Information Disclosure

Authenticated users with time or cost entry viewing permissions can read private work package subjects and IDs via the OpenProject REST API in versions prior to 17.6.0. The /api/v3/time_entries and /api/v3/cost_entries endpoints expose _links.workPackage.title and _links.workPackage.href through the associated_resource rendering path without enforcing WorkPackage.visible or view_work_packages permission checks. An attacker with only view_time_entries or view_cost_entries can enumerate titles and IDs of work packages they should not have access to, violating project confidentiality controls. No public exploit or CISA KEV listing exists; the fix is available in v17.6.0.

Plugin output logs in IBM UrbanCode Deploy and IBM DevOps Deploy expose sensitive step values to any authenticated user with log access, across a wide range of actively-maintained versions spanning both product lines. The CVSS PR:L vector confirms that a low-privileged authenticated user - such as a developer or operator - who can view deployment logs may read sensitive values such as credentials, API tokens, or configuration secrets that plugin steps emit without redaction. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the risk is practically elevated in CI/CD environments where plugin steps routinely handle high-value secrets.

The /unpack endpoint in Apache Tika's server component (tika-server 4.0.0-alpha-1) fails to enforce the operator-configured enableUnsecureFeatures=false security control, classified as Improper Protection of Alternate Path. This means the /unpack endpoint remains fully operational even when administrators have explicitly disabled unsafe features, bypassing the intended security boundary and allowing archive extraction or untrusted content processing through a restricted interface. No public exploit code has been identified and the vulnerability is confined to a pre-production alpha release, significantly limiting real-world exposure.

Insufficient session expiration in the MikroTik RouterOS API allows authenticated users whose permissions have been reduced to retain their prior, elevated access rights for the duration of the stale session. Specifically, when a user's group membership or permission set is downgraded, or when an inactivity timeout is expected to expire a session, the RouterOS API fails to re-evaluate or invalidate the existing session token - exposing confidential routing, firewall, or credential data the user should no longer reach. No public exploit has been identified and the vulnerability is not listed in the CISA KEV catalog; however, ICS-CERT's publication of ICSA-26-211-01 signals elevated concern for operational technology networks where MikroTik devices are used for segmentation and industrial network management.

Uncontrolled decompression in aiohttp's WebSocket client prior to version 3.14.2 allows a malicious server to exhaust CPU and memory on connecting clients by sending RSV1-flagged compressed frames without having negotiated the permessage-deflate extension. The root cause is a missing constructor argument in `client.py:_ws_connect` that caused `WebSocketReader` to default to `compress=True`, violating RFC 6455 §5.2 which mandates failing the connection on undefined reserved bits. This is client-side exposure only - aiohttp server deployments are not affected. No active exploitation has been identified and no public exploit code exists at time of analysis.

Verbose technical error message disclosure in IBM Verify Identity Access and IBM Security Verify Access (both appliance and container editions) allows unauthenticated remote attackers to harvest internal application details returned directly in the browser. Affected versions span IBM Verify Identity Access 11.0-11.0.2, IBM Security Verify Access 10.0-10.0.9.1, and their respective container variants. No public exploit or CISA KEV listing exists at time of analysis; however, the zero-authentication barrier and the reconnaissance value of exposed technical data elevate this beyond a benign information leak, as harvested details can directly inform more damaging follow-on attacks against an identity management system.

Broken access control in IBM Langflow OSS 1.0.0-1.8.4 exposes private flow files through two distinct endpoint flaws: the image retrieval endpoint enforces no authentication whatsoever, allowing unauthenticated remote attackers to access any user's image files given a valid flow ID and filename; separately, the file download endpoint, while requiring authentication, fails to validate resource ownership, enabling any authenticated user to access files belonging to other tenants via IDOR. Both flaws break tenant isolation in multi-user deployments and result in unauthorized disclosure of sensitive data. No public exploit or CISA KEV listing has been identified at time of analysis; a vendor patch is available.

