Use After Free
Monthly
Use-after-free in Google Chrome's Script component before 156.0.8078.47 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and works against default browser configurations, but the code execution is contained by the Chrome sandbox, so host compromise would require chaining a separate sandbox-escape flaw. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Use-after-free in the Media component of Google Chrome for Android lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Only Android builds below 156.0.8078.47 are affected, and Google rates the flaw Low severity even though the CVSS 3.1 vector scores 8.8, because the resulting code execution stays confined to the sandbox and would require chaining with a separate sandbox-escape to impact the host device. No public exploit code has been identified at time of analysis, and a fixed build (156.0.8078.47) has been released by the vendor.
Use-after-free in Google Chrome's Extensions component (all builds prior to 156.0.8078.47) lets remote unauthenticated attackers run arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring only one click or a drive-by page visit. Rated CVSS 3.1 8.8 (High) with Chromium security severity Medium, the flaw's reach is bounded by sandbox confinement (Scope:Unchanged) - escaping to the host OS or user data requires chaining a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis; patched builds 156.0.8078.47 and later are not vulnerable.
Use-after-free in Google Chrome's WebProtect component affects builds prior to 156.0.8078.47 and lets an unauthenticated remote attacker execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The impact is confined to the sandboxed browser process unless a separate sandbox-escape flaw is chained, and user interaction is required. No public exploit identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's SiteIsolation component before 156.0.8078.47 allows unauthenticated remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) and does not by itself escape Chrome's sandbox, so host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit identified at time of analysis, but the vendor has released a fixed build and the issue is rated High severity.
Use-after-free in Google Chrome's FileSystem component allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution inside the renderer sandbox by convincing a victim to open a crafted HTML page in any Chrome build prior to 156.0.8078.47. User interaction (loading the malicious page) is the primary exploitation prerequisite, but no credentials or non-default configuration are needed, which is reflected in the CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Impact is contained by the sandbox boundary - absent a separate sandbox-escape chain the attacker does not obtain host-level code execution - and no public exploit code or confirmed active exploitation was identified at time of analysis; Google credits an internal Chrome security team address (chrome-cve-admin@google.com) as the reporter, and a vendor patch exists.
Use-after-free in the Passwords component of Google Chrome on Android before 156.0.8078.47 lets a remote attacker execute arbitrary code inside the browser sandbox by convincing a victim to load a crafted HTML page. The flaw is unauthenticated on the attacker's side but requires user interaction (the victim must open the malicious page) and is restricted to the Android build of Chrome; successful exploitation is confined to the renderer sandbox, so full device compromise requires an additional sandbox-escape primitive not covered by this CVE. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome for Android's PerformanceAPIs (versions prior to 156.0.8078.47) can let a remote attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N); no public exploit identified at time of analysis, and this CVE does not provide a sandbox escape. Risk signals conflict and must be weighed carefully: CVSS 8.8 with high confidentiality/integrity impact contrasts with Chromium's Low severity rating and the renderer-sandbox containment, while a vendor patch is available.
A use-after-free in Google Chrome's 'Actor' component allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. The flaw affects Chrome desktop builds prior to 156.0.8078.47 and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - network-reachable, low complexity, and requiring no authentication, but gated by user interaction since the victim must actively visit or load the attacker's page. Impact is explicitly bounded by Chrome's sandbox (Scope:Unchanged), so host-level compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at the time of analysis, and Google has released a fixed build.
Remote code execution confined to Chrome's renderer sandbox can be triggered in Google Chrome desktop builds prior to 156.0.8078.47 when a victim opens a crafted HTML page that drives a use-after-free in the Media component. Exploitation is unauthenticated over the network but requires user interaction (CVSS:3.1/PR:N/UI:R), and because code execution stays 'inside the sandbox' per the vendor description, host compromise requires chaining a separate sandbox escape - which is why Google rated the issue Chromium severity Low even though NVD scored it 8.8 while our own assessment lands at C:L/I:L/A:L. No public exploit code or CISA KEV listing was identified at time of analysis, and the flaw is addressed by the vendor's 156.0.8078.47 stable release.
Use-after-free in Google Chrome's Compositing component allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in a build prior to 156.0.8078.47. The issue is unauthenticated from the network perspective but requires user interaction (UI:R), and the independent assessment bounds impact to sandbox code execution because scope is Unchanged; host compromise would require chaining a separate sandbox escape. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Use-after-free in Google Chrome's WebAppInstalls component, affecting versions prior to 156.0.8078.47, lets an unauthenticated remote attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page; the CVSS vector requires user interaction (UI:R) and does not require privileges (PR:N). The 8.8 CVSS rating contrasts with Google's Low Chromium severity because the code execution is confined to the renderer sandbox and full host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the fixed build.
Use-after-free in Chrome's SiteIsolation component allows a remote attacker who convinces a victim to load a crafted HTML page to corrupt renderer memory and potentially execute arbitrary code at the privilege of the renderer process in any Chrome build prior to 156.0.8078.47. Unauthenticated attackers need only user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but the impact is scope-limited: because the flaw lives in sandboxed renderer code, host-level compromise requires chaining a separate sandbox-escape bug, which is why Google rates the issue only Chromium severity Medium despite the high base score. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis and the bug is not in CISA KEV, so risk is real but conditional on user browsing behavior rather than opportunistic scanning.
Use-after-free in the Toolbar component of Google Chrome for Android allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the Chrome sandbox when a victim loads a crafted HTML page. All Chrome builds on Android prior to 156.0.8078.47 are affected; the flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), a classic drive-by browser profile where the only prerequisite is that the user navigates to or renders attacker-controlled content. Google rates the issue Medium in its own Chromium severity scale, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available.
Use-after-free in Google Chrome's DevTools component (all versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the browser sandbox by convincing a victim to load a crafted HTML page that drives the vulnerable DevTools code path. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects low attack complexity and no privileges required, tempered only by the mandatory user interaction of visiting the attacker's page and by the fact that execution is confined to the renderer sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium security severity as Medium despite the high CVSS base score.
Use-after-free in Google Chrome's Media component on Windows (versions prior to 156.0.8078.47) allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so host-level compromise would require a separate sandbox-escape chain; Chromium rates the issue Low despite high CVSS impact metrics. A vendor patch is available, and no public exploit code was identified at time of analysis.
A use-after-free in the browser component of Google Chrome versions prior to 156.0.8078.47 permits a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R). No authentication or non-default configuration is needed, but the mandatory user interaction and the fact that code execution is confined 'inside the sandbox' are the key limiting factors - full host compromise would require chaining an additional sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis; Google credits the flaw as reported through its Chrome CVE administration process and has released a stable-channel fix.
Google Chrome for Android before 156.0.8078.47 contains a use-after-free in the Notifications component that permits a remote, unauthenticated attacker to execute arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires the user to visit and interact with attacker-controlled content (UI:R), and any resulting code execution stays inside the browser sandbox (S:U), so a separate sandbox-escape bug is needed for host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis; Google has released a vendor patch in the stable channel.
Use-after-free in Google Chrome's Input component before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no privileges, but code execution is confined to Chrome's sandbox, so a separate sandbox escape is needed for OS-level compromise. No public exploit identified at time of analysis, no confirmed active exploitation, and a vendor patch is available.
Use-after-free in Google Chrome's Chromoting (Chrome Remote Desktop) component allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page on builds prior to 156.0.8078.47. Exploitation is gated by mandatory user interaction (the victim must navigate to attacker-controlled content) and the resulting code execution is confined to the sandbox, which is why Chromium assigned the issue a Low security severity; our independent assessment likewise rates confidentiality, integrity and availability impact as Low rather than the 8.8 base score published in other feeds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no KEV listing applies.
A use-after-free in Chrome's Media component (CWE-416) lets a remote attacker who convinces a victim to open a crafted HTML page execute arbitrary code within the renderer sandbox on any Chrome build prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and default configurations are exposed, giving the flaw an 8.8 CVSS rating; Google rates Chromium security severity as Medium because the resulting code execution is confined to the sandbox, and reaching the host would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor has released a patched build.
Use-after-free in Google Chrome's WebUI layer allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47 on desktop and ChromeOS. Successful exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and the resulting code execution is confined to the renderer sandbox, so full host compromise would require chaining with a separate sandbox-escape flaw. Rated 8.8 (High by Chromium standards), the bug carries no public exploit code and no confirmed active exploitation (no CISA KEV entry) at time of analysis, and Google has shipped a fixed build.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page (UI:R). Although the CVSS 3.1 base score is 8.8 and tags include RCE and memory corruption, Google rates the Chromium issue Low because code execution is confined to the renderer sandbox and full device compromise would require chaining a separate sandbox escape. Patch to 156.0.8078.47 or later; no public exploit was identified at time of analysis, and no CISA KEV status was provided.
