit a crafted HTML page. The flaw is classified CWE-200 (Exposure of Sensitive Information) and carries a CVSS confidentiality impact of High, though Chromium's internal team rated it Medium severity. No public exploit or CISA KEV listing exists at time of analysis, and EPSS of 0.22% (13th percentile) confirms very low observed exploitation probability, making this a normal patch-cycle priority rather than an emergency.
CustomTabs UI spoofing in Google Chrome for Android (prior to 152.0.7977.65) allows a remote attacker using social engineering to misrepresent browser UI elements through a crafted HTML page, enabling phishing-grade deception of users who believe they are interacting with a trusted interface. The flaw is classified under CWE-451 (UI Misrepresentation of Critical Information) and is limited to the Android platform's CustomTabs feature. No active exploitation is confirmed via CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating negligible current exploitation activity.
Observable discrepancy in HTML rendering in Google Chrome prior to 152.0.7977.65 enables a remote attacker to extract sensitive information when a victim visits a crafted HTML page. The root cause is CWE-203 (Observable Discrepancy), where Chrome's handling of specific HTML constructs produces measurable behavioral differences - such as timing variations or rendering side-channels - that leak protected state. No active exploitation is confirmed in CISA KEV, and EPSS sits at 0.22% (13th percentile), indicating low opportunistic risk despite the High confidentiality impact rating in the CVSS vector.
Cross-origin data leakage in Google Chrome's Canvas API (versions prior to 152.0.7977.65) allows a remote, unauthenticated attacker to read pixel-level data from cross-origin resources rendered in a canvas element via a crafted HTML page. Exploitation requires user interaction - the victim must visit an attacker-controlled page - and impact is limited to partial confidentiality loss (C:L), with no integrity or availability consequences. No public exploit code has been identified and EPSS sits at 0.27% (18th percentile), indicating low real-world exploitation probability; vendor-released patch is available.
ServiceWorker in Google Chrome versions prior to 152.0.7977.65 leaks sensitive information to remote attackers via a crafted HTML page, exploiting CWE-200 (Exposure of Sensitive Information to Unauthorized Actor). The vulnerability requires no attacker-side authentication (PR:N per CVSS) but does require user interaction - a victim must visit the malicious page. With CVSS C:H and no integrity or availability impact, the primary threat is data exfiltration; no public exploit has been identified at time of analysis and EPSS sits at a low 0.27%.
Missing authorization in Google Chrome's Network component prior to version 152.0.7977.65 enables remote attackers to bypass system access restrictions with high integrity impact by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network-reachable exploitation requiring no attacker-side privileges, though a single user interaction gates the attack. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.23% (13th percentile) reflects low observed exploitation probability despite broad product exposure.
Improper privilege management in Google Chrome's FileSystem subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by tricking a user into loading a specially crafted HTML page. The flaw is rated CVSS 4.3 (Medium) with impact limited to low integrity bypass - no confidentiality or availability impact - and carries an EPSS of 0.23% (13th percentile), indicating minimal observed exploitation interest. Vendor patch is available in stable channel 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis.
Web origin policy bypass in Google Chrome's StorageAccessAPI enables an attacker who has already compromised the renderer process to exfiltrate cross-origin storage data via a crafted HTML page, affecting all Chrome versions prior to 152.0.7977.65. The vulnerability is rated medium severity (CVSS 4.3) and requires both user interaction and a pre-existing renderer compromise, making it a second-stage chained exploit component rather than a standalone initial access vector. No public exploit code has been identified and no active exploitation is confirmed at time of analysis.
UI misrepresentation in Chrome's WebAppInstalls component allows remote attackers to spoof browser UI elements by serving a crafted HTML page to a user who visits it. All Chrome releases prior to 152.0.7977.65 are affected across desktop platforms. Exploitation requires user interaction (visiting a malicious page) but no authentication, and could be used to deceive users into believing they are interacting with a trusted installation prompt - for example, tricking a user into approving a Progressive Web App install from an attacker-controlled origin. No public exploit code has been identified and EPSS is low (0.22%, 13th percentile), placing this firmly in the 'patch on schedule' tier rather than emergency response.
Race condition in Google Chrome's Workers implementation before version 152.0.7977.65 allows a remote attacker to bypass system access restrictions, resulting in high integrity impact. Exploitation requires a victim to visit a crafted HTML page, placing this in the social-engineering-dependent threat category. No public exploit has been identified, and the EPSS score of 0.19% (9th percentile) indicates negligible observed exploitation in the wild at time of analysis.