Cross-buffer memory aliasing in msgpack-ruby prior to 1.8.2 allows same-process code to read or corrupt data belonging to a separate MessagePack::Buffer instance via a use-after-free in the rmem slab allocator. MessagePack::Buffer#clear returns a 4 KiB rmem page to the shared pool but leaves rmem_last, rmem_end, and rmem_owner pointing into the freed page; a subsequent write on the cleared buffer and a concurrent second Buffer allocation can claim the same physical page, creating a memory alias that exposes the second buffer's serialized bytes. A PoC is included in the vendor advisory (GHSA-4mrv-5p47-p938); no public exploit identified at time of analysis beyond that PoC, and the CVE is not in CISA KEV.

Denial of service in Samba's Kerberos KDC password change (kpasswd) service allows authenticated remote attackers to crash the KDC process by submitting specially crafted, malformed ASN.1-encoded password change requests. The server miscalculates the structure size of the incoming request and reads up to six bytes beyond the end of the allocated buffer; when this read strikes unmapped memory, the KDC process terminates rather than simply failing gracefully. No public exploit has been identified and no CISA KEV listing exists, but the disruption of a KDC in an Active Directory or Samba domain environment carries significant operational impact since authentication for the entire domain depends on KDC availability.

foreUP's customer REST API exposes cleartext payment-processor merchant credentials - such as API keys or secrets - directly in response bodies to any authenticated user. All foreUP versions are affected per the wildcard CPE (cpe:2.3:a:foreup:foreup:*). An attacker with any valid authenticated session can harvest these credentials and use them to interact directly with the downstream payment processor, creating potential for financial fraud or account takeover at the payment-processing layer. No public exploit has been identified and this vulnerability is not listed in the CISA KEV catalog at time of analysis.

Credential exposure in CSL 1010 M2M 3G WiFi Module firmware through 2.2.1.4 stems from a trivially reversible single-byte XOR cipher with a hard-coded static key used to 'protect' the Router.cfg configuration backup file. An attacker with local access to the device can decrypt the backup and recover web administration passwords, telnet credentials, WPA/WPA2 pre-shared keys, PPPoE and 3G/APN credentials, and SIM identifiers (IMSI and IMEI) in plaintext. No public exploit has been identified at time of analysis, KEV listing is absent, and no fixed firmware version has been confirmed.

Unauthenticated exposure of Go pprof debug endpoints in Calico kube-controllers and Goldmane components allows any pod with adjacent network access to retrieve sensitive in-memory data when the shared debug server feature is enabled. Affected products span Calico, Calico Enterprise, and Calico Cloud across all versions per CPE. The vulnerability is opt-in (debug server disabled by default), but carries high confidentiality impact when enabled because heap dumps and goroutine stacks may contain credentials, tokens, or other sensitive runtime state. No public exploit identified at time of analysis and no CISA KEV listing.

Insufficient audit logging in VMware ESX and related Broadcom virtualization platforms allows a malicious administrator to perform certain privileged operations without generating corresponding log entries. Affected products span the VMware ecosystem including Cloud Foundation, vSphere Foundation, ESX, and Telco Cloud Platform. No public exploit code exists and the vulnerability is not listed in CISA KEV, but the insider-threat and post-compromise forensic evasion implications are meaningful for organizations relying on audit logs for compliance and incident response.

DFIR-IRIS web application version 2.4.26 implements logout without server-side session invalidation, leaving session cookies valid indefinitely after a user believes they have signed out. Classified as CWE-613 (Insufficient Session Expiration), this flaw means any attacker who obtains a valid session cookie - through XSS, network interception, shoulder-surfing, or physical device access - retains unauthorized access to the IRIS incident response platform even after the legitimate user logs out. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA KEV catalog.