Use-after-free in Google Chrome's V8 JavaScript engine (versions prior to 156.0.8078.47) allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is rated CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting network reachability, low complexity, no privileges, and required user interaction; code execution is confined to the sandbox, so OS compromise would require an additional sandbox escape. A vendor-released patch is available as version 156.0.8078.47, and no public exploit has been identified at time of analysis.
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML page, triggering a use-after-free in the iOSWeb component. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting mandatory user interaction and code execution confined to the browser sandbox; no public exploit was identified at time of analysis. Google has released 156.0.8078.47 to correct the flaw.
Use-after-free in Google Chrome's Extensions component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so full host compromise would require a separate sandbox-escape vulnerability; the vendor rates this Chromium security severity Medium while the supplied CVSS score is 8.8. No public exploit identified at time of analysis.
A use-after-free in Chrome's Actor component affects versions prior to 156.0.8078.47, allowing remote code execution inside the browser sandbox when a victim loads a crafted HTML page. Exploitation is not zero-click: the CVSS vector (UI:R, PR:N) requires the target to navigate to or render attacker-controlled content in a default configuration, and no public exploit code or CISA KEV confirmation is available at time of analysis. Because the flaw yields code execution only within the sandbox, it must be chained with a separate sandbox escape to fully compromise the host.
Use-after-free in Google Chrome's Bookmarks component (all builds prior to 156.0.8078.47) allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated from the network side but requires user interaction - the victim must visit or render the malicious page - and the resulting code execution is confined to Chrome's renderer sandbox, so full OS compromise would require chaining a separate sandbox-escape flaw. Google rates the underlying Chromium issue as Low severity, and no public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 base score of 8.8 reflects the memory-corruption impact class rather than a demonstrated attack in the wild.
Use-after-free in Google Chrome's WebSockets implementation before 156.0.8078.47 enables remote code execution inside the renderer sandbox when a victim opens a crafted HTML page, requiring user interaction but no authentication. Google has released a vendor patch, and no public exploit or CISA KEV confirmation was identified at time of analysis. The raw 8.8 CVSS reflects high confidentiality, integrity, and availability impact within the renderer, but standalone host compromise would require chaining a separate sandbox-escape vulnerability, so the score overstates standalone impact even though the product makes this a high-priority patch-now issue.
Code execution inside the renderer sandbox is achievable in Google Chrome desktop builds prior to 156.0.8078.47 through a use-after-free in the Streaming component. A remote, unauthenticated attacker can trigger the flaw by convincing a victim to open a crafted HTML page, but the CVSS vector requires user interaction (UI:R) and the resulting code execution remains confined to the renderer sandbox, so a separate sandbox escape is needed to compromise the host. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the issue.
Use-after-free in Google Chrome's Media component allows remote code execution inside the renderer sandbox when a victim opens a crafted HTML page in versions prior to 156.0.8078.47. No authentication is required, but exploitation requires user interaction, and code execution is confined to the sandbox unless chained with a separate sandbox escape. Chrome 156.0.8078.47 fixes the issue; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and assessment signals are moderately consistent but incomplete.
Use-after-free in Google Chrome's Input handling prior to 156.0.8078.47 enables remote code execution inside the browser sandbox when a user opens a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N), but the assessed impact is contained to the renderer sandbox; full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released 156.0.8078.47 to address the flaw.
Use-after-free in Google Chrome's WebAppInstalls component allows a remote attacker who convinces a victim to open a crafted HTML page to corrupt heap memory and potentially execute arbitrary code inside the renderer sandbox, affecting Chrome builds prior to 156.0.8078.47 on Windows, macOS, and Linux. Exploitation is constrained by two factors: the attacker has no path to trigger the bug without user interaction (UI:R, the victim must navigate to the malicious page), and the resulting code execution is sandbox-confined, so standalone impact is limited to the renderer process unless chained with a separate sandbox-escape primitive - which is why our assessed vector (C:L/I:L/A:L) is materially lower than the 8.8 base score derived from the C:H/I:H/A:H vector. Signals conflict sharply and must be read together: Google rates the flaw Chromium security severity Low and has shipped a fix in 156.0.8078.47, while the NVD-style vector implies full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's WebAppInstalls component before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Google rates the issue Low, and the independent assessment emphasizes that the flaw does not escape the sandbox, which explains the sharp conflict with the 8.8 CVSS score. No public exploit identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the vendor fix.
Arbitrary code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 due to a use-after-free in the Turbolev component. A remote attacker can trigger it only when a victim opens a crafted HTML page (UI:R, PR:N), and the resulting code execution is confined to the sandbox, so full host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47 to address it.
Use-after-free in Google Chrome's Views component (desktop builds prior to 156.0.8078.47) can corrupt memory when a victim loads a crafted HTML page, potentially allowing arbitrary code execution inside the renderer sandbox. Exploitation is network-reachable, requires user interaction (UI:R), and needs no authentication or special configuration; Google rates the Chromium security severity as Low even though the CVSS 3.1 base score is 8.8, and host compromise would require chaining a separate sandbox escape. Vendor patching is available, and no public exploit identified at time of analysis.
Use-after-free in Google Chrome's Web Workers implementation before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads crafted HTML/JavaScript; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416), while Chromium itself rates the issue Low. The assessed impact is sandbox-confined, so system-level compromise would require chaining a separate sandbox escape, and exploitation requires user interaction plus a vulnerable pre-156.0.8078.47 build. No CISA KEV entry or public exploit is present in the supplied data, so the status is no public exploit identified at time of analysis; signals are mixed in a way that matters for prioritization because the numeric severity is high but the practical exploit path is constrained.
Use-after-free in Google Chrome's PerformanceAPIs - the Performance, PerformanceObserver and performance timing interfaces - allows a remote, unauthenticated attacker who gets a victim to load a crafted HTML page to potentially execute arbitrary code outside the browser sandbox on Chrome builds prior to 156.0.8078.47. The only prerequisite is that the user navigate to (or be redirected to) attacker-controlled content (UI:R, PR:N), and changed-scope scoring drives the CVSS to 9.6 - a number that must be read alongside Google's own Chromium severity rating of Medium and the assessment's caveat that the sandbox escape is described as potential rather than confirmed. Vendor patch is available; no public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Google Chrome on Windows before 156.0.8078.47 contains a use-after-free in CredentialProvider that can let a remote, unauthenticated attacker run arbitrary code inside the browser’s renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction and is contained by the sandbox, so host-level compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and the independently assessed impact is limited to low confidentiality, integrity, and availability effects within the sandbox.
Sandboxed code execution in Google Chrome versions prior to 156.0.8078.47 is possible through a use-after-free flaw in the WindowControlsOverlay component, which a remote, unauthenticated attacker can trigger by convincing a victim to open a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields arbitrary code execution, but strictly within the renderer sandbox - the attacker gains no direct access to the host operating system without chaining a separate sandbox-escape bug, which is why Google rates the issue only Medium in its own severity scheme. Google has shipped a vendor fix in Chrome 156.0.8078.47; no public exploit code or confirmed active exploitation was identified at time of analysis, and the attack is not drive-by - it requires deliberate user navigation to attacker-controlled content.
Use-after-free in Google Chrome's Workers implementation allows a remote, unauthenticated attacker to execute arbitrary code inside the browser's renderer sandbox if the victim loads a crafted HTML page. Only Chrome builds prior to 156.0.8078.47 are affected; exploitation requires user interaction (UI:R) and remains confined to the renderer sandbox, so host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released 156.0.8078.47 as the fix.
Use-after-free in Google Chrome's API layer allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in versions prior to 156.0.8078.47. CVSS 3.1 is 8.8 (High) with UI:R, while Chromium rates it Medium because code execution remains confined to the sandbox and host compromise requires a separate sandbox escape. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fix.
A use-after-free in Chrome's Animation component affects versions prior to 156.0.8078.47: a remote attacker can lure a victim into loading a crafted HTML page that triggers memory corruption and yields arbitrary code execution - but only inside the renderer sandbox, not on the host. The CVSS 8.8 reflects high confidentiality/integrity/availability impact to the sandboxed renderer, tempered by the required user interaction and the architectural containment; host compromise would require chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a patched stable build.
Use-after-free in Chrome's Input handling allows remote code execution inside the renderer sandbox when a user opens a crafted HTML page in any Chrome build prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and code execution is confined to the renderer sandbox, so host compromise requires chaining a separate sandbox escape; Google rates the flaw High severity. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix.
Eclipse ThreadX firmware built with Module Manager and loadable modules enabled contains a use-after-free in txm_module_object_deallocate: a module can request release of a kernel object control block by address, and the manager frees it even if the kernel still references it. The object remains on its created list and, for threads or timers, on scheduler/timer lists, so the byte pool can reallocate the same memory while the kernel still uses it. Exploitation requires local low-privilege code execution inside a loaded module (PR:L, AV:L) and is not remotely reachable in default builds; no public exploit code was identified at time of analysis.
