Suse
Monthly
Memory disclosure in Google Chrome's ANGLE graphics subsystem (prior to 152.0.7977.65) exposes out-of-sandbox memory contents when a user visits a crafted HTML page. The uninitialized resource flaw (CWE-908) in ANGLE - Chrome's cross-platform graphics abstraction layer - allows a remote attacker to read memory that should be isolated within the renderer sandbox, leading to high-confidence confidentiality impact. No public exploit has been identified at time of analysis, and EPSS at 0.29% reflects currently low exploitation probability despite the high CVSS confidentiality rating.
Cross-origin data disclosure in Google Chrome's ANGLE graphics translation layer affects all desktop versions prior to 152.0.7977.65. The uninitialized GPU resource (CWE-908) can be triggered by a crafted HTML page, allowing a remote attacker to read residual data across origin boundaries - a direct violation of browser isolation guarantees. No public exploit code or active exploitation is identified at the time of analysis; the 0.24% EPSS score (15th percentile) places real-world exploitation probability in low-priority territory despite the High confidentiality sub-score in the CVSS rating.
Incorrect authorization in the TabGroups feature of Google Chrome prior to 152.0.7977.65 allows a remote attacker to leak sensitive browser information by serving crafted network traffic to a victim user. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser fails to properly enforce access control within tab group contexts, and was rated Medium severity by the Chromium security team. No public exploit identified at time of analysis, and an EPSS of 0.20% at the 10th percentile confirms very low observed exploitation activity.
Chrome's Network subsystem before version 152.0.7977.65 allows remote attackers to bypass the browser's web origin policy due to improper initialization (CWE-665), exploitable via a crafted HTML page that requires user interaction. The impact is limited to partial confidentiality disclosure (C:L), with no integrity or availability consequences, and the CVSS score of 4.3 (Medium) aligns with EPSS exploitation probability of 0.36% (29th percentile). No public exploit code or CISA KEV listing exists at the time of analysis; a vendor patch is available in the stable channel.
Incorrect authorization in Google Chrome's WebProtect component before version 152.0.7977.65 allows a remote, unauthenticated attacker to exfiltrate sensitive information by directing a user to a specially crafted HTML page. The flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H) and no integrity or availability impact, scoped entirely within the browser process. No public exploit is identified at time of analysis, and the EPSS score of 0.27% (19th percentile) indicates low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Missing authorization in Chrome's CustomTabs feature on Android exposes sensitive browser information to co-installed malicious applications on versions prior to 152.0.7977.65. The vulnerability stems from CWE-862 (Missing Authorization), meaning Chrome does not properly verify whether a companion app is permitted to access data surfaced through the CustomTabs interface. No public exploit code or active exploitation has been identified; EPSS sits at the 6th percentile, confirming low real-world exploitation probability despite the High confidentiality impact in the CVSS vector.
Incorrect reference resolution in Chrome's Preload subsystem (versions prior to 152.0.7977.65) allows remote attackers to bypass the Same-Origin Policy by serving a crafted HTML page to a victim. The vulnerability is limited to confidentiality impact at the low tier - an attacker can read a constrained subset of cross-origin data but cannot modify content or cause a denial of service. No public exploit code has been identified and the EPSS score of 0.31% (23rd percentile) reflects low real-world exploitation probability at time of analysis.
Incorrect authorization in Google Chrome's Extensions subsystem (versions prior to 152.0.7977.65) permits a remote attacker to bypass system access restrictions through a crafted Chrome extension delivered via social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms mandatory user interaction limits opportunistic exploitation, and impact is constrained to integrity with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the social-engineering dependency.
Memory disclosure in Google Chrome's Video component (versions prior to 152.0.7977.65) allows a remote attacker to read memory contents from within the Chrome sandbox by directing a victim to a specially crafted HTML page. The uninitialized resource flaw (CWE-908) means the Video subsystem may expose stale memory - potentially including session tokens, credentials, or other sensitive browser data - without requiring any authentication from the attacker. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.34% (26th percentile) confirms low automated exploitation probability.
Injection in Google Chrome's Tabs component (versions prior to 152.0.7977.65) enables remote attackers to partially bypass system access restrictions by directing a user to a specially crafted HTML page. The flaw is classified CWE-74 (Injection) and carries only a low integrity impact (I:L) with no confidentiality or availability consequences, consistent with Chromium's own 'Medium' severity rating. No public exploit code has been identified and EPSS probability is low at 0.38% (31st percentile), indicating limited real-world exploitation pressure despite the browser's ubiquitous deployment footprint.
Incorrect authorization in Chrome's WebProtect component exposes sensitive browser information to remote attackers via crafted HTML pages, affecting all Chrome versions prior to 152.0.7977.65. The flaw carries a CVSS 6.5 score with high confidentiality impact; an unauthenticated attacker requires only that a target user visit a malicious page, making social-engineering delivery viable. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS of 0.32% (24th percentile) indicates low current exploitation activity despite the broad attack surface.
ServiceWorker incorrect authorization in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web origin policy by inducing a victim to visit a crafted HTML page. The flaw (CWE-863) allows a ServiceWorker to access cross-origin resources it should be forbidden from reading, yielding a low confidentiality impact with no integrity or availability consequence. No public exploit or active exploitation has been identified; vendor-released patch 152.0.7977.65 is available.
Google Chrome's Preload subsystem prior to version 152.0.7977.65 contains a missing authorization flaw (CWE-862) that permits unauthenticated remote attackers to bypass the web origin policy. By delivering a crafted HTML page to a victim running an unpatched Chrome browser, an attacker can cause the Preload mechanism to speculatively fetch cross-origin resources without enforcing same-origin access controls, resulting in limited confidentiality exposure. No public exploit has been identified at time of analysis, and a vendor-released patch is available in Chrome 152.0.7977.65.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already achieved renderer process compromise to read limited cross-origin data via a crafted HTML page. The vulnerability stems from CWE-863 (Incorrect Authorization) in Chrome's Input component, which fails to enforce origin boundaries correctly when processing renderer-supplied input. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.24% (15th percentile), consistent with low observed exploitation pressure.
WebProtect race condition in Google Chrome prior to 152.0.7977.65 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) enables a second-stage information disclosure step within a broader browser exploitation chain, requiring a victim to interact with a crafted HTML page. No public exploit code has been identified and EPSS sits at 0.29% (22nd percentile), indicating limited real-world exploitation pressure at this time; a vendor patch is available.
Web origin policy bypass in Google Chrome for Windows (prior to 152.0.7977.65) stems from inadequate encryption strength in the browser's Notifications subsystem, exploitable via a crafted HTML page using social engineering. An unauthenticated remote attacker who tricks a user into visiting a malicious page can read limited cross-origin notification data, violating the same-origin boundary. No public exploit code has been identified and EPSS is extremely low (0.13%, 3rd percentile), consistent with the Chromium team's own Medium severity rating.
Cross-origin data leakage in Google Chrome's Payments subsystem (prior to 152.0.7977.65) exposes information from other origins when a user visits a crafted HTML page. The vulnerability stems from improper isolation within the Payments component, allowing a remote unauthenticated attacker to read data across origin boundaries - a violation of the Same-Origin Policy that underpins browser security. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates low observed exploitation probability in the wild.
HttpsUpgrades protection mechanism failure in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy via crafted network traffic. The vulnerability affects all desktop Chrome installations before the patched stable channel release and requires user interaction to trigger, consistent with CVSS UI:R. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.26% (18th percentile) indicates low current exploitation probability.
The Viz compositor component in Google Chrome prior to 152.0.7977.65 can be exploited by an attacker who has already achieved renderer process compromise to bypass Chrome's web origin policy via a crafted HTML page. This is a chained exploit primitive, not a standalone initial-access vector - it escalates an existing renderer foothold into cross-origin data access. EPSS sits at 0.29% (21st percentile), no CISA KEV listing exists, and no public exploit code has been identified, placing real-world urgency below what raw CVSS metrics alone might suggest.
Incorrect reference resolution in Chrome's Loader component prior to version 152.0.7977.65 enables unauthenticated remote attackers to bypass the browser's web origin policy via crafted network traffic, with user interaction required. The flaw (CWE-706) allows misattribution of resource origins, potentially exposing cross-origin data; CVSS rates impact as limited confidentiality loss only. With an EPSS of 0.30% at the 22nd percentile and no CISA KEV listing, exploitation appears theoretical at this time rather than actively occurring, though origin policy bypass is a meaningful primitive for targeted attacks.
Web origin policy bypass in Google Chrome's Variations component (the Finch A/B testing and feature-flag delivery system) affects all Chrome versions prior to 152.0.7977.65. A remote attacker can deliver crafted network traffic to a user running a vulnerable browser version, potentially circumventing same-origin protections and reading cross-origin data. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.22% (12th percentile) signals low current exploitation activity.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) permits a remote attacker who has already compromised the renderer process to circumvent same-origin policy enforcement via a crafted HTML page, yielding limited cross-origin data disclosure. The flaw arises from improper input validation (CWE-20) in the network stack and functions as a second-stage amplifier within an exploit chain rather than a standalone initial-access vector. EPSS is very low at 0.28% (20th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data exfiltration via Skia, Chrome's graphics rendering engine, affects all Google Chrome versions prior to 152.0.7977.65, enabling remote unauthenticated attackers to read pixel-level cross-origin data from a victim's browser session. Exploitation requires user interaction - the victim must visit a crafted HTML page - and impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates minimal observed exploitation pressure.
DOM information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive browser data by inducing a victim to visit a crafted HTML page via social engineering. The vulnerability (CWE-200) reflects improper information exposure within Chrome's Document Object Model, with high confidentiality impact per CVSS. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 13th percentile (0.22%), and a vendor-released patch is available in stable channel 152.0.7977.65.