Observable discrepancy in the Forms component of Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive information by serving a crafted HTML page that induces measurable behavioral side-channel differences. The CVSS vector (AC:H/UI:R) confirms exploitation requires both high attack complexity - precise timing or environmental control to reliably observe the discrepancy - and active user interaction to visit the malicious page. No public exploit has been identified at time of analysis, and an EPSS of 0.22% (13th percentile) signals limited automated exploitation interest despite the high confidentiality impact designation.
Incorrect DOM authorization in Google Chrome prior to 152.0.7977.65 enables remote unauthenticated attackers to exfiltrate sensitive information by luring a user to a crafted HTML page. The flaw (CWE-863) bypasses DOM-level permission checks, resulting in High confidentiality impact with no integrity or availability consequences. No public exploit has been identified at time of analysis, and EPSS at 0.36% (28th percentile) indicates minimal observed exploitation pressure despite the patch now being available from Google.
Incorrect authorization in Google Chrome's Network subsystem (all versions before 152.0.7977.65) permits remote unauthenticated attackers to bypass system access restrictions by inducing a user to visit a crafted HTML page. Classified as CWE-863, the flaw allows a limited integrity violation against the affected system without confidentiality or availability impact. No public exploit has been identified at time of analysis, and the low EPSS score (0.38%, 31st percentile) indicates minimal current exploitation pressure.
Improper input validation in Google Chrome's Safebrowsing component prior to version 152.0.7977.65 allows remote attackers to bypass system access restrictions via a crafted file. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms the attack is network-reachable without authentication but requires user interaction, constraining opportunistic or automated exploitation at scale. EPSS at 0.22% (12th percentile) and absence from CISA KEV indicate low real-world exploitation probability at time of analysis; no public exploit code has been identified.
Memory read outside Chrome's sandbox via an uninitialized resource in ANGLE affects Google Chrome prior to 152.0.7977.65, enabling an attacker who has already compromised the renderer process to exfiltrate memory beyond sandbox boundaries using a crafted HTML page. This is a chained exploit component - it does not enable initial access but extends an attacker's reach post-renderer-compromise, making it a meaningful escalation primitive in a multi-stage browser exploit chain. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS is low at 0.29% (21st percentile), consistent with its role as a secondary exploit stage.
Web origin policy bypass in Google Chrome's Preload component (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a specially crafted HTML page. Classified as CWE-20 (Improper Input Validation) with a vendor-assigned CVSS score of 4.3 (Medium), the vulnerability is a second-stage attack primitive rather than a standalone exploit - requiring prior renderer compromise as a hard prerequisite. No public exploit code or active exploitation has been confirmed at time of analysis; Google has released a fix in Chrome 152.0.7977.65.
Missing authorization in Google Chrome's BFCache (Back/Forward Cache) component allows a remote attacker who has already compromised the renderer process to bypass system access restrictions via a crafted HTML page. Affected versions are all Chrome releases prior to 152.0.7977.65. The integrity impact is rated High, enabling unauthorized writes or modifications to protected resources beyond the renderer sandbox. EPSS is low at 0.38% (31st percentile), and no active exploitation or public POC has been identified, but the vulnerability is noteworthy as a sandbox-escape primitive in a chained attack.
Out-of-bounds memory read in the GPU component of Google Chrome on Android (prior to 152.0.7977.65) exposes process memory outside the renderer sandbox when a victim visits a crafted HTML page. The flaw targets Android-specific GPU code paths in Chrome's rendering pipeline, producing a high confidentiality impact limited to the GPU process memory space, with no integrity or availability consequence. No public exploit has been identified at time of analysis, and an EPSS probability of 0.24% at the 15th percentile indicates low near-term opportunistic exploitation likelihood.
Chrome's FileSystem API implementation prior to version 152.0.7977.65 contains incorrect authorization logic (CWE-863) that permits a remote attacker to bypass system access restrictions by directing a user to a crafted HTML page via social engineering. The bypass produces a limited integrity impact - unauthorized write or access to filesystem-restricted resources - with no confidentiality or availability consequence per the CVSS vector (I:L, C:N, A:N). No public exploit code exists and the vulnerability is absent from CISA KEV; EPSS of 0.27% (19th percentile) reflects low near-term exploitation probability.