Use-after-free in GIMP's XCF loader can crash the application and potentially allow arbitrary code execution when a user opens a crafted .xcf file that selects a path and then fails to load it. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 according to the provided CPE mappings, and exploitation is local and requires user interaction (CVSS 7.8, AV:L/UI:R/PR:N); no public exploit was identified at time of analysis. Because scope is unchanged, any code execution would run with the privileges of the user opening the file rather than automatically gaining root.
Opening a crafted XCF file in GIMP can trigger a use-after-free in the XCF loader's linked-channels handling, crashing the main GIMP process and potentially enabling code execution in the opening user's context. The defect affects GIMP installations that parse XCF files, with Red Hat tracking impact across RHEL 6 through RHEL 10 packages; exploitation requires local delivery and a victim to open the malicious image, and no public exploit code or CISA KEV entry is identified in the provided data.
Memory corruption in Pillow versions prior to 13.0.0 can crash the process when Image.transform() takes the fast Transform.EXTENT or pure scale-and-translate Transform.AFFINE path with default NEAREST resampling and a selective allocation failure occurs under memory pressure. The defect is a double free/use-after-free in ImagingScaleAffine: the output image allocation succeeds, the additional per-column lookup allocation fails, and the error path deletes image storage that later cleanup releases again (CWE-416). The assessed impact is availability-only with no confidentiality or integrity effect, exploitation depends on attacker-influenced transform sizes plus genuine memory pressure, and no public exploit identified at time of analysis.
A use-after-free in the Perl XS module Text::CSV_XS (versions 1.46 through 1.64) lets attacker-supplied CSV content crash the parsing process when an application combines three specific features: bind_columns(), the non-default skip_empty_rows option (or its 'eof' mode), and input containing an empty line. The defect drops a reference from the caller's bound scalar while it is still in use, so subsequent application code touches freed memory and typically aborts - the independent assessment scores this as availability-only impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the headline 9.8, because the vulnerable code path never runs under default configuration. EPSS is low at 0.19% (8th percentile), no public exploit code was identified at time of analysis, and no CISA KEV entry exists; a vendor patch is available in Text::CSV_XS 1.65.
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.
Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.
Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).
Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.
Use-after-free in curl's HTTP/2 client code (curl 8.12.0 through 8.22.0) can corrupt memory when a server answers an in-progress upload with an HTTP/2 RST_STREAM frame carrying the HTTP_1_1_REQUIRED or REFUSED_STREAM reason code, freeing the internal struct Curl_easy object while it is still referenced by the transfer state machine. The flaw is remote and requires no authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but exploitation is conditional: the victim must be uploading over a negotiated HTTP/2 connection to an endpoint the attacker controls or influences, and the RST_STREAM must land at the right point in the transfer lifecycle, which is why the assessed complexity is High. Publicly available exploit code exists (SSVC Exploitation: poc) and CISA's framework rates technical impact as total, yet there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.23% (12th percentile); a vendor patch is available. The same flaw affects libcurl and therefore every downstream application and distribution shipping an affected build.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.
Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.
In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
Use-after-free in Google Chrome's DOM implementation before 155.0.8059.79 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. The flaw affects desktop stable and extended-stable channels and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with exploitation limited by the requirement for user interaction and by the renderer sandbox preventing direct host compromise without a separate sandbox escape. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.
Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.
Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.
Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.
Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Use-after-free in Google Chrome's Media component before version 155.0.8059.79 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a user to open a crafted HTML page that drives the vulnerable media-parsing code path. Exploitation requires user interaction (the victim must navigate to or be redirected to attacker-controlled content), and the resulting code execution is confined to the sandbox, meaning host compromise would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, EPSS is low (0.21%, 11th percentile), and Google has released a fixed build, so risk is serious but not emergency-level; priority should follow normal rapid-patching timelines.
Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.
Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Local privilege escalation in Microsoft SQL Server allows an authorized, low-privileged principal with existing access to the database host to exploit a use-after-free memory condition (CWE-416) and run code in a more privileged security context. Affected builds span SQL Server 2019, 2022, and 2025 on versions below the fixed GDR and CU releases published with Microsoft's January 2026 update. Exploitation is constrained by the local attack vector (AV:L) and high attack complexity (AC:H), since the attacker must already be authenticated on the host and win a memory-reuse/timing race; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available.
Arbitrary code execution is possible in Adobe Substance 3D Stager 3.1.8 and earlier, where a use-after-free (CWE-416) is triggered while the application processes a crafted file. The CVSS v3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) shows no authentication is required, but the attacker must deliver the malicious file locally and convince the victim to open it, after which code runs only with the privileges of the current user. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the practical risk is driven by social-engineering delivery and by the fact that a crash (denial of service) is also achievable from the same corrupting file.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.
Use-after-free in Google Chrome's Script component before 156.0.8078.47 allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and works against default browser configurations, but the code execution is contained by the Chrome sandbox, so host compromise would require chaining a separate sandbox-escape flaw. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Use-after-free in the Media component of Google Chrome for Android lets a remote, unauthenticated attacker execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Only Android builds below 156.0.8078.47 are affected, and Google rates the flaw Low severity even though the CVSS 3.1 vector scores 8.8, because the resulting code execution stays confined to the sandbox and would require chaining with a separate sandbox-escape to impact the host device. No public exploit code has been identified at time of analysis, and a fixed build (156.0.8078.47) has been released by the vendor.
Use-after-free in Google Chrome's Extensions component (all builds prior to 156.0.8078.47) lets remote unauthenticated attackers run arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring only one click or a drive-by page visit. Rated CVSS 3.1 8.8 (High) with Chromium security severity Medium, the flaw's reach is bounded by sandbox confinement (Scope:Unchanged) - escaping to the host OS or user data requires chaining a separate sandbox-escape bug. No public exploit code or confirmed active exploitation was identified at time of analysis; patched builds 156.0.8078.47 and later are not vulnerable.
Use-after-free in Google Chrome's WebProtect component affects builds prior to 156.0.8078.47 and lets an unauthenticated remote attacker execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page. The impact is confined to the sandboxed browser process unless a separate sandbox-escape flaw is chained, and user interaction is required. No public exploit identified at time of analysis, and Google has released a fixed build.
Use-after-free in Google Chrome's SiteIsolation component before 156.0.8078.47 allows unauthenticated remote attackers to trigger memory corruption and execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. The attack requires user interaction (UI:R) and does not by itself escape Chrome's sandbox, so host compromise would require chaining an additional sandbox-escape vulnerability. No public exploit identified at time of analysis, but the vendor has released a fixed build and the issue is rated High severity.
Use-after-free in Google Chrome's FileSystem component allows a remote, unauthenticated attacker to potentially achieve arbitrary code execution inside the renderer sandbox by convincing a victim to open a crafted HTML page in any Chrome build prior to 156.0.8078.47. User interaction (loading the malicious page) is the primary exploitation prerequisite, but no credentials or non-default configuration are needed, which is reflected in the CVSS:3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Impact is contained by the sandbox boundary - absent a separate sandbox-escape chain the attacker does not obtain host-level code execution - and no public exploit code or confirmed active exploitation was identified at time of analysis; Google credits an internal Chrome security team address (chrome-cve-admin@google.com) as the reporter, and a vendor patch exists.
Use-after-free in the Passwords component of Google Chrome on Android before 156.0.8078.47 lets a remote attacker execute arbitrary code inside the browser sandbox by convincing a victim to load a crafted HTML page. The flaw is unauthenticated on the attacker's side but requires user interaction (the victim must open the malicious page) and is restricted to the Android build of Chrome; successful exploitation is confined to the renderer sandbox, so full device compromise requires an additional sandbox-escape primitive not covered by this CVE. Vendor patches are available, and no public exploit code or active exploitation has been identified at time of analysis.
Use-after-free in Google Chrome for Android's PerformanceAPIs (versions prior to 156.0.8078.47) can let a remote attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N); no public exploit identified at time of analysis, and this CVE does not provide a sandbox escape. Risk signals conflict and must be weighed carefully: CVSS 8.8 with high confidentiality/integrity impact contrasts with Chromium's Low severity rating and the renderer-sandbox containment, while a vendor patch is available.
A use-after-free in Google Chrome's 'Actor' component allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a victim to load a crafted HTML page. The flaw affects Chrome desktop builds prior to 156.0.8078.47 and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) - network-reachable, low complexity, and requiring no authentication, but gated by user interaction since the victim must actively visit or load the attacker's page. Impact is explicitly bounded by Chrome's sandbox (Scope:Unchanged), so host-level compromise would require chaining a separate sandbox escape; no public exploit code or confirmed active exploitation was identified at the time of analysis, and Google has released a fixed build.