Credential exposure in Phoenix Contact CHARX SEC EV charging controllers allows a low-privileged local attacker who can read log files to extract plaintext credentials for the built-in 'user-app' account and subsequently authenticate via SSH. Affected are all CHARX SEC-3000, 3050, 3100, and 3150 units running firmware versions 1.0.0 through 1.9.0. Successful exploitation can interrupt active EV charging sessions, constituting a high availability impact in operational charging infrastructure. No public exploit or active exploitation has been identified at time of analysis.

Firmware update handling in Phoenix Contact CHARX SEC EV charging controllers (versions 1.0.0 through 1.8.x) exposes a race condition exploitable by unauthenticated remote attackers via the OCPP backend. By supplying an invalid firmware file, an attacker can cause the file to persist temporarily in accessible device storage during the flawed cleanup window before deletion, resulting in low-impact integrity interference with the firmware management process. No public exploit code and no CISA KEV entry have been identified; a vendor-released patch is confirmed at version 1.9.1.

Password reset token hijacking in Veeam Service Provider Console 9.2 and earlier enables unauthenticated remote attackers to take over any portal user account by manipulating the returnUrl parameter in the Forgot Password workflow. An attacker who knows a target's email address initiates a password reset on their behalf, supplying an attacker-controlled domain via the unvalidated returnUrl parameter; the platform then generates a reset email whose link routes through the attacker's infrastructure, transmitting the one-time reset code upon the victim clicking it. Account takeover is achieved without requiring any credentials or prior access to the platform. No public exploit has been identified at time of analysis, and CISA KEV status is not confirmed; however, the technique is straightforward and the report originated from HackerOne, suggesting the attack vector is well-understood by researchers.

Unauthenticated deletion of all custom icon font packs is possible in Ultimate Addons for WPBakery Page Builder WordPress plugin before version 3.21.4. The plugin's icon font deletion endpoint performs no WordPress capability check and no nonce verification, meaning any unauthenticated HTTP request can permanently erase every custom-uploaded icon font pack on an affected site in a single request. A publicly available proof-of-concept exists and SSVC assesses the attack as automatable, though EPSS remains very low at 0.15% (5th percentile), indicating no significant observed exploitation at scale; the vulnerability is absent from CISA KEV.

Authenticated information disclosure in the LifterLMS WordPress plugin before 10.0.10 exposes internal post type titles - including coupon codes - to any subscriber-level user. The root cause is a missing capability check in a select2 query AJAX handler that only verifies login status, not whether the user holds an appropriate WordPress capability. A publicly available proof-of-concept exists (via WPScan), though EPSS sits at just 0.16% (5th percentile), indicating low broad exploitation likelihood; no active exploitation is confirmed by CISA KEV.

Unauthorized customer PII exposure in MotoPress Hotel Booking WordPress plugin before 6.0.4 allows any authenticated subscriber-level user to retrieve full personal details - name, email, phone number, and address - belonging to any customer booking in the system. The flaw stems from a missing capability check in an AJAX action handler, meaning the plugin never verifies whether the requesting user is authorized to view the target booking before returning its data. A publicly available exploit exists per WPScan, though EPSS at 0.16% (5th percentile) and absence from CISA KEV suggest exploitation remains opportunistic rather than widespread.

Easy Appointments WordPress plugin through version 3.12.26 exposes an appointment-listing REST endpoint to any authenticated user by gating it on a capability held by every WordPress user - including subscribers, the lowest authenticated role. Any user with a basic account can query this endpoint to enumerate all site bookings, extracting customer names, appointment schedules, and booking statuses belonging to other clients. A publicly available exploit is documented by WPScan; however, EPSS sits at 0.16% (5th percentile) and the vulnerability is not in CISA KEV, indicating limited observed mass exploitation at time of analysis.

Easy Appointments WordPress plugin through version 3.12.26 exposes all stored customer personal information to any authenticated contributor-level user due to missing per-request capability and nonce validation on a customer-listing handler. Any user holding a contributor role - a low-privilege WordPress role normally limited to drafting posts - can invoke the unprotected endpoint and enumerate the full customer dataset. A publicly available proof-of-concept exists per WPScan, though EPSS places exploitation probability at 0.16% (5th percentile) and the flaw has not been listed in CISA KEV, suggesting limited observed exploitation.