Cross-origin data leakage in Google Chrome's Performance API implementation prior to version 152.0.7977.65 enables remote information disclosure via observable timing discrepancies. By serving a crafted HTML page, a remote unauthenticated attacker can exploit CWE-203 side-channel behavior to infer or extract data belonging to other web origins, violating the browser Same-Origin Policy. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.37% (30th percentile), indicating low near-term exploitation probability despite the high confidentiality impact rating in CVSS.
UI misrepresentation in Google Chrome prior to 152.0.7977.65 enables remote attackers to spoof browser interface elements via a crafted HTML page, potentially deceiving users about the identity or security state of a site they are visiting. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L) confirms network delivery with no attacker authentication required, though user interaction is a hard prerequisite. No public exploit code and no active exploitation have been identified; the EPSS score of 0.22% at the 13th percentile reflects very low near-term exploitation probability.
UI spoofing in Google Chrome on macOS prior to version 152.0.7977.65 enables a remote attacker to misrepresent input UI elements by serving a crafted HTML page, classified under CWE-451 (UI Misrepresentation of Critical Information). Victims who visit the malicious page may be deceived by falsified browser UI elements - such as address bar content, form fields, or security indicators - potentially leading to credential theft or other social engineering outcomes. No active exploitation is confirmed (not in CISA KEV), and EPSS is very low at 0.22%; a vendor patch is available at 152.0.7977.65.
Incorrect authorization in Google Chrome Mobile on iOS (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw stems from improper authorization enforcement (CWE-863) within the iOS-specific mobile browser code path, permitting limited integrity violations without confidentiality or availability impact. No public exploit has been identified and EPSS sits at a low 0.23% (13th percentile), consistent with a medium-severity, user-interaction-dependent issue not yet seeing active targeting.
Address bar spoofing in Google Chrome prior to version 152.0.7977.65 enables remote attackers to deceive users about the true origin of a page they are visiting via a crafted HTML page, exploiting CWE-451 (UI Misrepresentation of Critical Information) in the browser's navigation subsystem. The practical impact is phishing amplification: a victim visiting the attacker's page may see a trusted domain displayed in the address bar and submit credentials or sensitive information to an attacker-controlled site. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS at 0.22% (13th percentile) confirms low automated exploitation probability, though the social-engineering utility of address bar spoofing makes targeted abuse plausible.
Cross-origin data disclosure in Google Chrome's ANGLE graphics layer on Windows allows a remote unauthenticated attacker to read data from other origins by serving a crafted HTML page to a victim user. The flaw is rooted in an uninitialized resource (CWE-908) within ANGLE, Chrome's graphics abstraction layer, affecting all Chrome versions on Windows prior to 152.0.7977.65. No public exploit code has been identified and the vulnerability is absent from CISA KEV; EPSS of 0.29% (21st percentile) corroborates low observed exploitation activity, though the C:H confidentiality rating reflects the severity of cross-origin data leakage if exploited.
Web origin policy bypass in Google Chrome's Loader component (all versions prior to 152.0.7977.65) enables remote unauthenticated attackers to read limited cross-origin data by luring a user to a crafted HTML page. The flaw stems from incorrect authorization (CWE-863) in how the Loader enforces origin boundaries, allowing an attacker-controlled page to extract content from another origin the victim is browsing. EPSS is 0.34% (26th percentile), no CISA KEV listing exists, and no public exploit code has been identified at time of analysis, placing this in the lower tier of active exploitation risk despite broad product prevalence.
Improper access control in Chrome's Workers subsystem allows a remote unauthenticated attacker to bypass the web origin policy by luring a user to a crafted HTML page, resulting in limited cross-origin data leakage. Affected versions span all Chrome releases prior to 152.0.7977.65 across desktop platforms. No public exploit identified at time of analysis and EPSS probability stands at 0.24% (15th percentile), indicating this is a low-urgency but real boundary-enforcement gap in the browser's sandboxing model.
Incorrect reference resolution in Google Chrome's Passwords feature (versions prior to 152.0.7977.65) allows a remote attacker to bypass system access restrictions by delivering a crafted file that a user must open. The integrity impact is limited (CVSS I:L), and no confidentiality or availability loss is indicated. With EPSS at 0.36% (29th percentile), no KEV listing, and no public exploit identified at time of analysis, real-world exploitation risk is currently low despite the network-accessible attack vector.