Remote code execution confined to Chrome's renderer sandbox can be triggered in Google Chrome desktop builds prior to 156.0.8078.47 when a victim opens a crafted HTML page that drives a use-after-free in the Media component. Exploitation is unauthenticated over the network but requires user interaction (CVSS:3.1/PR:N/UI:R), and because code execution stays 'inside the sandbox' per the vendor description, host compromise requires chaining a separate sandbox escape - which is why Google rated the issue Chromium severity Low even though NVD scored it 8.8 while our own assessment lands at C:L/I:L/A:L. No public exploit code or CISA KEV listing was identified at time of analysis, and the flaw is addressed by the vendor's 156.0.8078.47 stable release.
Use-after-free in Google Chrome's Compositing component allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in a build prior to 156.0.8078.47. The issue is unauthenticated from the network perspective but requires user interaction (UI:R), and the independent assessment bounds impact to sandbox code execution because scope is Unchanged; host compromise would require chaining a separate sandbox escape. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis.
Use-after-free in Google Chrome's WebAppInstalls component, affecting versions prior to 156.0.8078.47, lets an unauthenticated remote attacker execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page; the CVSS vector requires user interaction (UI:R) and does not require privileges (PR:N). The 8.8 CVSS rating contrasts with Google's Low Chromium severity because the code execution is confined to the renderer sandbox and full host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the fixed build.
Use-after-free in Chrome's SiteIsolation component allows a remote attacker who convinces a victim to load a crafted HTML page to corrupt renderer memory and potentially execute arbitrary code at the privilege of the renderer process in any Chrome build prior to 156.0.8078.47. Unauthenticated attackers need only user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8), but the impact is scope-limited: because the flaw lives in sandboxed renderer code, host-level compromise requires chaining a separate sandbox-escape bug, which is why Google rates the issue only Chromium severity Medium despite the high base score. Vendor-released patch: 156.0.8078.47; no public exploit identified at time of analysis and the bug is not in CISA KEV, so risk is real but conditional on user browsing behavior rather than opportunistic scanning.
Use-after-free in the Toolbar component of Google Chrome for Android allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the Chrome sandbox when a victim loads a crafted HTML page. All Chrome builds on Android prior to 156.0.8078.47 are affected; the flaw scores CVSS 3.1 base 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), a classic drive-by browser profile where the only prerequisite is that the user navigates to or renders attacker-controlled content. Google rates the issue Medium in its own Chromium severity scale, and no public exploit code or confirmed active exploitation was identified at time of analysis; a vendor patch is available.
Use-after-free in Google Chrome's DevTools component (all versions prior to 156.0.8078.47) allows a remote, unauthenticated attacker to achieve arbitrary code execution inside the browser sandbox by convincing a victim to load a crafted HTML page that drives the vulnerable DevTools code path. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, 8.8) reflects low attack complexity and no privileges required, tempered only by the mandatory user interaction of visiting the attacker's page and by the fact that execution is confined to the renderer sandbox - full host compromise would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google rates the underlying Chromium security severity as Medium despite the high CVSS base score.
Use-after-free in Google Chrome's Media component on Windows (versions prior to 156.0.8078.47) allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so host-level compromise would require a separate sandbox-escape chain; Chromium rates the issue Low despite high CVSS impact metrics. A vendor patch is available, and no public exploit code was identified at time of analysis.
A use-after-free in the browser component of Google Chrome versions prior to 156.0.8078.47 permits a remote attacker to execute arbitrary code inside the renderer sandbox by convincing a victim to load a crafted HTML page (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R). No authentication or non-default configuration is needed, but the mandatory user interaction and the fact that code execution is confined 'inside the sandbox' are the key limiting factors - full host compromise would require chaining an additional sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis; Google credits the flaw as reported through its Chrome CVE administration process and has released a stable-channel fix.
Google Chrome for Android before 156.0.8078.47 contains a use-after-free in the Notifications component that permits a remote, unauthenticated attacker to execute arbitrary code within the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires the user to visit and interact with attacker-controlled content (UI:R), and any resulting code execution stays inside the browser sandbox (S:U), so a separate sandbox-escape bug is needed for host compromise. No public exploit code or confirmed active exploitation was identified at time of analysis; Google has released a vendor patch in the stable channel.
Use-after-free in Google Chrome's Input component before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and no privileges, but code execution is confined to Chrome's sandbox, so a separate sandbox escape is needed for OS-level compromise. No public exploit identified at time of analysis, no confirmed active exploitation, and a vendor patch is available.
Use-after-free in Google Chrome's Chromoting (Chrome Remote Desktop) component allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim renders a crafted HTML page on builds prior to 156.0.8078.47. Exploitation is gated by mandatory user interaction (the victim must navigate to attacker-controlled content) and the resulting code execution is confined to the sandbox, which is why Chromium assigned the issue a Low security severity; our independent assessment likewise rates confidentiality, integrity and availability impact as Low rather than the 8.8 base score published in other feeds. No public exploit code or confirmed active exploitation was identified at time of analysis, and no KEV listing applies.
A use-after-free in Chrome's Media component (CWE-416) lets a remote attacker who convinces a victim to open a crafted HTML page execute arbitrary code within the renderer sandbox on any Chrome build prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and default configurations are exposed, giving the flaw an 8.8 CVSS rating; Google rates Chromium security severity as Medium because the resulting code execution is confined to the sandbox, and reaching the host would require chaining a separate sandbox escape. No public exploit code or confirmed active exploitation was identified at time of analysis, though the vendor has released a patched build.
Use-after-free in Google Chrome's WebUI layer allows a remote attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page, affecting all Chrome builds prior to 156.0.8078.47 on desktop and ChromeOS. Successful exploitation requires user interaction (UI:R) but no authentication or privileges (PR:N), and the resulting code execution is confined to the renderer sandbox, so full host compromise would require chaining with a separate sandbox-escape flaw. Rated 8.8 (High by Chromium standards), the bug carries no public exploit code and no confirmed active exploitation (no CISA KEV entry) at time of analysis, and Google has shipped a fixed build.
Use-after-free in Google Chrome for Android before 156.0.8078.47 can allow a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim opens a crafted HTML page (UI:R). Although the CVSS 3.1 base score is 8.8 and tags include RCE and memory corruption, Google rates the Chromium issue Low because code execution is confined to the renderer sandbox and full device compromise would require chaining a separate sandbox escape. Patch to 156.0.8078.47 or later; no public exploit was identified at time of analysis, and no CISA KEV status was provided.
Use-after-free in Google Chrome's V8 JavaScript engine (versions prior to 156.0.8078.47) allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim visits a crafted HTML page. The flaw is rated CVSS 3.1 8.8 (High) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, reflecting network reachability, low complexity, no privileges, and required user interaction; code execution is confined to the sandbox, so OS compromise would require an additional sandbox escape. A vendor-released patch is available as version 156.0.8078.47, and no public exploit has been identified at time of analysis.
Remote code execution in Google Chrome for iOS prior to 156.0.8078.47 is possible when a victim opens a crafted HTML page, triggering a use-after-free in the iOSWeb component. The CVSS 3.1 score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), reflecting mandatory user interaction and code execution confined to the browser sandbox; no public exploit was identified at time of analysis. Google has released 156.0.8078.47 to correct the flaw.
Use-after-free in Google Chrome's Extensions component before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Exploitation requires user interaction and is confined to the sandbox, so full host compromise would require a separate sandbox-escape vulnerability; the vendor rates this Chromium security severity Medium while the supplied CVSS score is 8.8. No public exploit identified at time of analysis.
A use-after-free in Chrome's Actor component affects versions prior to 156.0.8078.47, allowing remote code execution inside the browser sandbox when a victim loads a crafted HTML page. Exploitation is not zero-click: the CVSS vector (UI:R, PR:N) requires the target to navigate to or render attacker-controlled content in a default configuration, and no public exploit code or CISA KEV confirmation is available at time of analysis. Because the flaw yields code execution only within the sandbox, it must be chained with a separate sandbox escape to fully compromise the host.
Use-after-free in Google Chrome's Bookmarks component (all builds prior to 156.0.8078.47) allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Exploitation is unauthenticated from the network side but requires user interaction - the victim must visit or render the malicious page - and the resulting code execution is confined to Chrome's renderer sandbox, so full OS compromise would require chaining a separate sandbox-escape flaw. Google rates the underlying Chromium issue as Low severity, and no public exploit code or active exploitation has been identified at time of analysis; the CVSS 3.1 base score of 8.8 reflects the memory-corruption impact class rather than a demonstrated attack in the wild.