Spring Tools language server exposes proxy Basic-auth credentials in cleartext log files, affecting Spring Tools for Eclipse 5.2.0 and earlier and Spring Tools for VSCode/Cursor/Theia 2.2.0 and earlier. When no explicit http.proxy workspace setting is configured, the language server reads the HTTP_PROXY/HTTPS_PROXY (and lowercase variants) environment variables and writes their raw values-including embedded credentials in the form http://user:pass@proxy:8080-to its log at INFO level without redaction. Because language server logs are often shared in bug reports or are readable by other local users and processes, this results in proxy credential disclosure. No public exploit has been identified at time of analysis, and CISA KEV listing is absent.

Remote unauthenticated denial of service and memory disclosure in the Performance Co-Pilot (PCP) pmproxy service affects Red Hat Enterprise Linux 6 through 10 and OpenShift Container Platform 4. An out-of-bounds read (CWE-125) in the pmLogLoadInDom() function can be triggered by a specially crafted network request, causing the pmproxy process to crash and potentially leaking sensitive data from process memory. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Price manipulation in the Persian Elementor WordPress plugin (all versions up to and including 2.8.1) allows unauthenticated remote attackers to submit arbitrary payment amounts to the ZarinPal payment gateway by tampering with the client-supplied 'amount' POST parameter, bypassing the price configured in the Elementor widget. The root cause is the absence of server-side reconciliation between the submitted payment figure and the widget's defined price - whatever the client sends is forwarded directly to ZarinPal. No public exploit code has been identified and the CVE is not listed in the CISA KEV catalog, though exploitation requires zero authentication and only trivial HTTP parameter manipulation.

Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables a remote attacker to leak cross-origin data by directing a victim to a crafted HTML page, bypassing same-origin policy protections through measurable side effects of media processing. Affected desktop users on all platforms running any Chrome release before 151.0.7922.72 are exposed to limited confidentiality loss. EPSS is 0.16% (6th percentile), SSVC exploitation status is none, and no public exploit has been identified at time of analysis - all signals converge on low real-world risk.

UI spoofing in the Google Chrome Updater component on Windows (prior to 151.0.7922.72) enables a local attacker to present a falsified interface to users by placing a malicious file in a location the Updater processes. Chromium's own team rates this 'Low' severity, consistent with the 4.0 CVSS score, EPSS of 0.10% (1st percentile), and SSVC exploitation status of 'none'. No public exploit exists at time of analysis, and a vendor-confirmed patch is available in Chrome 151.0.7922.72.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users into believing they are interacting with a legitimate browser interface by serving a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346, origin validation error), allowing the attacker to manipulate rendered UI elements. No public exploit code exists and no active exploitation has been confirmed; EPSS stands at 0.16% (6th percentile) and CISA SSVC classifies exploitation as none, placing this firmly in a patch-and-monitor priority tier rather than an emergency response.

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote unauthenticated attacker to misrepresent critical interface elements - such as the address bar or origin indicators - through a specially crafted HTML page. Classified as CWE-451 (UI Misrepresentation of Critical Information), the impact is limited to integrity: no code execution or data exfiltration is possible directly, but users can be deceived into trusting a malicious page as legitimate. No public exploit code exists, EPSS sits at 0.16% (6th percentile), and Chromium internally rated this as Low severity - consistent with a constrained, social-engineering-dependent attack surface.

Chrome for iOS prior to 151.0.7922.72 exposes potentially sensitive process memory contents to an attacker with physical access to the device through an inappropriate implementation flaw. The vulnerability is classified CWE-200 (Information Disclosure) and is iOS-platform-specific, not affecting Chrome on other operating systems. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the low-urgency tier despite requiring prompt patching for high-assurance mobile environments.