Canvas API information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy and read cross-origin pixel data via a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) and results in low confidentiality impact - pixel-level canvas data leakage rather than credential or file system exposure. No public exploit has been identified and EPSS at 0.39% (32nd percentile) confirms low real-world exploitation probability; no CISA KEV listing exists.
Race condition in Google Chrome's Permissions component on Android allows a remote attacker, through social engineering, to bypass the web origin policy and access limited cross-origin data. Affected are all Chrome for Android versions prior to 152.0.7977.65. Exploitation requires user interaction with a crafted HTML page; no public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.26% (18th percentile) reflects low observed exploitation probability.
Observable discrepancy (CWE-203) in Google Chrome's network stack prior to version 152.0.7977.65 enables remote attackers to extract sensitive information by exploiting behavioral differences observable from a crafted HTML page. Exploitation requires high attack complexity and user interaction - the victim must visit a malicious page - constraining real-world impact despite the high confidentiality rating in the CVSS vector. No public exploit code exists and no active exploitation has been reported; Google has released a patch in Chrome 152.0.7977.65.
Incorrect authorization in the Downloads component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system-level file access restrictions through a crafted HTML page delivered via social engineering. The flaw (CWE-863) requires user interaction to trigger, limiting opportunistic mass exploitation; however, Chrome's ubiquitous install base makes even low-probability attack paths operationally significant. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits low at 0.32% (24th percentile).
Incorrect authorization in the Navigation subsystem of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy by luring a victim to a crafted HTML page. The flaw, classified under CWE-863 (Incorrect Authorization), allows partial cross-origin data reads (limited confidentiality impact per CVSS C:L). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.29% (21st percentile) reflects a currently low real-world exploitation probability. Vendor-released patch 152.0.7977.65 is available.
Chrome's Network component prior to version 152.0.7977.65 contains an improper input validation flaw that allows a pre-positioned attacker - one who has already compromised the renderer process - to bypass system access restrictions via a crafted HTML page. All Google Chrome desktop releases below 152.0.7977.65 on Windows, macOS, and Linux are affected. With a CVSS score of 6.8, an EPSS of 0.24%, no CISA KEV listing, and no public exploit identified at time of analysis, the threat is real but confined to sophisticated chained-attack scenarios.
Remote same-origin policy bypass in Google Chrome prior to 152.0.7977.65 exploits a use-after-free condition (CWE-672) in the Network component, allowing an attacker who has already achieved renderer process compromise to escape origin boundaries via a crafted HTML page. The vulnerability carries a CVSS 4.3 and EPSS of 0.66% (49th percentile), consistent with its role as a second-stage exploit chain component rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-origin data leakage in Google Chrome's SVG rendering engine (prior to 152.0.7977.65) allows a remote attacker to bypass same-origin policy boundaries through observable behavioral discrepancies. Exploitation requires the victim to interact with a crafted HTML page (UI:R), limiting opportunistic mass exploitation. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.37% (30th percentile) confirms low current exploitation probability.
Web Workers race condition in Google Chrome prior to 152.0.7977.65 enables Same-Origin Policy bypass for attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) allows a timing attack between origin validation and Worker data access, permitting cross-origin data reads from within a compromised renderer. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.19% (9th percentile) reflects the chained-exploit prerequisite that substantially limits real-world attacker reach.
Chrome's QUIC protocol implementation prior to version 152.0.7977.65 permits remote attackers to bypass the browser's web origin policy by directing a user to a crafted HTML page. The flaw is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), meaning an attacker can influence a reference within the QUIC layer to access cross-origin resources that should be restricted. Impact is limited to partial confidentiality loss; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
UI misrepresentation in the Chrome Extensions subsystem (CWE-451) enables remote attackers to use social engineering and a crafted extension to deceive users into disclosing sensitive information. All Google Chrome desktop installations prior to version 152.0.7977.65 are affected. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV; however, the high confidentiality impact in the CVSS vector reflects the potential for credential or sensitive-data theft if a user is successfully deceived into installing a malicious extension.
Web origin policy bypass in Google Chrome before 152.0.7977.65 exploits improper input validation (CWE-20) in the browser's Input component, allowing a remote attacker who has already compromised the renderer process to circumvent same-origin protections via a crafted HTML page combined with social engineering. The confidentiality impact is limited (CVSS C:L) with no integrity or availability consequence, and the Chromium team rates this Medium severity. No public exploit code exists and EPSS at 0.24% (15th percentile) reflects the low opportunistic exploitation probability given the chained pre-conditions required.
Web origin policy bypass in Google Chrome's network layer prior to version 152.0.7977.65 allows a remote attacker to circumvent the browser's same-origin enforcement by luring a user to a crafted HTML page. The flaw stems from incorrect authorization logic (CWE-863) in Chrome's networking stack, resulting in limited confidentiality exposure (C:L) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low observed exploitation probability at time of analysis.
Incorrect authorization in Google Chrome Core prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass the web origin policy by combining that foothold with social engineering via a crafted HTML page. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser's Core incorrectly validates authorization checks across origins under this specific post-compromise condition. No public exploit or CISA KEV listing is present, and the EPSS score of 0.34% (26th percentile) reflects limited real-world exploitation probability at this time.
Missing authorization in the WebAppInstalls component of Google Chrome for Android (prior to 152.0.7977.65) enables an attacker who has already achieved renderer process compromise to extract sensitive information by issuing crafted IPC requests that bypass browser-process authorization checks. This is a chained exploit primitive rather than a standalone attack - it elevates a pre-existing renderer compromise into an unauthorized data disclosure. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.38% at the 30th percentile reflects the high practical barrier imposed by the required renderer prerequisite.
Sensor API information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to read sensitive device sensor data by loading a crafted HTML page. The flaw (CWE-862, Missing Authorization) does not provide initial access on its own - it is a post-exploitation primitive that extends the capability of a pre-existing renderer compromise. No public exploit code has been identified at time of analysis, and EPSS stands at 0.26% (17th percentile), reflecting low current exploitation probability.
Incorrect authorization in Chrome's FileSystem API (CWE-863) allows a remote attacker to bypass system access restrictions through a crafted HTML page delivered via social engineering, achieving high-integrity impact on versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network delivery with mandatory user interaction and no confidentiality exposure - only unauthorized writes or modification of normally restricted filesystem locations. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.38% (31st percentile), consistent with the social-engineering friction required. A vendor patch is available in stable channel 152.0.7977.65.
Chrome's browser Sync subsystem in versions prior to 152.0.7977.65 leaks sensitive user data due to improper validation of crafted inbound network traffic (CWE-20), enabling a remote attacker to read high-confidentiality synchronized content such as credentials or browsing history. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable with no privilege requirement, but a user interaction step limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists; EPSS at 0.25% (16th percentile) corroborates low near-term exploitation probability, and the vendor-released patch (152.0.7977.65) is already available.
Incorrect authorization in Chrome's CustomTabs feature on Android (prior to 152.0.7977.65) allows a co-installed malicious application to bypass the browser's web origin policy. The flaw is classified CWE-863 and is limited to Android deployments where an attacker controls a separately installed app on the same device. A vendor patch was released in Chrome 152.0.7977.65; no public exploit code or CISA KEV listing exists, and EPSS sits at 0.14% (3rd percentile), indicating minimal observed exploitation pressure.
Sensitive information disclosure via the QUIC protocol stack in Google Chrome affects all versions prior to 152.0.7977.65, exploitable by remote unauthenticated attackers through a crafted HTML page. When a victim navigates to an attacker-controlled page, Chrome's QUIC (HTTP/3) implementation improperly exposes confidential data, with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified at time of analysis; CISA SSVC rates exploitation status as none and EPSS is 0.31% (23rd percentile), indicating low near-term exploitation probability despite the medium-severity classification.
Observable discrepancy in Chrome's Autofill subsystem allows remote information disclosure via a crafted HTML page, affecting all desktop Chrome versions before 152.0.7977.65. The flaw (CWE-203) enables a network-reachable attacker to infer sensitive stored autofill data - such as addresses or payment fields - by measuring behavioral or timing differences triggered by form elements on a malicious page. Google has issued a patch in stable channel version 152.0.7977.65; no public exploit code exists and no CISA KEV listing has been recorded at time of analysis.
Cross-origin data exposure via the GPU subsystem in Google Chrome prior to 152.0.7977.65 allows a remote, unauthenticated attacker to read data from other web origins by luring a user to a crafted HTML page. The vulnerability resides in Chrome's GPU rendering path and violates the browser's same-origin policy, potentially exposing session tokens, rendered content, or other sensitive cross-origin data. No public exploit code or CISA KEV listing has been identified, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Incorrect authorization in the Chrome Extensions subsystem (CWE-863) allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by delivering a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. Chromium rated this High severity despite the NVD CVSS base score of 4.3, because the same-origin policy bypass has meaningful privacy implications even though it requires a pre-compromised renderer as a prerequisite. No public exploit code has been identified and EPSS stands at 0.34% (26th percentile), consistent with no active exploitation confirmed at time of analysis.
Race condition in Google Chrome's Autofill subsystem (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to bypass the browser's same-origin policy via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer exploit, making it a chained-attack component rather than a standalone threat. No public exploit code has been identified, and EPSS at 0.31% (24th percentile) reflects low opportunistic exploitation probability with no CISA KEV listing.
Incorrect authorization in Google Chrome's Extensions subsystem (all versions before 152.0.7977.65) allows an attacker who has already compromised the renderer process to bypass the web origin policy and reach privileged browser pages via a crafted HTML page. This is a chained, second-stage vulnerability - a prior renderer compromise is required - substantially narrowing the realistic attacker pool despite the network-accessible vector. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS probability of 0.24% at the 15th percentile is consistent with this chained attack profile.