Use-after-free in Google Chrome's WebSockets implementation before 156.0.8078.47 enables remote code execution inside the renderer sandbox when a victim opens a crafted HTML page, requiring user interaction but no authentication. Google has released a vendor patch, and no public exploit or CISA KEV confirmation was identified at time of analysis. The raw 8.8 CVSS reflects high confidentiality, integrity, and availability impact within the renderer, but standalone host compromise would require chaining a separate sandbox-escape vulnerability, so the score overstates standalone impact even though the product makes this a high-priority patch-now issue.
Code execution inside the renderer sandbox is achievable in Google Chrome desktop builds prior to 156.0.8078.47 through a use-after-free in the Streaming component. A remote, unauthenticated attacker can trigger the flaw by convincing a victim to open a crafted HTML page, but the CVSS vector requires user interaction (UI:R) and the resulting code execution remains confined to the renderer sandbox, so a separate sandbox escape is needed to compromise the host. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 to address the issue.
Use-after-free in Google Chrome's Media component allows remote code execution inside the renderer sandbox when a victim opens a crafted HTML page in versions prior to 156.0.8078.47. No authentication is required, but exploitation requires user interaction, and code execution is confined to the sandbox unless chained with a separate sandbox escape. Chrome 156.0.8078.47 fixes the issue; no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis, and assessment signals are moderately consistent but incomplete.
Use-after-free in Google Chrome's Input handling prior to 156.0.8078.47 enables remote code execution inside the browser sandbox when a user opens a crafted HTML page. Exploitation requires user interaction (UI:R) and no authentication (PR:N), but the assessed impact is contained to the renderer sandbox; full host compromise would require chaining a separate sandbox-escape vulnerability. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released 156.0.8078.47 to address the flaw.
Use-after-free in Google Chrome's WebAppInstalls component allows a remote attacker who convinces a victim to open a crafted HTML page to corrupt heap memory and potentially execute arbitrary code inside the renderer sandbox, affecting Chrome builds prior to 156.0.8078.47 on Windows, macOS, and Linux. Exploitation is constrained by two factors: the attacker has no path to trigger the bug without user interaction (UI:R, the victim must navigate to the malicious page), and the resulting code execution is sandbox-confined, so standalone impact is limited to the renderer process unless chained with a separate sandbox-escape primitive - which is why our assessed vector (C:L/I:L/A:L) is materially lower than the 8.8 base score derived from the C:H/I:H/A:H vector. Signals conflict sharply and must be read together: Google rates the flaw Chromium security severity Low and has shipped a fix in 156.0.8078.47, while the NVD-style vector implies full confidentiality, integrity, and availability loss; no public exploit code or confirmed active exploitation was identified at time of analysis.
Use-after-free in Google Chrome's WebAppInstalls component before 156.0.8078.47 allows a remote, unauthenticated attacker to execute arbitrary code inside the browser sandbox when a victim loads a crafted HTML page. Google rates the issue Low, and the independent assessment emphasizes that the flaw does not escape the sandbox, which explains the sharp conflict with the 8.8 CVSS score. No public exploit identified at time of analysis, and Google has released Chrome 156.0.8078.47 as the vendor fix.
Arbitrary code execution inside the Chrome renderer sandbox is possible in Google Chrome versions prior to 156.0.8078.47 due to a use-after-free in the Turbolev component. A remote attacker can trigger it only when a victim opens a crafted HTML page (UI:R, PR:N), and the resulting code execution is confined to the sandbox, so full host compromise would require a separate sandbox escape. No public exploit was identified at time of analysis, and Google has released Chrome 156.0.8078.47 to address it.
Use-after-free in Google Chrome's Views component (desktop builds prior to 156.0.8078.47) can corrupt memory when a victim loads a crafted HTML page, potentially allowing arbitrary code execution inside the renderer sandbox. Exploitation is network-reachable, requires user interaction (UI:R), and needs no authentication or special configuration; Google rates the Chromium security severity as Low even though the CVSS 3.1 base score is 8.8, and host compromise would require chaining a separate sandbox escape. Vendor patching is available, and no public exploit identified at time of analysis.
Use-after-free in Google Chrome's Web Workers implementation before 156.0.8078.47 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim loads crafted HTML/JavaScript; the CVSS 3.1 base score is 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416), while Chromium itself rates the issue Low. The assessed impact is sandbox-confined, so system-level compromise would require chaining a separate sandbox escape, and exploitation requires user interaction plus a vulnerable pre-156.0.8078.47 build. No CISA KEV entry or public exploit is present in the supplied data, so the status is no public exploit identified at time of analysis; signals are mixed in a way that matters for prioritization because the numeric severity is high but the practical exploit path is constrained.
Use-after-free in Google Chrome's PerformanceAPIs - the Performance, PerformanceObserver and performance timing interfaces - allows a remote, unauthenticated attacker who gets a victim to load a crafted HTML page to potentially execute arbitrary code outside the browser sandbox on Chrome builds prior to 156.0.8078.47. The only prerequisite is that the user navigate to (or be redirected to) attacker-controlled content (UI:R, PR:N), and changed-scope scoring drives the CVSS to 9.6 - a number that must be read alongside Google's own Chromium severity rating of Medium and the assessment's caveat that the sandbox escape is described as potential rather than confirmed. Vendor patch is available; no public exploit was identified at time of analysis, and there is no CISA KEV confirmation of active exploitation.
Google Chrome on Windows before 156.0.8078.47 contains a use-after-free in CredentialProvider that can let a remote, unauthenticated attacker run arbitrary code inside the browser’s renderer sandbox when a victim opens a crafted HTML page. Exploitation requires user interaction and is contained by the sandbox, so host-level compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and the independently assessed impact is limited to low confidentiality, integrity, and availability effects within the sandbox.
Sandboxed code execution in Google Chrome versions prior to 156.0.8078.47 is possible through a use-after-free flaw in the WindowControlsOverlay component, which a remote, unauthenticated attacker can trigger by convincing a victim to open a crafted HTML page (CVSS 3.1: 8.8, AV:N/AC:L/PR:N/UI:R). Successful exploitation yields arbitrary code execution, but strictly within the renderer sandbox - the attacker gains no direct access to the host operating system without chaining a separate sandbox-escape bug, which is why Google rates the issue only Medium in its own severity scheme. Google has shipped a vendor fix in Chrome 156.0.8078.47; no public exploit code or confirmed active exploitation was identified at time of analysis, and the attack is not drive-by - it requires deliberate user navigation to attacker-controlled content.
Use-after-free in Google Chrome's Workers implementation allows a remote, unauthenticated attacker to execute arbitrary code inside the browser's renderer sandbox if the victim loads a crafted HTML page. Only Chrome builds prior to 156.0.8078.47 are affected; exploitation requires user interaction (UI:R) and remains confined to the renderer sandbox, so host compromise would require a separate sandbox escape. No public exploit code or CISA KEV entry was identified at time of analysis, and the vendor has released 156.0.8078.47 as the fix.
Use-after-free in Google Chrome's API layer allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in versions prior to 156.0.8078.47. CVSS 3.1 is 8.8 (High) with UI:R, while Chromium rates it Medium because code execution remains confined to the sandbox and host compromise requires a separate sandbox escape. No public exploit was identified at time of analysis, and the vendor has released Chrome 156.0.8078.47 as the fix.
A use-after-free in Chrome's Animation component affects versions prior to 156.0.8078.47: a remote attacker can lure a victim into loading a crafted HTML page that triggers memory corruption and yields arbitrary code execution - but only inside the renderer sandbox, not on the host. The CVSS 8.8 reflects high confidentiality/integrity/availability impact to the sandboxed renderer, tempered by the required user interaction and the architectural containment; host compromise would require chaining a separate sandbox-escape flaw. No public exploit code or confirmed active exploitation was identified at time of analysis, and Google has released a patched stable build.
Use-after-free in Chrome's Input handling allows remote code execution inside the renderer sandbox when a user opens a crafted HTML page in any Chrome build prior to 156.0.8078.47. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and code execution is confined to the renderer sandbox, so host compromise requires chaining a separate sandbox escape; Google rates the flaw High severity. No public exploit code or confirmed active exploitation was identified at time of analysis, and the vendor has released a fix.
Eclipse ThreadX firmware built with Module Manager and loadable modules enabled contains a use-after-free in txm_module_object_deallocate: a module can request release of a kernel object control block by address, and the manager frees it even if the kernel still references it. The object remains on its created list and, for threads or timers, on scheduler/timer lists, so the byte pool can reallocate the same memory while the kernel still uses it. Exploitation requires local low-privilege code execution inside a loaded module (PR:L, AV:L) and is not remotely reachable in default builds; no public exploit code was identified at time of analysis.
Use-after-free in GIMP's XCF loader can crash the application and potentially allow arbitrary code execution when a user opens a crafted .xcf file that selects a path and then fails to load it. The flaw affects GIMP as packaged in Red Hat Enterprise Linux 6 through 10 according to the provided CPE mappings, and exploitation is local and requires user interaction (CVSS 7.8, AV:L/UI:R/PR:N); no public exploit was identified at time of analysis. Because scope is unchanged, any code execution would run with the privileges of the user opening the file rather than automatically gaining root.