UI spoofing in Google Chrome's Passwords subsystem (versions prior to 151.0.7922.72) enables remote attackers to manipulate password-related UI elements through malicious network traffic, potentially deceiving users into submitting credentials to unintended destinations. Exploitation requires active user interaction (UI:R per CVSS), and real-world risk is constrained by an EPSS of 0.15% (5th percentile) and SSVC confirmation of no known exploitation and a non-automatable attack path. No public exploit identified at time of analysis; vendor patch is available in Chrome 151.0.7922.72.

UI spoofing in Google Chrome's Passwords component (versions prior to 151.0.7922.72) allows a remote unauthenticated attacker to manipulate how credential-related UI elements are displayed by delivering maliciously crafted network traffic to a browsing user. The root cause is insufficient input validation (CWE-20) in the Passwords subsystem, which fails to sanitize externally sourced data before rendering it in the browser interface. No public exploit code has been identified and CISA has not listed this in KEV; EPSS of 0.15% (5th percentile) confirms low automated exploitation probability, consistent with the SSVC rating of exploitation: none.

UI spoofing in Google Chrome's Settings component (versions prior to 151.0.7922.72) enables remote attackers to misrepresent critical interface elements to victims via malicious network traffic, requiring user interaction to trigger. EPSS at 0.15% (5th percentile) and CISA SSVC exploitation rating of none align with the Chromium team's own Low severity classification, making this a low-urgency issue despite its network-accessible attack vector. Google has released a patch in stable channel version 151.0.7922.72; no public exploits are identified at time of analysis.

UI spoofing in Google Chrome for Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading interface elements to users through a crafted HTML page. The flaw stems from an inappropriate implementation in Chrome's input handling on Android, classified under CWE-451 (UI Misrepresentation of Critical Information), meaning the browser fails to correctly represent critical UI state to the user. No public exploit code exists and CISA has not listed this in KEV; EPSS is extremely low at 0.16% (6th percentile), consistent with Chromium's own Low severity classification.

UI spoofing via Google Lens in Google Chrome prior to 151.0.7922.72 is achievable by a remote attacker who has already compromised the renderer process, using a crafted HTML page to misrepresent interface elements to the victim. The attack requires a chained exploitation scenario: renderer compromise as a prerequisite, followed by abuse of an inappropriate implementation in the Lens component (CWE-451) to manipulate what the user perceives in the browser UI. No active exploitation is confirmed - CISA KEV does not list this CVE, SSVC assessment shows exploitation status of none, and EPSS sits at 0.16% (6th percentile), indicating very low real-world exploitation probability at time of analysis.

Information disclosure in Google Chrome's WebXR subsystem prior to version 151.0.7922.72 allows unauthenticated remote attackers to read potentially sensitive process memory contents by luring a victim to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) indicates a network-accessible, low-complexity path to high confidentiality impact, though Chromium's internal severity rating of Low and an EPSS of 0.16% (6th percentile) reflect limited real-world exploitation risk. No public exploit code exists and CISA SSVC rates exploitation as none, making this a watch-and-patch item rather than an emergency response trigger.

UI spoofing in Google Chrome on iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page identity or browser security state by serving a crafted HTML page. The flaw is iOS-specific, exploiting an inappropriate implementation in the Chrome for iOS rendering layer rather than the broader Chromium engine, and requires only that the victim navigate to an attacker-controlled page. No public exploit has been identified and EPSS stands at 0.19% (9th percentile), consistent with Chromium's own 'Low' internal severity classification; this is a real but low-urgency integrity issue.

Process memory disclosure in Google Chrome's WebGL implementation allows a remote attacker to read potentially sensitive data from the browser's memory by luring a user to a specially crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 across desktop platforms. No public exploit code has been identified and EPSS sits at 0.16% (6th percentile), indicating low real-world exploitation probability despite the High confidentiality rating in the CVSS vector.

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the USB component, exploitable only after the attacker has already compromised the renderer process. Exploitation requires luring a victim to a crafted HTML page in a pre-compromised renderer context, making this a secondary-stage vulnerability in a chained attack rather than a standalone threat. EPSS sits at 0.19% (9th percentile), SSVC records no exploitation activity, and the vulnerability is not listed in CISA KEV - consistent with its low severity rating and demanding prerequisite.