Uninitialized memory in Chrome's ANGLE graphics abstraction layer, across all desktop platforms prior to version 152.0.7977.65, enables remote attackers to read cross-origin data by delivering a crafted HTML page to a victim user. The flaw breaks the browser's same-origin policy through the graphics pipeline rather than through JavaScript or DOM manipulation. No public exploit or CISA KEV listing exists; EPSS of 0.24% at the 15th percentile reflects low current exploitation pressure.
Cross-origin information leak in Google Chrome's Paint rendering component (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy by delivering a crafted HTML page. The vulnerability is confined to the confidentiality dimension - no integrity or availability impact - and requires user interaction (visiting the attacker-controlled page) to trigger. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.33% places it in the 25th percentile, indicating low exploitation probability in the near term.
Cross-origin pixel data leakage in the Canvas API of Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web same-origin policy by enticing a victim to visit a crafted HTML page. The flaw is classified High severity by the Chromium team and Medium (CVSS 4.3) by NVD, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing is identified at time of analysis, and EPSS at 0.33% indicates very low observed exploitation probability.
Incorrect authorization in Google Chrome's Transactions Platform (versions prior to 152.0.7977.65) permits a remote attacker who has already achieved renderer process compromise to bypass the browser's web origin policy via a crafted HTML page. The flaw is classified CWE-863 and carries a vendor severity of High, though the CVSS base score of 4.3 reflects the limited confidentiality-only impact and required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.24% (15th percentile) indicates low observed exploitation probability.
Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. The impact is limited to a partial confidentiality breach via cross-origin data access; no integrity or availability impact has been identified. No public exploit code exists and EPSS probability sits at 0.20% (10th percentile), indicating very low near-term exploitation likelihood despite Chromium's internal 'High' severity rating.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (versions prior to 152.0.7977.65) allows an unauthenticated remote attacker to read limited data across origin boundaries by inducing a victim to visit a crafted HTML page. The root cause is an uninitialized resource (CWE-908) in ANGLE, Chrome's graphics abstraction engine, which can expose residual GPU buffer contents from other origins. No public exploit identified at time of analysis; EPSS is low at 0.40% (33rd percentile), and the vulnerability is not listed in CISA KEV.
Information disclosure in Google Chrome's Autofill component on Android (prior to 152.0.7977.65) enables a remote attacker to extract sensitive user data - likely form-fill credentials or PII - by luring a victim to a specially crafted HTML page. The vulnerability stems from CWE-20 improper input validation in the Autofill subsystem, which fails to sanitize attacker-controlled HTML before processing it. No public exploit code or CISA KEV listing is present at time of analysis; EPSS sits at the 13th percentile, indicating low current exploitation momentum despite the high confidentiality impact.
Incorrect authorization in the Paint component of Google Chrome before version 152.0.7977.65 enables remote unauthenticated attackers to potentially bypass the Same-Origin Policy via a crafted HTML page, resulting in limited cross-origin data exposure. Exploitation requires user interaction - the victim must navigate to the attacker-controlled page - and impact is confined to partial confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and the low EPSS score of 0.24% (15th percentile) corroborates low observed exploitation activity; a vendor patch was released in the Chrome 152 stable channel.
Missing authorization in Google Chrome's Passwords component prior to version 152.0.7977.65 allows a remote attacker, who has already compromised the renderer process, to bypass web origin policy and access stored password data for other origins via a crafted HTML page combined with social engineering. The attack requires two chained prerequisites - renderer compromise and user interaction - which significantly constrains real-world exploitability despite the network-facing attack vector. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at a very low 0.24% (15th percentile). A vendor patch is available.
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to silently return an empty string on XML canonicalization failure instead of raising an exception. This silent failure propagates incorrectly to downstream SAML libraries, which have been demonstrated in practice to accept the malformed output as a valid canonicalized document, enabling signature validation bypass. The JRuby implementation is not affected; exploitation has been confirmed as demonstrated by a HackerOne researcher but is not listed in CISA KEV.
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against long-running Ruby applications that pass attacker-controlled input to `Nokogiri::XSLT::Stylesheet#transform` parameters containing null bytes. Each null-byte-bearing call leaks approximately 24-32 bytes of heap memory; meaningful service degradation requires sustained, high-rate malicious traffic against the specific code path. No public exploit has been identified at time of analysis, and the vulnerability is absent from CISA KEV. Notably, the VulnCheck-reported CVSS 4.0 score of 6.9 is higher than the Nokogiri maintainers' own assessment of CVSS 5.3 Moderate, reflecting scoring convention differences rather than disagreement on impact.
Denial of service in GNU wget's FTP OPIE/S-KEY authentication handler allows a malicious or intercepted FTP server to cause wget to perform approximately 2.1 billion MD5 computations by supplying a crafted sequence number near INT_MAX in the OPIE challenge line. All versions of GNU wget with OPIE/S-KEY FTP authentication support are affected per CPE cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*. The --timeout option provides no mitigation because it governs network I/O exclusively, not CPU-bound computation. No public exploit identified at time of analysis; a fix is confirmed via upstream GitLab commit.
Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.
Denial of service in OpenEXR 3.4.0 through 3.4.12 allows any application calling exr_start_read() on untrusted input to be unconditionally aborted by a crafted HTJ2K-compressed EXR file containing a QCD marker with lower five bits set to zero. The flaw chains two weaknesses: OpenJPH's vendored assertion-based validation calls abort() instead of returning a recoverable error, and OpenEXR's error handling wraps only its internal HT header parser, leaving downstream codestream construction calls entirely unprotected. No public exploit or active exploitation (CISA KEV) has been identified, but the trivial triggering condition and prevalence of OpenEXR in automated rendering pipelines make this a meaningful denial-of-service risk for media production infrastructure.
Uncontrolled resource consumption in Mailpit's thumbnail generation endpoint allows unauthenticated network clients to exhaust server memory and CPU by submitting email attachments containing image decompression bombs. The affected code path in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation before performing any dimension, pixel-count, or memory validation, meaning a compact on-disk image declaring enormous pixel dimensions triggers full raster allocation prior to the 180×120 scaling step. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the vendor-confirmed fix is Mailpit 1.30.4.
Uncontrolled memory allocation in Mailpit's SMTP command reader allows unauthenticated remote clients to exhaust server memory by sending oversized pre-DATA command lines. Versions prior to 1.30.4 use Go's unbounded `bufio.Reader.ReadString` in `internal/smtpd/smtpd.go`, which allocates the full attacker-controlled input before any syntax rejection or RFC 5321 line-length enforcement occurs. The same vulnerable code path handles AUTH continuation lines (LOGIN, PLAIN, CRAM-MD5), so concurrent oversized inputs compound memory pressure and can reduce service availability. No public exploit identified at time of analysis; a vendor-released patch is available in v1.30.4.
Terminal escape sequence injection in Ember's interactive TUI allows unauthenticated remote attackers to smuggle ANSI/OSC/CSI control bytes into an operator's terminal by embedding them in HTTP requests sent to the monitored Caddy server. Ember's ParseLogLine restores raw control bytes from Caddy's unicode-escaped JSON access log, and the render helpers fitCellLeft and fitCellRight pass them unfiltered to os.Stdout via bubbletea's View(), enabling clipboard hijacking (OSC 52), dashboard spoofing (CSI cursor/erase), and window-title manipulation (OSC 0/2). No CISA KEV listing or confirmed public exploit exists at time of analysis; the 'RCE' tag in the intelligence metadata conflicts with the advisory's explicit statement that this is not general-case RCE and should not drive incident response decisions without independent verification.
Path traversal in VictoriaMetrics vmrestore (prior to versions 1.122.25, 1.136.12, and 1.146.0) allows an attacker who controls or can modify a remote backup source - S3, GCS, Azure Blob Storage, or equivalent - to plant dot-dot sequences in object names, causing vmrestore to write restored files outside the configured -storageDataPath directory when an operator executes a restore operation. The CVSS Scope Changed metric (S:C) reflects that successful exploitation reaches beyond the vmrestore process boundary to the broader host filesystem, enabling potential overwrite of binaries, configuration, or credentials within the OS permissions of the process. Vendor-released patches are available across three maintained branches; no active exploitation has been identified at time of analysis.
Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.
Denial of service in Wireshark's BUSMASTER file parser causes an abnormal process exit when processing a specially crafted BUSMASTER capture file, affecting Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is a reachable assertion (CWE-617) that aborts the process rather than handling the malformed input gracefully. An attacker who can induce a user to open a crafted file can crash the Wireshark session; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.
Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.
Wireshark's Tektronix K12xx file parser crashes when processing a malformed capture file, causing a denial of service in versions 4.6.0-4.6.7 and 4.4.0-4.4.18. Rooted in CWE-126 (Buffer Over-read), the flaw allows an attacker to terminate Wireshark on a victim's system by inducing them to open a specially crafted K12xx-format file. No public exploit code and no active exploitation (CISA KEV) have been identified; the low CVSS score of 3.1 reflects the crash-only impact and mandatory user interaction.
Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Broken cryptography in Ceph's CephX authentication subsystem enables credential scope escalation and plaintext inference for any network-adjacent attacker holding a compromised Ceph account. CephX employed AES-CBC with a hardcoded initialization vector and no message authentication code, making encrypted authentication traffic both deterministic (identical plaintexts yield identical ciphertexts) and malleable (bit-flip attacks alter decrypted credential payloads undetected). Fixed in Ceph Tentacle 20.2.4 and Squid 19.2.6 by replacing the scheme with AES-256-CTS-HMAC-SHA384-192; no public exploit has been identified at time of analysis.