Network-layer information disclosure in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to exfiltrate sensitive network-layer data by delivering a crafted HTML page to a victim. The CVSS score of 5.3 reflects constrained real-world risk: high confidentiality impact is offset by the requirement for a prior renderer compromise and active user interaction. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates low anticipated exploitation activity.
Sensitive information disclosure in Google Chrome's Sync component (versions prior to 152.0.7977.65) allows remote unauthenticated attackers to extract synchronized user data via crafted network traffic. The flaw stems from improper input validation (CWE-20) in the Sync subsystem, which handles cross-device synchronization of browser data including passwords, history, and tokens. No public exploit code or CISA KEV listing exists; EPSS of 0.34% (27th percentile) reflects low real-world exploitation probability, though CVSS C:H signals potentially severe data exposure if exploited.
Incorrect authorization in Chrome's Network component allows remote unauthenticated attackers to bypass system access restrictions via a crafted HTML page, resulting in low-integrity impact. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code has been identified and EPSS at 0.23% (13th percentile) reflects low real-world exploitation probability; a vendor patch has been issued in the stable channel.
Information disclosure in Google Chrome's SignIn component (versions prior to 152.0.7977.65) allows remote, unauthenticated attackers to obtain sensitive user information by sending crafted network traffic during the sign-in flow. The CVSS vector assigns High complexity (AC:H), indicating exploitation is not straightforward and requires specific network conditions to be met. No public exploit code has been identified, and EPSS places exploitation probability at just 0.21%, reinforcing that real-world opportunistic exploitation is unlikely at this time.
Missing authorization in the Payments component of Google Chrome on Android (prior to 152.0.7977.65) allows remote attackers to potentially bypass system access restrictions by inducing a user to visit a crafted HTML page. The flaw is classified as CWE-862 and carries a CVSS 3.1 score of 4.3 (Medium), with impact limited to integrity. No public exploit code has been identified at time of analysis, and EPSS scoring of 0.32% (24th percentile) indicates statistically low exploitation probability at scale.
Origin policy bypass in Google Chrome prior to 152.0.7977.65 exposes users to potential cross-site data leakage when a victim visits an attacker-controlled page. The Network component fails to properly validate input (CWE-20), enabling circumvention of the browser's web origin policy - a fundamental Same-Origin Policy enforcement mechanism - allowing a remote attacker to read data from origins other than the page's own. No public exploit has been identified and EPSS stands at 0.24% (15th percentile), indicating low current exploitation probability, though Chrome's ubiquitous global deployment amplifies the aggregate exposure.
Missing authorization in Google Chrome's HTTP/2 implementation prior to version 152.0.7977.65 exposes sensitive browser information to remote attackers via crafted network traffic. The CVSS vector (AV:N/AC:H/PR:N/UI:N) indicates no authentication is required but high attack complexity, consistent with a need for specific network positioning or traffic crafting. No public exploit code or active exploitation has been identified; EPSS at 0.20% (10th percentile) confirms low current exploitation probability.
Safebrowsing in Google Chrome prior to 152.0.7977.65 fails to properly validate input from crafted files, permitting remote attackers to bypass system access restrictions that the component is designed to enforce. The attack requires user interaction - specifically opening a crafted file - and results in limited integrity impact with no confidentiality or availability compromise. No public exploit code or CISA KEV listing has been identified; EPSS exploitation probability is very low at 0.22% (12th percentile), consistent with the Chromium team's Medium severity classification.
Incorrect authorization in Chrome's WebAppInstalls component on Android (versions prior to 152.0.7977.65) enables a remote attacker to bypass system access restrictions by luring a user to a crafted HTML page. The flaw (CWE-863) results in a low-integrity impact with no confidentiality or availability consequence, consistent with CVSS 4.3 Medium. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS of 0.24% (15th percentile) signals low current exploitation interest.
Missing authorization in Google Chrome's Network component, prior to version 152.0.7977.65, allows a remote attacker who has already compromised the renderer process to bypass system access restrictions by serving a crafted HTML page to a user. This is effectively a second-stage sandbox-bypass vulnerability requiring a pre-compromised renderer as a prerequisite, making it a chained exploit component rather than a standalone critical flaw. No public exploit code and no CISA KEV listing have been identified; EPSS is 0.23% (13th percentile), consistent with low near-term exploitation probability. A vendor patch is available in stable channel release 152.0.7977.65.