Opening a crafted XCF file in GIMP can trigger a use-after-free in the XCF loader's linked-channels handling, crashing the main GIMP process and potentially enabling code execution in the opening user's context. The defect affects GIMP installations that parse XCF files, with Red Hat tracking impact across RHEL 6 through RHEL 10 packages; exploitation requires local delivery and a victim to open the malicious image, and no public exploit code or CISA KEV entry is identified in the provided data.
Memory corruption in Pillow versions prior to 13.0.0 can crash the process when Image.transform() takes the fast Transform.EXTENT or pure scale-and-translate Transform.AFFINE path with default NEAREST resampling and a selective allocation failure occurs under memory pressure. The defect is a double free/use-after-free in ImagingScaleAffine: the output image allocation succeeds, the additional per-column lookup allocation fails, and the error path deletes image storage that later cleanup releases again (CWE-416). The assessed impact is availability-only with no confidentiality or integrity effect, exploitation depends on attacker-influenced transform sizes plus genuine memory pressure, and no public exploit identified at time of analysis.
A use-after-free in the Perl XS module Text::CSV_XS (versions 1.46 through 1.64) lets attacker-supplied CSV content crash the parsing process when an application combines three specific features: bind_columns(), the non-default skip_empty_rows option (or its 'eof' mode), and input containing an empty line. The defect drops a reference from the caller's bound scalar while it is still in use, so subsequent application code touches freed memory and typically aborts - the independent assessment scores this as availability-only impact (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H) rather than the headline 9.8, because the vulnerable code path never runs under default configuration. EPSS is low at 0.19% (8th percentile), no public exploit code was identified at time of analysis, and no CISA KEV entry exists; a vendor patch is available in Text::CSV_XS 1.65.
Use-after-free in MariaDB Server's SYS_REFCURSOR handling (12.3.1 through 12.3.2, and the 13.0.x branch before 13.0.2) lets an authenticated, low-privileged database user crash the server and corrupt server memory by declaring and opening more than the default 16 SYS_REFCURSORs inside a stored routine and then fetching from one of them. The flaw is a stale-reference bug in the cursor array: when the array is reallocated to grow beyond its initial 16 slots, routine-context references still point at the freed element, and the resulting use-after-free can be leveraged for remote code execution only when chained with a second, separate vulnerability. Authentication is required (CVSS PR:L, AV:N), and no public exploit code or confirmed active exploitation has been identified at the time of analysis; the vendor CVSS of 9.9 is high, but practical impact is bounded by the narrow affected version range and the need for CREATE ROUTINE/EXECUTE privileges plus a second bug to convert memory corruption into code execution.
Use-after-free in Google Chrome's compositing pipeline lets an unauthenticated remote attacker execute arbitrary code within the browser sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.84. The flaw carries a CVSS 3.1 score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) even though Google rates it Chromium severity Medium, and no public exploit has been identified at time of analysis, with CISA's SSVC assessment recording no observed exploitation. Because the resulting code execution stays inside the sandbox, full host compromise would require chaining a separate sandbox escape, which tempers the real-world severity despite the high vector score.
Use-after-free in the V8 JavaScript engine in Google Chrome before 155.0.8059.84 allows unauthenticated remote attackers to achieve arbitrary code execution inside the renderer sandbox by persuading a victim to load a crafted HTML page; only default JavaScript settings are required, with no privileges needed (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Vendor patches are available in Chrome 155.0.8059.84, and no public exploit code has been identified at time of analysis per CISA SSVC (Exploitation: none). The resulting code execution is confined to the renderer sandbox, so a separate sandbox-escape vulnerability would be required to compromise the underlying host; the exposure window closes once the browser auto-updates to the patched build.
Use-after-free in the V8 JavaScript engine of Google Chrome before 155.0.8059.84 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page. Successful exploitation is gated by mandatory user interaction (CVSS UI:R) and needs no authentication (PR:N), so a single visit to an attacker-controlled or compromised page is enough, though the resulting code execution stays confined to the renderer sandbox under the assessed S:U scope and would require a separate sandbox-escape to compromise the host. No public exploit code or active exploitation has been identified at time of analysis, and a vendor patch is available in release 155.0.8059.84 (Chromium severity: High).
Use-after-free in Google Chrome's Prerender component allows remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page, and Google rates the flaw Critical with a CVSS base score of 8.8. All Chrome builds prior to 155.0.8059.84 are affected, and exploitation requires user interaction (UI:R) since the attacker cannot trigger the flaw without the victim loading the malicious content, though no authentication or special privileges are needed. Vendor-released patch: 155.0.8059.84; no public exploit code or confirmed active exploitation has been identified at time of analysis, and the SSVC assessment records exploitation as none, making this a high-priority patching target rather than an emergency.
Remote code execution in Microsoft Excel is possible when a user opens or previews a specially crafted spreadsheet, which triggers a use-after-free during file parsing and lets an unauthenticated attacker run code in the context of the victim. The flaw carries a CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, the Mac LTSC and Office 365 for Mac builds, and Office Online Server, with no attacker authentication required but mandatory user interaction (UI:R) - meaning successful exploitation depends on social engineering rather than automatic server-side triggering, and Protected View plus Mark-of-the-Web warnings can interrupt the chain. At time of analysis there is no confirmed active exploitation (no CISA KEV listing) and no public exploit code identified, and Microsoft has published a vendor fix via its MSRC update guide; risk is high but manageable through prompt patching and the existing Office security defaults.
Use-after-free memory corruption in Microsoft Office Word enables remote attackers to execute arbitrary code with the privileges of the user who opens a maliciously crafted document. The flaw is unauthenticated (PR:N) but requires the victim to open the document (UI:R), and affects Microsoft 365 Apps for Enterprise, Office LTSC 2021/2024, and the corresponding macOS editions (Office 365 for Mac, Office LTSC for Mac 2021/2024). No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV); vendor patches are available, making this a genuine high-priority patching target rather than an emergency.
A use-after-unmap in DPDK's vhost library gives a local attacker who controls a VDUSE (vDPA Device in USErspace) backend, or a guest able to drive IOTLB invalidations on the vhost device, a path to memory corruption inside the host vhost process. The flaw is that the VDUSE handler does not invalidate cached vring pointers when the IOTLB is invalidated, so the code keeps dereferencing vring addresses that have already been unmapped - a classic CWE-416 use-after-free. The assessed CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, base 8.8) marks this as locally reachable, low-complexity and low-privilege, with a scope change (S:C) reflecting that a confined guest/userspace VDUSE device can compromise the host vhost trust boundary; impact is full confidentiality, integrity and availability loss. No public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, so risk is concentrated in multi-tenant virtualization and NFV hosts that specifically enable DPDK VDUSE. Affected packages are Red Hat's Fast Datapath DPDK channel for RHEL 8, 9 and 10, with downstream exposure noted for RHEL, OpenShift Container Platform 4 and OpenStack Platform 13 Queens.
Adjacent, unauthenticated attackers can crash the rpd routing protocol daemon on Juniper Networks Junos OS and Junos OS Evolved devices that are configured for sparse-mode PIM, exploiting a use-after-free flaw triggered by specific PIM Join/Prune messages. Successful exploitation causes a denial of service through daemon failure and subsequent routing churn, with no impact on confidentiality or integrity. Exploitation is conditional: the target must run PIM sparse mode and the attacker must already sit on an adjacent multicast/routing segment with a valid PIM adjacency, and no public exploit code or confirmed active exploitation (CISA KEV) was identified at time of analysis; the vendor advisory JSA112187 is the authoritative source for affected and fixed releases.
A use-after-free in the packet forwarding engine of Juniper Networks Junos OS on SRX Series firewalls lets unauthenticated, network-based attackers repeatedly crash the flowd daemon when web filtering for TCP traffic is enabled, producing a temporary but complete service outage until flowd automatically restarts. The trigger is a high volume of DNS requests that must coincide with an internal race condition explicitly outside the attacker's direct control, so impact is probabilistic rather than deterministic; devices without web filtering for TCP configured are not exposed. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the exposure is bounded to specific pre-25.2 service releases for which Juniper has published fixed builds.
Unauthenticated remote attackers can trigger a use-after-free in NGINX's ngx_http_core_module when asynchronous file I/O (AIO) is enabled and a Server Side Includes (SSI) page containing 'include virtual' commands is processed, causing memory corruption or a worker process crash. This affects both NGINX Plus and NGINX Open Source, with code execution possible only on systems where Address Space Layout Randomization (ASLR) is disabled or can be bypassed. Exploitation requires a non-default configuration (AIO and SSI enabled), and no public exploit code was identified at time of analysis.