Out-of-bounds read in FreeRDP's planar RLE bitmap decoder allows a malicious RDP server to crash connecting clients and potentially disclose adjacent heap or stack memory. The flaw exists in planar_decompress_plane_rle and planar_decompress_plane_rle_only within libfreerdp/codec/planar.c across all FreeRDP releases prior to 3.29.0. An attacker operating or controlling an RDP server can exploit this by sending a specially truncated planar bitmap or surface update whose RLE control byte claims more raw bytes than the buffer contains, triggering the decoder to read beyond the allocated source buffer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) exposes any deployment using FFmpeg to mux AV1 video over RTP to memory disclosure and process crash via a crafted input. All FFmpeg versions prior to commit 983dae9 are affected across every platform. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, VulnCheck has independently disclosed the issue, and a vendor-provided fix commit is available upstream.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when processing archive members whose names temporarily escape and re-enter it, such as '../evil/../dest/sub/file'. The extraction filters ('tar' and 'data') validate the resolved path - which correctly resolves to inside the destination - but create intermediate directories from the raw member name as given, allowing filesystem pollution beyond the extraction boundary. File contents are never placed outside the destination, and no public exploit has been identified at time of analysis; the PSF advisory confirms the limited scope.
Heap overread in swtpm's SWTPM_NVRAM_CheckHeader() function allows local low-privileged users to crash the swtpm daemon and leak heap memory contents to system logs on Red Hat Enterprise Linux 8, 9, and 10. The root cause is a classic sizeof-pointer vs. sizeof-struct confusion: the guard compares buffer length against sizeof(bh) (pointer width, 8 bytes on 64-bit) rather than sizeof(*bh) (actual struct size), permitting undersized buffers to bypass validation and triggering a 2-byte heap overread on 64-bit systems or 6 bytes on 32-bit. No public exploit or CISA KEV listing has been identified at time of analysis.
Skia graphics library in Google Chrome prior to 151.0.7922.169 leaks information in a way that allows remote attackers to potentially bypass the web Same-Origin Policy via a specially crafted HTML page. Affected users on all desktop platforms running any Chrome version before 151.0.7922.169 are exposed to cross-origin data disclosure triggered by visiting a malicious page. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Incorrect reference resolution in the Core component of Google Chrome on Android exposes sensitive information to remote attackers who can socially engineer users into visiting a malicious HTML page. Affected versions are all Chrome for Android builds prior to 151.0.7922.169. Exploitation requires user interaction but no authentication, and the vulnerability is platform-specific to Android. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Site isolation bypass in Google Chrome prior to 151.0.7922.169 enables a renderer-compromised attacker to cross origin boundaries via a flawed CORS implementation, reading or modifying data from otherwise isolated sites. This is a chained exploitation scenario: it requires a preceding renderer compromise as a prerequisite, making it a sandbox-escape-class vulnerability rather than a standalone browser attack. No public exploit code or active exploitation has been identified at the time of analysis, and a vendor patch is available in the 151.0.7922.169 stable channel release.
Partial denial-of-service in Oracle Java SE's JSSE component allows unauthenticated remote attackers to degrade availability of applications using TLS APIs across a broad range of supported Java versions. Affected releases span Java SE 8 through 26, GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.19, making this a wide-blast-radius availability issue for the Java ecosystem. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized data exposure in Oracle Java SE's Networking component allows unauthenticated remote attackers via HTTP to access critical or all data accessible to the affected Java process, with a confirmed scope change that can impact systems and products beyond the JDK's own security boundary. Affected versions span a wide range across Oracle Java SE (8u501 through 26.0.2), Oracle GraalVM for JDK (17.0.20 and 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19), covering both server-side Java API consumers and client-side Java Web Start or sandboxed applet deployments. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the breadth of affected LTS versions and the ubiquity of Java in enterprise environments make patch prioritization appropriate.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Site isolation bypass in Firefox's Graphics: WebRender component allows a remote attacker to achieve limited cross-origin information disclosure and content manipulation by delivering a crafted webpage to a user (CWE-346, origin validation error). All Firefox releases prior to 154 and Firefox ESR releases prior to 153.1 are affected across all platforms. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Clickjacking in Firefox for Android before version 154 allows remote unauthenticated attackers to overlay transparent or opaque UI frames over legitimate browser content, capturing user interactions intended for other elements. The CVSS vector (PR:N, UI:R, I:H) indicates no privileges are needed but a victim must interact with an attacker-controlled page, resulting in high-integrity impact through unintended user actions such as inadvertent permission grants or form submissions. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
JIT miscompilation in Firefox's SpiderMonkey JavaScript engine exposes sensitive memory to remote attackers via crafted web content. The CWE-843 (type confusion) root cause means the JIT compiler generates native code that accesses a JavaScript value as the wrong type, resulting in a high-confidentiality information disclosure. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing has been identified at time of analysis.
Same-origin policy bypass in Firefox's ImageLib image rendering component allows remote attackers to read cross-origin data or perform unauthorized cross-origin writes against victims using unpatched browser versions. Affected releases span the main Firefox channel (prior to 154) and three ESR branches (prior to ESR 115.39, ESR 140.14, and ESR 153.1), placing a large share of the global Firefox install base at risk until patched. The CVSS 5.4 score reflects limited confidentiality and integrity impact with no authentication requirement on the attacker side, though no public exploit has been identified and this CVE is not listed in the CISA KEV catalog at the time of analysis.
Memory disclosure in Google Chrome's ANGLE graphics subsystem (prior to 152.0.7977.65) exposes out-of-sandbox memory contents when a user visits a crafted HTML page. The uninitialized resource flaw (CWE-908) in ANGLE - Chrome's cross-platform graphics abstraction layer - allows a remote attacker to read memory that should be isolated within the renderer sandbox, leading to high-confidence confidentiality impact. No public exploit has been identified at time of analysis, and EPSS at 0.29% reflects currently low exploitation probability despite the high CVSS confidentiality rating.
Cross-origin data disclosure in Google Chrome's ANGLE graphics translation layer affects all desktop versions prior to 152.0.7977.65. The uninitialized GPU resource (CWE-908) can be triggered by a crafted HTML page, allowing a remote attacker to read residual data across origin boundaries - a direct violation of browser isolation guarantees. No public exploit code or active exploitation is identified at the time of analysis; the 0.24% EPSS score (15th percentile) places real-world exploitation probability in low-priority territory despite the High confidentiality sub-score in the CVSS rating.
Incorrect authorization in the TabGroups feature of Google Chrome prior to 152.0.7977.65 allows a remote attacker to leak sensitive browser information by serving crafted network traffic to a victim user. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser fails to properly enforce access control within tab group contexts, and was rated Medium severity by the Chromium security team. No public exploit identified at time of analysis, and an EPSS of 0.20% at the 10th percentile confirms very low observed exploitation activity.
Chrome's Network subsystem before version 152.0.7977.65 allows remote attackers to bypass the browser's web origin policy due to improper initialization (CWE-665), exploitable via a crafted HTML page that requires user interaction. The impact is limited to partial confidentiality disclosure (C:L), with no integrity or availability consequences, and the CVSS score of 4.3 (Medium) aligns with EPSS exploitation probability of 0.36% (29th percentile). No public exploit code or CISA KEV listing exists at the time of analysis; a vendor patch is available in the stable channel.
Incorrect authorization in Google Chrome's WebProtect component before version 152.0.7977.65 allows a remote, unauthenticated attacker to exfiltrate sensitive information by directing a user to a specially crafted HTML page. The flaw carries a CVSS 3.1 score of 6.5 with high confidentiality impact (C:H) and no integrity or availability impact, scoped entirely within the browser process. No public exploit is identified at time of analysis, and the EPSS score of 0.27% (19th percentile) indicates low current exploitation probability despite Chrome's ubiquitous deployment footprint.
Missing authorization in Chrome's CustomTabs feature on Android exposes sensitive browser information to co-installed malicious applications on versions prior to 152.0.7977.65. The vulnerability stems from CWE-862 (Missing Authorization), meaning Chrome does not properly verify whether a companion app is permitted to access data surfaced through the CustomTabs interface. No public exploit code or active exploitation has been identified; EPSS sits at the 6th percentile, confirming low real-world exploitation probability despite the High confidentiality impact in the CVSS vector.
Incorrect reference resolution in Chrome's Preload subsystem (versions prior to 152.0.7977.65) allows remote attackers to bypass the Same-Origin Policy by serving a crafted HTML page to a victim. The vulnerability is limited to confidentiality impact at the low tier - an attacker can read a constrained subset of cross-origin data but cannot modify content or cause a denial of service. No public exploit code has been identified and the EPSS score of 0.31% (23rd percentile) reflects low real-world exploitation probability at time of analysis.
Incorrect authorization in Google Chrome's Extensions subsystem (versions prior to 152.0.7977.65) permits a remote attacker to bypass system access restrictions through a crafted Chrome extension delivered via social engineering. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms mandatory user interaction limits opportunistic exploitation, and impact is constrained to integrity with no confidentiality or availability consequence. No public exploit code or CISA KEV listing has been identified; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the social-engineering dependency.
Memory disclosure in Google Chrome's Video component (versions prior to 152.0.7977.65) allows a remote attacker to read memory contents from within the Chrome sandbox by directing a victim to a specially crafted HTML page. The uninitialized resource flaw (CWE-908) means the Video subsystem may expose stale memory - potentially including session tokens, credentials, or other sensitive browser data - without requiring any authentication from the attacker. No public exploit code or active exploitation has been identified at time of analysis; the EPSS score of 0.34% (26th percentile) confirms low automated exploitation probability.