Use-after-free in curl's HTTP/2 client code (curl 8.12.0 through 8.22.0) can corrupt memory when a server answers an in-progress upload with an HTTP/2 RST_STREAM frame carrying the HTTP_1_1_REQUIRED or REFUSED_STREAM reason code, freeing the internal struct Curl_easy object while it is still referenced by the transfer state machine. The flaw is remote and requires no authentication (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H, base 8.1), but exploitation is conditional: the victim must be uploading over a negotiated HTTP/2 connection to an endpoint the attacker controls or influences, and the RST_STREAM must land at the right point in the transfer lifecycle, which is why the assessed complexity is High. Publicly available exploit code exists (SSVC Exploitation: poc) and CISA's framework rates technical impact as total, yet there is no confirmed active exploitation (not in CISA KEV) and EPSS is low at 0.23% (12th percentile); a vendor patch is available. The same flaw affects libcurl and therefore every downstream application and distribution shipping an affected build.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker trigger memory corruption and execute arbitrary code inside the browser's renderer sandbox when a victim loads a crafted HTML page in any Chrome build prior to 155.0.8059.79. Exploitation is not confirmed in the wild - CISA's SSVC assessment lists exploitation as none and no public exploit code has been identified at time of analysis - and the EPSS score is low at 0.21% (10th percentile), although the technical impact if successfully triggered is total. User interaction is mandatory (UI:R), the attacker needs no credentials or privileges (PR:N), and Google has released a fixed build, so risk is serious but not emergency-grade.
Use-after-free in Google Chrome's Media component (versions prior to 155.0.8059.79) allows a remote, unauthenticated attacker to corrupt memory and execute arbitrary code inside the browser's renderer sandbox when a victim opens a crafted HTML page containing malicious media content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, Chromium severity High). Successful exploitation requires only that the user navigate to the attacker-controlled page with an affected build; no credentials or non-default configuration are needed, so default desktop installations are exposed. No public exploit code has been identified at time of analysis, and CISA's SSVC assessment records exploitation as "none" with automatable "no," so this is a patch-promptly issue rather than an active emergency. Real-world impact is bounded by the fact that code execution stays within the sandboxed renderer process (scope unchanged, S:U); an attacker would need to chain a separate sandbox-escape flaw to reach the host operating system.
In-sandbox remote code execution is possible in Google Chrome builds prior to 155.0.8059.79 because of a use-after-free in the V8 JavaScript engine that is triggered when a victim loads a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and Google rates it High severity; no authentication or non-default configuration is required, but the attacker must induce a user to open the malicious page, and successful exploitation is confined to the browser sandbox, so full host compromise would also require a separate sandbox-escape flaw. No public exploit code and no active exploitation have been identified at time of analysis, and CISA's SSVC decision framework records Exploitation: none and Automatable: no, although the SSVC Technical Impact is rated total. A vendor patch (155.0.8059.79) is available.
Use-after-free in Chrome's V8 JavaScript engine allows remote, unauthenticated attackers to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page in Google Chrome builds prior to 155.0.8059.79. Exploitation is gated by user interaction (the victim must navigate to attacker-controlled HTML/JavaScript), and according to the CISA SSVC evaluation it is neither currently exploited nor assessed as automatable, with no public exploit identified at time of analysis. The SSVC technical impact is rated total within the affected component, but code execution is confined to the renderer sandbox - reaching the host operating system would require chaining a separate sandbox-escape vulnerability.
Arbitrary code execution inside the Chrome renderer sandbox is achievable through a use-after-free in the browser's Media component, affecting all desktop Chrome builds prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by getting a victim to load a crafted HTML page; the CVSS vector requires user interaction (UI:R), so there is no zero-click path, and no public exploit has been identified at time of analysis. Impact is scoped to the renderer (S:U), meaning a successful exploit yields code execution within the sandbox rather than host compromise unless chained with a separate sandbox escape; Google classifies the issue as High severity and has shipped a fixed build.
A use-after-free in the Core component of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page. Affected builds are those prior to 155.0.8059.79, per the vendor advisory (EUVD's affected-version data lists the same 155.0.8059.79 threshold). Exploitation requires unauthenticated remote delivery with user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) and is rated Critical by Chromium; there is no confirmed active exploitation (CISA SSVC Exploitation: none) and no public exploit identified at time of analysis, though the SSVC Technical Impact rating of "total" and the scope-changing (S:C) sandbox-escape impact make prompt patching important. Note a platform discrepancy: the description specifies Chrome on Android while the cited vendor reference is a desktop stable-channel update, so the exact affected platform should be confirmed against the advisory.
Use-after-free in the DOM component of Google Chrome prior to 155.0.8059.79 allows unauthenticated remote attackers to potentially execute arbitrary code inside the renderer sandbox by convincing a user to load a crafted HTML page (UI:R). With a CVSS score of 8.8, exploitation yields high confidentiality, integrity, and availability impact within the browser process, though full host compromise would require an additional sandbox escape not covered by this CVE. No public exploit code or active exploitation has been identified at time of analysis, and the vendor has released a patched version.
Use-after-free in Google Chrome's DOM implementation before 155.0.8059.79 allows unauthenticated remote attackers to execute arbitrary code inside the renderer sandbox when a victim navigates to a crafted HTML page. The flaw affects desktop stable and extended-stable channels and carries a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), with exploitation limited by the requirement for user interaction and by the renderer sandbox preventing direct host compromise without a separate sandbox escape. No public exploit identified at time of analysis, but a vendor patch is available.
Remote code execution confined to the renderer sandbox is possible in Google Chrome Desktop releases prior to 155.0.8059.79, where a use-after-free flaw in the Desktop component is triggered when a victim opens or is redirected to an attacker-controlled crafted HTML page. No authentication or special privileges are required (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, score 8.8), but exploitation depends on user interaction and the resulting code execution is limited to the sandboxed renderer unless a second, independent sandbox-escape vulnerability is chained. Vendor-released patch: 155.0.8059.79; there is no public exploit identified at time of analysis and CISA SSVC records no known exploitation, so this is a high-priority patch item rather than an emergency.
Use-after-free in Google Chrome's network component allows remote attackers to execute arbitrary code outside the sandbox by delivering crafted network traffic to versions prior to 155.0.8059.79. Exploitation requires a victim to interact with attacker-influenced content (UI:R) but no authentication (PR:N), and the vulnerability carries a CVSS score of 9.6 (Critical). Although no public exploit code or active exploitation has been identified at time of analysis, the severity and potential for full system compromise warrant immediate patching.
Sandbox escape through a use-after-free in Google Chrome's Passwords component allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in versions prior to 155.0.8059.79. The flaw carries a high attack complexity (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H, base 8.3) because the heap-timing condition must be reliably won, and it is not a standalone attack: it functions as the second stage of a chain, so no public exploit has been identified at time of analysis and CISA's SSVC assessment rates exploitation as 'none'. Vendor-released patch 155.0.8059.79 is available, which keeps opportunistic mass exploitation unlikely and points to targeted use only.
Use-after-free in SVG rendering in Google Chrome versions prior to 155.0.8059.79 allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page containing malicious SVG content (CVSS 3.1 base 8.8, AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, CWE-416). Exploitation requires user interaction - the victim must navigate to attacker-controlled content - but no credentials or non-default configuration are needed, so default desktop installations are affected; the resulting code execution is confined to the renderer process, meaning full host compromise would additionally require a separate sandbox-escape bug. No public exploit code has been identified at time of analysis (CISA SSVC exploitation: none), and no public exploit identified at time of analysis; EPSS data was not provided. Google rates the issue Chromium security severity High and has released a stable-channel fix.
Use-after-free in the Canvas rendering path of Google Chrome versions prior to 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R, base 8.8). Because the freed object is reused in a graphics-rendering context, exploitation yields code execution only within the renderer sandbox, so full host compromise would require chaining a separate sandbox-escape flaw. No public exploit identified at time of analysis, and CISA's SSVC assessment rates exploitation as 'none' and automatable as 'no', though technical impact is rated 'total' if the bug is successfully triggered; a vendor-released patch (155.0.8059.79) is available.
A use-after-free in Google Chrome's Media component lets a remote, unauthenticated attacker who convinces a victim to load a crafted HTML page execute arbitrary code within the renderer sandbox (CVSS 3.1 base 8.8, vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H). Only Chrome builds prior to 155.0.8059.79 are affected, and because the scope is unchanged (S:U) any meaningful escape from the browser sandbox would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, CISA's SSVC assessment rates exploitation as none with automatable exploitation as no, and a vendor patch (155.0.8059.79) is available - the overall picture is a genuine, high-severity memory-corruption bug that nonetheless does not warrant top-tier emergency handling.
Remote code execution inside the Chrome renderer sandbox is possible via a use-after-free in the Media component of Google Chrome versions prior to 155.0.8059.79. An unauthenticated remote attacker can trigger the flaw by inducing a victim to load a crafted HTML page containing malicious media content; the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) confirms that no privileges are needed but that user interaction is required, and that any code execution is confined to the renderer sandbox unless chained with a separate sandbox escape. Google rates the Chromium severity as Critical, a vendor patch in 155.0.8059.79 is available, and no public exploit code has been identified at time of analysis.
Use-after-free in the Chrome Browser process before version 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the sandbox when a victim loads a crafted HTML page. Google rates this Chromium security severity Critical, and the CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H, 9.6) reflects confirmed high confidentiality, integrity and availability impact with a sandbox-escape scope change; only user interaction - opening the malicious page - is required, and no authentication or prior access is needed. At the time of analysis there is no CISA KEV listing and no public exploit code identified, although weaponization of Chrome browser-process use-after-frees is a realistic near-term concern given the sandbox-escape payoff. Vendor patch: Google shipped a fix in the 155.0.8059.79 stable channel release.
Use-after-free in Google Chrome's SVG rendering path allows a remote, unauthenticated attacker to execute arbitrary code inside the renderer sandbox when a victim opens a crafted HTML page, affecting all desktop builds prior to 155.0.8059.79 on both the Stable and Extended Stable channels. Exploitation requires user interaction (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, base 8.8), and because the scope is unchanged (S:U) the attacker gains renderer-process code execution, not host compromise, unless the primitive is chained with a separate sandbox escape. Chromium rates the flaw Critical, but all available exploitation signals are currently negative: CISA's SSVC assessment records Exploitation: none, and no public exploit code has been identified at time of analysis. Google has released a vendor patch in Chrome 155.0.8059.79.
Use-after-free in Google Chrome's built-in PDF handling lets a remote attacker achieve arbitrary code execution inside the browser sandbox by getting a victim to open a crafted HTML page containing malicious PDF content, affecting all desktop Chrome builds prior to 155.0.8059.79. Exploitation requires user interaction (UI:R) but no authentication (PR:N), and because the corrupted free happens in the renderer, code execution is contained by Chrome's sandbox - full host compromise would require chaining a separate sandbox-escape bug. CISA's SSVC assessment records no observed exploitation and no public exploit identified at time of analysis, so this is a genuine but not emergency-grade priority; Google rates the Chromium security severity as High and a vendor patch is available.
Use-after-free in Google Chrome's Passwords component (desktop stable builds prior to 155.0.8059.79) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox by convincing a victim to load a crafted HTML page. The 8.3 CVSS score reflects high confidentiality, integrity, and availability impact with a changed scope, but it is unauthenticated on paper (PR:N) only in the sense that no credentials are checked - the real gate is the prerequisite renderer compromise plus a hard-to-win use-after-free race (AC:H) and required user interaction (UI:R). No public exploit code and no confirmed active exploitation (not in CISA KEV) were identified at time of analysis, and Google has already released a fixed build, so the signals point to lower real-world urgency than the raw score suggests.
Use-after-free in Google Chrome's FileSystem component (CWE-416) lets an unauthenticated remote attacker execute arbitrary code outside the browser sandbox when a victim loads a crafted HTML page in any build prior to 155.0.8059.79. The 9.6 CVSS score is driven by the scope change (S:C) that models the sandbox escape plus high confidentiality, integrity and availability impact, yet exploitation requires mandatory user interaction (UI:R) and CISA's SSVC rates the attack non-automatable with exploitation status 'none', while Google itself assigns only Medium severity - sharply conflicting signals that should be reconciled before prioritization. No public exploit code has been identified at time of analysis and there is no confirmed active exploitation (CISA KEV).
Use-after-free in Google Chrome's Media component before version 155.0.8059.79 allows a remote attacker to achieve arbitrary code execution inside the renderer sandbox by convincing a user to open a crafted HTML page that drives the vulnerable media-parsing code path. Exploitation requires user interaction (the victim must navigate to or be redirected to attacker-controlled content), and the resulting code execution is confined to the sandbox, meaning host compromise would require chaining a separate sandbox-escape flaw. No public exploit code has been identified at time of analysis, EPSS is low (0.21%, 11th percentile), and Google has released a fixed build, so risk is serious but not emergency-level; priority should follow normal rapid-patching timelines.
Use-after-free in Google Chrome's ShapeDetection implementation, affecting all versions prior to 155.0.8059.79, allows an attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox, turning a renderer foothold into full browser-process compromise. Exploitation is not standalone: the CVSS vector (AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H) and the assessed conditions require both a prior renderer compromise achieved through a separate bug and user interaction, since the victim must load attacker-controlled crafted HTML that exercises the ShapeDetection API to trigger the free-then-reuse condition. Exploitation status is limited: no public exploit identified at time of analysis, no CISA KEV listing, and EPSS is low at 0.21% (11th percentile), though the SSVC technical impact is rated total because success means code execution beyond the Chrome sandbox.
Google Chrome before 155.0.8059.79 contains a use-after-free in its WebRTC component that can let a remote, unauthenticated attacker execute code inside the renderer sandbox when a victim loads a crafted HTML page, requiring user interaction. The issue is high severity (CVSS 8.8, CWE-416) and has a vendor patch, but sandbox containment means host-level compromise would require a separate escape. No public exploit has been identified at time of analysis and EPSS is 0.21% (11th percentile), so active exploitation is not currently indicated.
Remote code execution outside the sandbox in Google Chrome allows an unauthenticated attacker to execute arbitrary code on a victim's system by convincing them to open a crafted HTML page that loads a malicious PDF, affecting Chrome versions prior to 155.0.8059.79 on all platforms. This is a use-after-free (CWE-416) in the PDF component with a Critical Chromium severity and an assessed CVSS of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). Exploitation requires user interaction, and no public exploit identified at time of analysis; EPSS is low at 0.21% (11th percentile), and the vendor has released a patch (155.0.8059.79).
Local privilege escalation in Microsoft SQL Server allows an authorized, low-privileged principal with existing access to the database host to exploit a use-after-free memory condition (CWE-416) and run code in a more privileged security context. Affected builds span SQL Server 2019, 2022, and 2025 on versions below the fixed GDR and CU releases published with Microsoft's January 2026 update. Exploitation is constrained by the local attack vector (AV:L) and high attack complexity (AC:H), since the attacker must already be authenticated on the host and win a memory-reuse/timing race; no public exploit code or confirmed active exploitation was identified at time of analysis, and vendor patches are available.
Arbitrary code execution is possible in Adobe Substance 3D Stager 3.1.8 and earlier, where a use-after-free (CWE-416) is triggered while the application processes a crafted file. The CVSS v3.1 vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (7.8 High) shows no authentication is required, but the attacker must deliver the malicious file locally and convince the victim to open it, after which code runs only with the privileges of the current user. No public exploit code has been identified at time of analysis and there is no CISA KEV listing, so the practical risk is driven by social-engineering delivery and by the fact that a crash (denial of service) is also achievable from the same corrupting file.
Remote code execution in OpenSSH for Windows (the Microsoft OpenSSH server component) can be triggered over the network by an unauthenticated attacker with no user interaction, according to the CVSS:3.1 vector AV:N/AC:L/PR:N/UI:N and a 9.8 base score. The flaw is a use-after-free that can lead to memory corruption and potential code execution or denial of service, but exposure is limited to Windows hosts where the optional OpenSSH Server feature is installed and listening, typically on TCP/22. No public exploit identified at time of analysis, and confidence is limited by single-source reporting; defenders should treat any network-exposed Windows sshd listener as high risk and restrict or firewall the SSH port pending patching.
Local privilege escalation in the Windows Broadcast DVR User Service lets an authenticated attacker who already holds a low-privileged foothold on a Windows host trigger a use-after-free (CWE-416) memory corruption condition and gain elevated privileges, with high confidentiality, integrity, and availability impact per CVSS 7.8. The vector (CVSS:3.1/AV:L/AC:L/PR:L/UI:N) confirms this is strictly a local attack requiring prior code execution or an interactive session at low privilege, with no user interaction and no additional complexity barriers; the service ships and runs by default on the affected Windows 10, Windows 11, and Windows Server 2019 builds. Vendor patch is available and no public exploit code or confirmed active exploitation was identified at time of analysis.
Local privilege escalation in Windows Broadcast DVR User Service allows an authenticated low-privileged attacker on affected Windows 10, Windows 11, and Windows Server 2019 systems to elevate privileges by triggering a use-after-free (CWE-416) in the service. The flaw requires existing local access and a non-deterministic memory-lifecycle/race condition with heap grooming (CVSS 3.1 7.0, AC:H), and no public exploit code has been identified at time of analysis. Microsoft has released patches; update to the fixed builds listed in the advisory.