Injection in Google Chrome's Tabs component (versions prior to 152.0.7977.65) enables remote attackers to partially bypass system access restrictions by directing a user to a specially crafted HTML page. The flaw is classified CWE-74 (Injection) and carries only a low integrity impact (I:L) with no confidentiality or availability consequences, consistent with Chromium's own 'Medium' severity rating. No public exploit code has been identified and EPSS probability is low at 0.38% (31st percentile), indicating limited real-world exploitation pressure despite the browser's ubiquitous deployment footprint.
Incorrect authorization in Chrome's WebProtect component exposes sensitive browser information to remote attackers via crafted HTML pages, affecting all Chrome versions prior to 152.0.7977.65. The flaw carries a CVSS 6.5 score with high confidentiality impact; an unauthenticated attacker requires only that a target user visit a malicious page, making social-engineering delivery viable. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS of 0.32% (24th percentile) indicates low current exploitation activity despite the broad attack surface.
ServiceWorker incorrect authorization in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web origin policy by inducing a victim to visit a crafted HTML page. The flaw (CWE-863) allows a ServiceWorker to access cross-origin resources it should be forbidden from reading, yielding a low confidentiality impact with no integrity or availability consequence. No public exploit or active exploitation has been identified; vendor-released patch 152.0.7977.65 is available.
Google Chrome's Preload subsystem prior to version 152.0.7977.65 contains a missing authorization flaw (CWE-862) that permits unauthenticated remote attackers to bypass the web origin policy. By delivering a crafted HTML page to a victim running an unpatched Chrome browser, an attacker can cause the Preload mechanism to speculatively fetch cross-origin resources without enforcing same-origin access controls, resulting in limited confidentiality exposure. No public exploit has been identified at time of analysis, and a vendor-released patch is available in Chrome 152.0.7977.65.
Web origin policy bypass in Google Chrome prior to 152.0.7977.65 enables a remote attacker who has already achieved renderer process compromise to read limited cross-origin data via a crafted HTML page. The vulnerability stems from CWE-863 (Incorrect Authorization) in Chrome's Input component, which fails to enforce origin boundaries correctly when processing renderer-supplied input. No public exploit code or CISA KEV listing has been identified at time of analysis; EPSS sits at 0.24% (15th percentile), consistent with low observed exploitation pressure.
WebProtect race condition in Google Chrome prior to 152.0.7977.65 exposes sensitive information to attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) enables a second-stage information disclosure step within a broader browser exploitation chain, requiring a victim to interact with a crafted HTML page. No public exploit code has been identified and EPSS sits at 0.29% (22nd percentile), indicating limited real-world exploitation pressure at this time; a vendor patch is available.
Web origin policy bypass in Google Chrome for Windows (prior to 152.0.7977.65) stems from inadequate encryption strength in the browser's Notifications subsystem, exploitable via a crafted HTML page using social engineering. An unauthenticated remote attacker who tricks a user into visiting a malicious page can read limited cross-origin notification data, violating the same-origin boundary. No public exploit code has been identified and EPSS is extremely low (0.13%, 3rd percentile), consistent with the Chromium team's own Medium severity rating.
Cross-origin data leakage in Google Chrome's Payments subsystem (prior to 152.0.7977.65) exposes information from other origins when a user visits a crafted HTML page. The vulnerability stems from improper isolation within the Payments component, allowing a remote unauthenticated attacker to read data across origin boundaries - a violation of the Same-Origin Policy that underpins browser security. No public exploit code has been identified at time of analysis, and EPSS of 0.22% (13th percentile) indicates low observed exploitation probability in the wild.
HttpsUpgrades protection mechanism failure in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy via crafted network traffic. The vulnerability affects all desktop Chrome installations before the patched stable channel release and requires user interaction to trigger, consistent with CVSS UI:R. No public exploit code has been identified and no CISA KEV listing exists; the EPSS score of 0.26% (18th percentile) indicates low current exploitation probability.
The Viz compositor component in Google Chrome prior to 152.0.7977.65 can be exploited by an attacker who has already achieved renderer process compromise to bypass Chrome's web origin policy via a crafted HTML page. This is a chained exploit primitive, not a standalone initial-access vector - it escalates an existing renderer foothold into cross-origin data access. EPSS sits at 0.29% (21st percentile), no CISA KEV listing exists, and no public exploit code has been identified, placing real-world urgency below what raw CVSS metrics alone might suggest.
Incorrect reference resolution in Chrome's Loader component prior to version 152.0.7977.65 enables unauthenticated remote attackers to bypass the browser's web origin policy via crafted network traffic, with user interaction required. The flaw (CWE-706) allows misattribution of resource origins, potentially exposing cross-origin data; CVSS rates impact as limited confidentiality loss only. With an EPSS of 0.30% at the 22nd percentile and no CISA KEV listing, exploitation appears theoretical at this time rather than actively occurring, though origin policy bypass is a meaningful primitive for targeted attacks.
Web origin policy bypass in Google Chrome's Variations component (the Finch A/B testing and feature-flag delivery system) affects all Chrome versions prior to 152.0.7977.65. A remote attacker can deliver crafted network traffic to a user running a vulnerable browser version, potentially circumventing same-origin protections and reading cross-origin data. No public exploit code or CISA KEV listing exists at time of analysis; EPSS at 0.22% (12th percentile) signals low current exploitation activity.
Web origin policy bypass in Google Chrome's Network component (all versions prior to 152.0.7977.65) permits a remote attacker who has already compromised the renderer process to circumvent same-origin policy enforcement via a crafted HTML page, yielding limited cross-origin data disclosure. The flaw arises from improper input validation (CWE-20) in the network stack and functions as a second-stage amplifier within an exploit chain rather than a standalone initial-access vector. EPSS is very low at 0.28% (20th percentile), and no public exploit code or CISA KEV listing has been identified at time of analysis.
Cross-origin data exfiltration via Skia, Chrome's graphics rendering engine, affects all Google Chrome versions prior to 152.0.7977.65, enabling remote unauthenticated attackers to read pixel-level cross-origin data from a victim's browser session. Exploitation requires user interaction - the victim must visit a crafted HTML page - and impact is limited to partial confidentiality loss with no integrity or availability consequence. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.22% (13th percentile) indicates minimal observed exploitation pressure.
DOM information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to extract sensitive browser data by inducing a victim to visit a crafted HTML page via social engineering. The vulnerability (CWE-200) reflects improper information exposure within Chrome's Document Object Model, with high confidentiality impact per CVSS. No active exploitation is confirmed (not in CISA KEV), EPSS sits at the 13th percentile (0.22%), and a vendor-released patch is available in stable channel 152.0.7977.65.
Canvas API information leak in Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the Same-Origin Policy and read cross-origin pixel data via a crafted HTML page. Exploitation requires user interaction (visiting the malicious page) and results in low confidentiality impact - pixel-level canvas data leakage rather than credential or file system exposure. No public exploit has been identified and EPSS at 0.39% (32nd percentile) confirms low real-world exploitation probability; no CISA KEV listing exists.
Race condition in Google Chrome's Permissions component on Android allows a remote attacker, through social engineering, to bypass the web origin policy and access limited cross-origin data. Affected are all Chrome for Android versions prior to 152.0.7977.65. Exploitation requires user interaction with a crafted HTML page; no public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.26% (18th percentile) reflects low observed exploitation probability.
Observable discrepancy (CWE-203) in Google Chrome's network stack prior to version 152.0.7977.65 enables remote attackers to extract sensitive information by exploiting behavioral differences observable from a crafted HTML page. Exploitation requires high attack complexity and user interaction - the victim must visit a malicious page - constraining real-world impact despite the high confidentiality rating in the CVSS vector. No public exploit code exists and no active exploitation has been reported; Google has released a patch in Chrome 152.0.7977.65.
Incorrect authorization in the Downloads component of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass system-level file access restrictions through a crafted HTML page delivered via social engineering. The flaw (CWE-863) requires user interaction to trigger, limiting opportunistic mass exploitation; however, Chrome's ubiquitous install base makes even low-probability attack paths operationally significant. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS sits low at 0.32% (24th percentile).
Incorrect authorization in the Navigation subsystem of Google Chrome prior to version 152.0.7977.65 enables remote attackers to bypass the browser's web origin policy by luring a victim to a crafted HTML page. The flaw, classified under CWE-863 (Incorrect Authorization), allows partial cross-origin data reads (limited confidentiality impact per CVSS C:L). No public exploit code or active exploitation has been identified at time of analysis, and the low EPSS score of 0.29% (21st percentile) reflects a currently low real-world exploitation probability. Vendor-released patch 152.0.7977.65 is available.
Chrome's Network component prior to version 152.0.7977.65 contains an improper input validation flaw that allows a pre-positioned attacker - one who has already compromised the renderer process - to bypass system access restrictions via a crafted HTML page. All Google Chrome desktop releases below 152.0.7977.65 on Windows, macOS, and Linux are affected. With a CVSS score of 6.8, an EPSS of 0.24%, no CISA KEV listing, and no public exploit identified at time of analysis, the threat is real but confined to sophisticated chained-attack scenarios.
Remote same-origin policy bypass in Google Chrome prior to 152.0.7977.65 exploits a use-after-free condition (CWE-672) in the Network component, allowing an attacker who has already achieved renderer process compromise to escape origin boundaries via a crafted HTML page. The vulnerability carries a CVSS 4.3 and EPSS of 0.66% (49th percentile), consistent with its role as a second-stage exploit chain component rather than a standalone initial-access vector. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Cross-origin data leakage in Google Chrome's SVG rendering engine (prior to 152.0.7977.65) allows a remote attacker to bypass same-origin policy boundaries through observable behavioral discrepancies. Exploitation requires the victim to interact with a crafted HTML page (UI:R), limiting opportunistic mass exploitation. No public exploit code exists and no CISA KEV listing is present; EPSS of 0.37% (30th percentile) confirms low current exploitation probability.
Web Workers race condition in Google Chrome prior to 152.0.7977.65 enables Same-Origin Policy bypass for attackers who have already achieved renderer process compromise. The flaw (CWE-367 TOCTOU) allows a timing attack between origin validation and Worker data access, permitting cross-origin data reads from within a compromised renderer. No active exploitation is confirmed (not in CISA KEV) and EPSS of 0.19% (9th percentile) reflects the chained-exploit prerequisite that substantially limits real-world attacker reach.
Chrome's QUIC protocol implementation prior to version 152.0.7977.65 permits remote attackers to bypass the browser's web origin policy by directing a user to a crafted HTML page. The flaw is classified as CWE-610 (Externally Controlled Reference to a Resource in Another Sphere), meaning an attacker can influence a reference within the QUIC layer to access cross-origin resources that should be restricted. Impact is limited to partial confidentiality loss; no public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.
UI misrepresentation in the Chrome Extensions subsystem (CWE-451) enables remote attackers to use social engineering and a crafted extension to deceive users into disclosing sensitive information. All Google Chrome desktop installations prior to version 152.0.7977.65 are affected. No public exploit has been identified at time of analysis, and no active exploitation has been confirmed by CISA KEV; however, the high confidentiality impact in the CVSS vector reflects the potential for credential or sensitive-data theft if a user is successfully deceived into installing a malicious extension.
Web origin policy bypass in Google Chrome before 152.0.7977.65 exploits improper input validation (CWE-20) in the browser's Input component, allowing a remote attacker who has already compromised the renderer process to circumvent same-origin protections via a crafted HTML page combined with social engineering. The confidentiality impact is limited (CVSS C:L) with no integrity or availability consequence, and the Chromium team rates this Medium severity. No public exploit code exists and EPSS at 0.24% (15th percentile) reflects the low opportunistic exploitation probability given the chained pre-conditions required.
Web origin policy bypass in Google Chrome's network layer prior to version 152.0.7977.65 allows a remote attacker to circumvent the browser's same-origin enforcement by luring a user to a crafted HTML page. The flaw stems from incorrect authorization logic (CWE-863) in Chrome's networking stack, resulting in limited confidentiality exposure (C:L) with no integrity or availability impact. No active exploitation has been confirmed by CISA KEV, and the EPSS score of 0.29% (21st percentile) indicates low observed exploitation probability at time of analysis.
Incorrect authorization in Google Chrome Core prior to 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to bypass the web origin policy by combining that foothold with social engineering via a crafted HTML page. The flaw is classified CWE-863 (Incorrect Authorization), meaning the browser's Core incorrectly validates authorization checks across origins under this specific post-compromise condition. No public exploit or CISA KEV listing is present, and the EPSS score of 0.34% (26th percentile) reflects limited real-world exploitation probability at this time.
Missing authorization in the WebAppInstalls component of Google Chrome for Android (prior to 152.0.7977.65) enables an attacker who has already achieved renderer process compromise to extract sensitive information by issuing crafted IPC requests that bypass browser-process authorization checks. This is a chained exploit primitive rather than a standalone attack - it elevates a pre-existing renderer compromise into an unauthorized data disclosure. No active exploitation has been confirmed (absent from CISA KEV), and the EPSS score of 0.38% at the 30th percentile reflects the high practical barrier imposed by the required renderer prerequisite.
Sensor API information disclosure in Google Chrome before 152.0.7977.65 enables a remote attacker who has already compromised the renderer process to read sensitive device sensor data by loading a crafted HTML page. The flaw (CWE-862, Missing Authorization) does not provide initial access on its own - it is a post-exploitation primitive that extends the capability of a pre-existing renderer compromise. No public exploit code has been identified at time of analysis, and EPSS stands at 0.26% (17th percentile), reflecting low current exploitation probability.
Incorrect authorization in Chrome's FileSystem API (CWE-863) allows a remote attacker to bypass system access restrictions through a crafted HTML page delivered via social engineering, achieving high-integrity impact on versions prior to 152.0.7977.65. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms network delivery with mandatory user interaction and no confidentiality exposure - only unauthorized writes or modification of normally restricted filesystem locations. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.38% (31st percentile), consistent with the social-engineering friction required. A vendor patch is available in stable channel 152.0.7977.65.
Chrome's browser Sync subsystem in versions prior to 152.0.7977.65 leaks sensitive user data due to improper validation of crafted inbound network traffic (CWE-20), enabling a remote attacker to read high-confidentiality synchronized content such as credentials or browsing history. The CVSS 6.5 vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable with no privilege requirement, but a user interaction step limits opportunistic mass exploitation. No public exploit code or CISA KEV listing exists; EPSS at 0.25% (16th percentile) corroborates low near-term exploitation probability, and the vendor-released patch (152.0.7977.65) is already available.
Incorrect authorization in Chrome's CustomTabs feature on Android (prior to 152.0.7977.65) allows a co-installed malicious application to bypass the browser's web origin policy. The flaw is classified CWE-863 and is limited to Android deployments where an attacker controls a separately installed app on the same device. A vendor patch was released in Chrome 152.0.7977.65; no public exploit code or CISA KEV listing exists, and EPSS sits at 0.14% (3rd percentile), indicating minimal observed exploitation pressure.
Sensitive information disclosure via the QUIC protocol stack in Google Chrome affects all versions prior to 152.0.7977.65, exploitable by remote unauthenticated attackers through a crafted HTML page. When a victim navigates to an attacker-controlled page, Chrome's QUIC (HTTP/3) implementation improperly exposes confidential data, with high confidentiality impact but no integrity or availability consequences. No public exploit has been identified at time of analysis; CISA SSVC rates exploitation status as none and EPSS is 0.31% (23rd percentile), indicating low near-term exploitation probability despite the medium-severity classification.
Observable discrepancy in Chrome's Autofill subsystem allows remote information disclosure via a crafted HTML page, affecting all desktop Chrome versions before 152.0.7977.65. The flaw (CWE-203) enables a network-reachable attacker to infer sensitive stored autofill data - such as addresses or payment fields - by measuring behavioral or timing differences triggered by form elements on a malicious page. Google has issued a patch in stable channel version 152.0.7977.65; no public exploit code exists and no CISA KEV listing has been recorded at time of analysis.
Cross-origin data exposure via the GPU subsystem in Google Chrome prior to 152.0.7977.65 allows a remote, unauthenticated attacker to read data from other web origins by luring a user to a crafted HTML page. The vulnerability resides in Chrome's GPU rendering path and violates the browser's same-origin policy, potentially exposing session tokens, rendered content, or other sensitive cross-origin data. No public exploit code or CISA KEV listing has been identified, and the EPSS score of 0.22% (13th percentile) reflects low current exploitation probability.
Incorrect authorization in the Chrome Extensions subsystem (CWE-863) allows a remote attacker who has already compromised the renderer process to bypass the web origin policy by delivering a crafted HTML page, affecting all Chrome desktop versions prior to 152.0.7977.65. Chromium rated this High severity despite the NVD CVSS base score of 4.3, because the same-origin policy bypass has meaningful privacy implications even though it requires a pre-compromised renderer as a prerequisite. No public exploit code has been identified and EPSS stands at 0.34% (26th percentile), consistent with no active exploitation confirmed at time of analysis.
Race condition in Google Chrome's Autofill subsystem (versions prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to bypass the browser's same-origin policy via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer exploit, making it a chained-attack component rather than a standalone threat. No public exploit code has been identified, and EPSS at 0.31% (24th percentile) reflects low opportunistic exploitation probability with no CISA KEV listing.
Incorrect authorization in Google Chrome's Extensions subsystem (all versions before 152.0.7977.65) allows an attacker who has already compromised the renderer process to bypass the web origin policy and reach privileged browser pages via a crafted HTML page. This is a chained, second-stage vulnerability - a prior renderer compromise is required - substantially narrowing the realistic attacker pool despite the network-accessible vector. No active exploitation is confirmed (not listed in CISA KEV), and the EPSS probability of 0.24% at the 15th percentile is consistent with this chained attack profile.
Uninitialized memory in Chrome's ANGLE graphics abstraction layer, across all desktop platforms prior to version 152.0.7977.65, enables remote attackers to read cross-origin data by delivering a crafted HTML page to a victim user. The flaw breaks the browser's same-origin policy through the graphics pipeline rather than through JavaScript or DOM manipulation. No public exploit or CISA KEV listing exists; EPSS of 0.24% at the 15th percentile reflects low current exploitation pressure.
Cross-origin information leak in Google Chrome's Paint rendering component (versions prior to 152.0.7977.65) enables remote attackers to bypass the web origin policy by delivering a crafted HTML page. The vulnerability is confined to the confidentiality dimension - no integrity or availability impact - and requires user interaction (visiting the attacker-controlled page) to trigger. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.33% places it in the 25th percentile, indicating low exploitation probability in the near term.
Cross-origin pixel data leakage in the Canvas API of Google Chrome prior to 152.0.7977.65 enables remote attackers to bypass the web same-origin policy by enticing a victim to visit a crafted HTML page. The flaw is classified High severity by the Chromium team and Medium (CVSS 4.3) by NVD, reflecting limited confidentiality impact with no integrity or availability consequences. No public exploit code or CISA KEV listing is identified at time of analysis, and EPSS at 0.33% indicates very low observed exploitation probability.
Incorrect authorization in Google Chrome's Transactions Platform (versions prior to 152.0.7977.65) permits a remote attacker who has already achieved renderer process compromise to bypass the browser's web origin policy via a crafted HTML page. The flaw is classified CWE-863 and carries a vendor severity of High, though the CVSS base score of 4.3 reflects the limited confidentiality-only impact and required user interaction. No public exploit code or CISA KEV listing has been identified at time of analysis, and the EPSS score of 0.24% (15th percentile) indicates low observed exploitation probability.
Race condition in Google Chrome for Android's WebAppInstalls component allows a remote attacker, through social engineering, to bypass web origin policy by exploiting a co-installed application on the same device. All Chrome for Android versions prior to 152.0.7977.65 are affected. The impact is limited to a partial confidentiality breach via cross-origin data access; no integrity or availability impact has been identified. No public exploit code exists and EPSS probability sits at 0.20% (10th percentile), indicating very low near-term exploitation likelihood despite Chromium's internal 'High' severity rating.
Cross-origin data leakage in Google Chrome's ANGLE graphics layer (versions prior to 152.0.7977.65) allows an unauthenticated remote attacker to read limited data across origin boundaries by inducing a victim to visit a crafted HTML page. The root cause is an uninitialized resource (CWE-908) in ANGLE, Chrome's graphics abstraction engine, which can expose residual GPU buffer contents from other origins. No public exploit identified at time of analysis; EPSS is low at 0.40% (33rd percentile), and the vulnerability is not listed in CISA KEV.
Information disclosure in Google Chrome's Autofill component on Android (prior to 152.0.7977.65) enables a remote attacker to extract sensitive user data - likely form-fill credentials or PII - by luring a victim to a specially crafted HTML page. The vulnerability stems from CWE-20 improper input validation in the Autofill subsystem, which fails to sanitize attacker-controlled HTML before processing it. No public exploit code or CISA KEV listing is present at time of analysis; EPSS sits at the 13th percentile, indicating low current exploitation momentum despite the high confidentiality impact.
Incorrect authorization in the Paint component of Google Chrome before version 152.0.7977.65 enables remote unauthenticated attackers to potentially bypass the Same-Origin Policy via a crafted HTML page, resulting in limited cross-origin data exposure. Exploitation requires user interaction - the victim must navigate to the attacker-controlled page - and impact is confined to partial confidentiality loss with no integrity or availability effect. No public exploit code has been identified at time of analysis and the low EPSS score of 0.24% (15th percentile) corroborates low observed exploitation activity; a vendor patch was released in the Chrome 152 stable channel.
Missing authorization in Google Chrome's Passwords component prior to version 152.0.7977.65 allows a remote attacker, who has already compromised the renderer process, to bypass web origin policy and access stored password data for other origins via a crafted HTML page combined with social engineering. The attack requires two chained prerequisites - renderer compromise and user interaction - which significantly constrains real-world exploitability despite the network-facing attack vector. No active exploitation (KEV) or public proof-of-concept has been identified; EPSS sits at a very low 0.24% (15th percentile). A vendor patch is available.
Unchecked return value in Nokogiri's CRuby extension (versions 1.5.1 through 1.19.0) causes the `canonicalize` method to silently return an empty string on XML canonicalization failure instead of raising an exception. This silent failure propagates incorrectly to downstream SAML libraries, which have been demonstrated in practice to accept the malformed output as a valid canonicalized document, enabling signature validation bypass. The JRuby implementation is not affected; exploitation has been confirmed as demonstrated by a HackerOne researcher but is not listed in CISA KEV.
Heap memory leaks in Nokogiri's XSLT transform method (versions before 1.19.3) enable gradual denial of service against long-running Ruby applications that pass attacker-controlled input to `Nokogiri::XSLT::Stylesheet#transform` parameters containing null bytes. Each null-byte-bearing call leaks approximately 24-32 bytes of heap memory; meaningful service degradation requires sustained, high-rate malicious traffic against the specific code path. No public exploit has been identified at time of analysis, and the vulnerability is absent from CISA KEV. Notably, the VulnCheck-reported CVSS 4.0 score of 6.9 is higher than the Nokogiri maintainers' own assessment of CVSS 5.3 Moderate, reflecting scoring convention differences rather than disagreement on impact.
Denial of service in GNU wget's FTP OPIE/S-KEY authentication handler allows a malicious or intercepted FTP server to cause wget to perform approximately 2.1 billion MD5 computations by supplying a crafted sequence number near INT_MAX in the OPIE challenge line. All versions of GNU wget with OPIE/S-KEY FTP authentication support are affected per CPE cpe:2.3:a:gnu:wget:*:*:*:*:*:*:*:*. The --timeout option provides no mitigation because it governs network I/O exclusively, not CPU-bound computation. No public exploit identified at time of analysis; a fix is confirmed via upstream GitLab commit.
Stack buffer overflow in file-roller's archive extraction path causes denial of service when a victim opens or extracts a crafted 7z or RAR archive containing an excessively long file path entry. The unbounded string copy in the progress-line parsing routine overwrites a fixed-size stack buffer, crashing the application with no confidentiality or integrity impact. No public exploit code or CISA KEV listing has been identified at time of analysis, and exploitation is gated entirely on user interaction with a malicious archive.
Denial of service in OpenEXR 3.4.0 through 3.4.12 allows any application calling exr_start_read() on untrusted input to be unconditionally aborted by a crafted HTJ2K-compressed EXR file containing a QCD marker with lower five bits set to zero. The flaw chains two weaknesses: OpenJPH's vendored assertion-based validation calls abort() instead of returning a recoverable error, and OpenEXR's error handling wraps only its internal HT header parser, leaving downstream codestream construction calls entirely unprotected. No public exploit or active exploitation (CISA KEV) has been identified, but the trivial triggering condition and prevalence of OpenEXR in automated rendering pipelines make this a meaningful denial-of-service risk for media production infrastructure.
Uncontrolled resource consumption in Mailpit's thumbnail generation endpoint allows unauthenticated network clients to exhaust server memory and CPU by submitting email attachments containing image decompression bombs. The affected code path in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation before performing any dimension, pixel-count, or memory validation, meaning a compact on-disk image declaring enormous pixel dimensions triggers full raster allocation prior to the 180×120 scaling step. No public exploit code has been identified and the vulnerability is absent from CISA KEV; the vendor-confirmed fix is Mailpit 1.30.4.
Uncontrolled memory allocation in Mailpit's SMTP command reader allows unauthenticated remote clients to exhaust server memory by sending oversized pre-DATA command lines. Versions prior to 1.30.4 use Go's unbounded `bufio.Reader.ReadString` in `internal/smtpd/smtpd.go`, which allocates the full attacker-controlled input before any syntax rejection or RFC 5321 line-length enforcement occurs. The same vulnerable code path handles AUTH continuation lines (LOGIN, PLAIN, CRAM-MD5), so concurrent oversized inputs compound memory pressure and can reduce service availability. No public exploit identified at time of analysis; a vendor-released patch is available in v1.30.4.
Terminal escape sequence injection in Ember's interactive TUI allows unauthenticated remote attackers to smuggle ANSI/OSC/CSI control bytes into an operator's terminal by embedding them in HTTP requests sent to the monitored Caddy server. Ember's ParseLogLine restores raw control bytes from Caddy's unicode-escaped JSON access log, and the render helpers fitCellLeft and fitCellRight pass them unfiltered to os.Stdout via bubbletea's View(), enabling clipboard hijacking (OSC 52), dashboard spoofing (CSI cursor/erase), and window-title manipulation (OSC 0/2). No CISA KEV listing or confirmed public exploit exists at time of analysis; the 'RCE' tag in the intelligence metadata conflicts with the advisory's explicit statement that this is not general-case RCE and should not drive incident response decisions without independent verification.
Path traversal in VictoriaMetrics vmrestore (prior to versions 1.122.25, 1.136.12, and 1.146.0) allows an attacker who controls or can modify a remote backup source - S3, GCS, Azure Blob Storage, or equivalent - to plant dot-dot sequences in object names, causing vmrestore to write restored files outside the configured -storageDataPath directory when an operator executes a restore operation. The CVSS Scope Changed metric (S:C) reflects that successful exploitation reaches beyond the vmrestore process boundary to the broader host filesystem, enabling potential overwrite of binaries, configuration, or credentials within the OS permissions of the process. Vendor-released patches are available across three maintained branches; no active exploitation has been identified at time of analysis.
Denial of service in FreeIPA's ipa-enrollment SLAPI plugin allows any authenticated LDAP client to crash the 389 Directory Server by sending a malformed extended operation. The flaw (CWE-476, null pointer dereference) is triggered by omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, causing the server to dereference a null pointer and crash. No public exploit or active exploitation has been identified at time of analysis; however, the low attack complexity and network-accessible vector make this a credible threat against any RHEL Identity Management deployment.
Denial of service in Wireshark's BUSMASTER file parser causes an abnormal process exit when processing a specially crafted BUSMASTER capture file, affecting Wireshark 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is a reachable assertion (CWE-617) that aborts the process rather than handling the malformed input gracefully. An attacker who can induce a user to open a crafted file can crash the Wireshark session; no public exploit has been identified at time of analysis, and the issue is not listed in CISA KEV.
Denial of service via crash in sharkd, Wireshark's daemon-mode component, affects versions 4.6.0-4.6.7 and 4.4.0-4.4.18. An unauthenticated remote attacker with high-complexity exploitation conditions and required user interaction can cause sharkd to crash by submitting crafted input, resulting in limited availability impact. No public exploit code and no CISA KEV listing have been identified at time of analysis; the low CVSS score of 3.1 reflects the constrained attack conditions.
Denial of service via a crash in sharkd, the Wireshark daemon component, affects the Wireshark Foundation's Wireshark versions 4.6.0-4.6.7 and 4.4.0-4.4.18. The root cause is CWE-825 (Expired Pointer Dereference), where a crafted network request or packet capture can trigger use of an expired pointer, crashing the sharkd process and producing a denial of service. No public exploit code has been identified at time of analysis and this vulnerability is not listed in CISA's KEV catalog; with a CVSS base score of 3.1, it represents low severity bounded by high attack complexity and a required user interaction.
Wireshark's Tektronix K12xx file parser crashes when processing a malformed capture file, causing a denial of service in versions 4.6.0-4.6.7 and 4.4.0-4.4.18. Rooted in CWE-126 (Buffer Over-read), the flaw allows an attacker to terminate Wireshark on a victim's system by inducing them to open a specially crafted K12xx-format file. No public exploit code and no active exploitation (CISA KEV) have been identified; the low CVSS score of 3.1 reflects the crash-only impact and mandatory user interaction.
Wireshark's dissection engine in versions 4.4.0-4.4.17 and 4.6.0-4.6.7 contains a heap-based buffer overflow (CWE-122) that crashes the application when processing a specially crafted malformed packet, yielding a denial-of-service outcome. Exploitation requires that an analyst actively opens a malicious capture file or performs live capture of adversary-controlled traffic, making this a user-interaction-dependent, high-complexity flaw with no code execution potential. No active exploitation has been confirmed by CISA KEV, no public proof-of-concept has been identified, and the CVSS 3.1 base score of 3.1 (Low) accurately reflects the constrained real-world impact.
The ERF file parser in Wireshark crashes on malformed input, enabling denial of service against analyst workstations running versions 4.4.0 through 4.4.17 and 4.6.0 through 4.6.7. Exploitation requires that a user open a specially crafted ERF capture file, and the CVSS vector (AV:N/AC:H/UI:R/A:L) reflects both the user-interaction dependency and the limited scope of impact - a crash of the Wireshark process only. No public exploit has been identified at time of analysis, and CISA KEV does not list this CVE.
Broken cryptography in Ceph's CephX authentication subsystem enables credential scope escalation and plaintext inference for any network-adjacent attacker holding a compromised Ceph account. CephX employed AES-CBC with a hardcoded initialization vector and no message authentication code, making encrypted authentication traffic both deterministic (identical plaintexts yield identical ciphertexts) and malleable (bit-flip attacks alter decrypted credential payloads undetected). Fixed in Ceph Tentacle 20.2.4 and Squid 19.2.6 by replacing the scheme with AES-256-CTS-HMAC-SHA384-192; no public exploit has been identified at time of analysis.
Out-of-bounds read in FreeRDP's planar RLE bitmap decoder allows a malicious RDP server to crash connecting clients and potentially disclose adjacent heap or stack memory. The flaw exists in planar_decompress_plane_rle and planar_decompress_plane_rle_only within libfreerdp/codec/planar.c across all FreeRDP releases prior to 3.29.0. An attacker operating or controlling an RDP server can exploit this by sending a specially truncated planar bitmap or surface update whose RLE control byte claims more raw bytes than the buffer contains, triggering the decoder to read beyond the allocated source buffer. No public exploit code or CISA KEV listing has been identified at time of analysis.
Out-of-bounds read in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) exposes any deployment using FFmpeg to mux AV1 video over RTP to memory disclosure and process crash via a crafted input. All FFmpeg versions prior to commit 983dae9 are affected across every platform. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV; however, VulnCheck has independently disclosed the issue, and a vendor-provided fix commit is available upstream.
Out-of-bounds memory access in FFmpeg's AV1 RTP packetizer (libavformat/rtpenc_av1.c) is triggered by an integer narrowing conversion that sign-flips large OBU size values on platforms where C `long` is 32 bits, most critically 64-bit Windows builds. The sign-flipped negative value passes a payload size bounds check, causing a subsequent oversized copy operation and out-of-bounds memory access that can crash the application or - with additional exploit primitives - be leveraged for memory corruption. All FFmpeg versions prior to upstream commit b4c199c are affected on vulnerable platforms; the upstream fix is committed but no specific tagged release has been independently confirmed. No public exploit has been identified at time of analysis.
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when processing archive members whose names temporarily escape and re-enter it, such as '../evil/../dest/sub/file'. The extraction filters ('tar' and 'data') validate the resolved path - which correctly resolves to inside the destination - but create intermediate directories from the raw member name as given, allowing filesystem pollution beyond the extraction boundary. File contents are never placed outside the destination, and no public exploit has been identified at time of analysis; the PSF advisory confirms the limited scope.
Heap overread in swtpm's SWTPM_NVRAM_CheckHeader() function allows local low-privileged users to crash the swtpm daemon and leak heap memory contents to system logs on Red Hat Enterprise Linux 8, 9, and 10. The root cause is a classic sizeof-pointer vs. sizeof-struct confusion: the guard compares buffer length against sizeof(bh) (pointer width, 8 bytes on 64-bit) rather than sizeof(*bh) (actual struct size), permitting undersized buffers to bypass validation and triggering a 2-byte heap overread on 64-bit systems or 6 bytes on 32-bit. No public exploit or CISA KEV listing has been identified at time of analysis.
Skia graphics library in Google Chrome prior to 151.0.7922.169 leaks information in a way that allows remote attackers to potentially bypass the web Same-Origin Policy via a specially crafted HTML page. Affected users on all desktop platforms running any Chrome version before 151.0.7922.169 are exposed to cross-origin data disclosure triggered by visiting a malicious page. No public exploit code or CISA KEV listing has been identified at time of analysis; a vendor-released patch is available.
Incorrect reference resolution in the Core component of Google Chrome on Android exposes sensitive information to remote attackers who can socially engineer users into visiting a malicious HTML page. Affected versions are all Chrome for Android builds prior to 151.0.7922.169. Exploitation requires user interaction but no authentication, and the vulnerability is platform-specific to Android. No public exploit code and no CISA KEV listing have been identified at time of analysis; a vendor-released patch is available.
Site isolation bypass in Google Chrome prior to 151.0.7922.169 enables a renderer-compromised attacker to cross origin boundaries via a flawed CORS implementation, reading or modifying data from otherwise isolated sites. This is a chained exploitation scenario: it requires a preceding renderer compromise as a prerequisite, making it a sandbox-escape-class vulnerability rather than a standalone browser attack. No public exploit code or active exploitation has been identified at the time of analysis, and a vendor patch is available in the 151.0.7922.169 stable channel release.
Partial denial-of-service in Oracle Java SE's JSSE component allows unauthenticated remote attackers to degrade availability of applications using TLS APIs across a broad range of supported Java versions. Affected releases span Java SE 8 through 26, GraalVM for JDK 17 and 21, and GraalVM Enterprise Edition 21.3.19, making this a wide-blast-radius availability issue for the Java ecosystem. Exploitation is limited to availability impact only - no confidentiality or integrity compromise is possible - and no public exploit or active exploitation (CISA KEV) has been identified at time of analysis.
Unauthorized data exposure in Oracle Java SE's Networking component allows unauthenticated remote attackers via HTTP to access critical or all data accessible to the affected Java process, with a confirmed scope change that can impact systems and products beyond the JDK's own security boundary. Affected versions span a wide range across Oracle Java SE (8u501 through 26.0.2), Oracle GraalVM for JDK (17.0.20 and 21.0.12), and Oracle GraalVM Enterprise Edition (21.3.19), covering both server-side Java API consumers and client-side Java Web Start or sandboxed applet deployments. No public exploit code has been identified at time of analysis, and the vulnerability does not appear in the CISA Known Exploited Vulnerabilities catalog; however, the breadth of affected LTS versions and the ubiquity of Java in enterprise environments make patch prioritization appropriate.
Out-of-bounds memory read in BlueZ's AVRCP implementation allows a physically proximate attacker - within Bluetooth radio range - to crash the bluetoothd daemon and potentially leak heap memory contents by sending a malformed GetFolderItems response. The flaw resides in parse_media_element() and parse_media_folder(), which fail to validate packet length fields before reading. Exploitation requires the victim to interactively pair with the attacker-controlled malicious Bluetooth device. No public exploit code or CISA KEV listing has been identified at time of analysis.
Site isolation bypass in Firefox's Graphics: WebRender component allows a remote attacker to achieve limited cross-origin information disclosure and content manipulation by delivering a crafted webpage to a user (CWE-346, origin validation error). All Firefox releases prior to 154 and Firefox ESR releases prior to 153.1 are affected across all platforms. No public exploit code or active exploitation has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.
Clickjacking in Firefox for Android before version 154 allows remote unauthenticated attackers to overlay transparent or opaque UI frames over legitimate browser content, capturing user interactions intended for other elements. The CVSS vector (PR:N, UI:R, I:H) indicates no privileges are needed but a victim must interact with an attacker-controlled page, resulting in high-integrity impact through unintended user actions such as inadvertent permission grants or form submissions. No public exploit identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
JIT miscompilation in Firefox's SpiderMonkey JavaScript engine exposes sensitive memory to remote attackers via crafted web content. The CWE-843 (type confusion) root cause means the JIT compiler generates native code that accesses a JavaScript value as the wrong type, resulting in a high-confidentiality information disclosure. Vendor-released patches are available in Firefox 154, Firefox ESR 140.14, and Firefox ESR 153.1; no public exploit or CISA KEV listing has been identified at time of analysis.
Same-origin policy bypass in Firefox's ImageLib image rendering component allows remote attackers to read cross-origin data or perform unauthorized cross-origin writes against victims using unpatched browser versions. Affected releases span the main Firefox channel (prior to 154) and three ESR branches (prior to ESR 115.39, ESR 140.14, and ESR 153.1), placing a large share of the global Firefox install base at risk until patched. The CVSS 5.4 score reflects limited confidentiality and integrity impact with no authentication requirement on the attacker side, though no public exploit has been identified and this CVE is not listed in the CISA KEV catalog at the time of analysis.