Domain spoofing in Google Chrome on Android (all versions prior to 151.0.7922.72) results from a race condition in the PictureInPicture component, enabling a remote attacker to misrepresent the origin domain shown to a user when they interact with a crafted HTML page. The integrity impact is limited to the browser UI trust indicator - no code execution or data exfiltration occurs directly - but successful spoofing can be chained with credential phishing against a falsely trusted domain. No active exploitation has been confirmed (not listed in CISA KEV), and the EPSS score of 0.16% at the 6th percentile reflects very low exploitation probability, consistent with Chromium's own 'Low' severity classification.

UI spoofing in Google Chrome's Extensions subsystem (all versions prior to 151.0.7922.72) allows an attacker who tricks a user into installing a crafted malicious extension to misrepresent critical security indicators within the browser interface. The flaw stems from incorrect security UI rendering in the Extensions component (CWE-451), enabling deceptive presentation of extension trust signals or permissions. No public exploit has been identified at time of analysis and EPSS is 0.10% (1st percentile), aligning with Chromium's own internal 'Low' severity rating; however, the ubiquitous deployment footprint of Chrome elevates the aggregate exposure.

Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) exposes password-related data to attackers who have already compromised the renderer process and can deliver a crafted HTML page. The flaw stems from an inappropriate implementation that fails to enforce proper origin validation within the Passwords subsystem, making it a second-stage element in a chained attack rather than a standalone threat. No public exploit has been identified, EPSS is 0.16% (6th percentile), SSVC records no known exploitation, and Chromium internally rates this Low severity - consistent with the high prerequisite bar of prior renderer compromise.

Uninitialized memory use in Skia, Chrome's 2D graphics rendering engine, exposes process memory contents to remote attackers on Windows via crafted HTML pages in Google Chrome versions prior to 151.0.7922.72. The flaw is strictly an information disclosure issue (CWE-457), with no integrity or availability impact, affecting only the Windows platform per the vulnerability description. No public exploit code has been identified, EPSS places exploitation probability at 0.19% (9th percentile), and SSVC classifies exploitation as none with partial technical impact - collectively suggesting limited real-world risk despite the CVSS C:H rating.

Cross-origin data leakage in Google Chrome on Android prior to 151.0.7922.72 enables a local attacker to read data from a different origin by directing a victim user to a crafted HTML page. The flaw stems from an inappropriate browser implementation (CWE-346 Origin Validation Error), undermining the Same-Origin Policy's isolation guarantees on the Android platform. No public exploit code exists and no active exploitation has been observed; SSVC assessment confirms exploitation status as none, making this a low-urgency but noteworthy information-disclosure defect.

UI spoofing in Google Chrome's Global Media Controls component prior to version 151.0.7922.72 enables remote attackers to misrepresent interface elements when a victim visits a crafted HTML page. The flaw is rooted in CWE-451 (misrepresentation of critical UI information), allowing attacker-controlled content to manipulate what the media controls overlay displays. No public exploit code exists and no active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' both corroborate this as a low-urgency, routine-patching-priority finding.

Cross-origin data leakage in Google Chrome's Blink rendering engine (versions prior to 151.0.7922.72) exposes data protected by the Same-Origin Policy to remote attackers who can lure a victim to a crafted HTML page. The flaw, classified as CWE-346 (Origin Validation Error), allows Blink to improperly handle origin boundaries, enabling a malicious page to read cross-origin resource data. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with SSVC's 'Exploitation: none' designation and absence from CISA KEV.

Cross-origin data leakage in Google Chrome on Android (prior to 151.0.7922.72) results from an inappropriate UI implementation that allows a remote attacker to extract data from a different web origin when a user is socially engineered into performing specific UI gestures on a crafted HTML page. Rated CVSS 3.1 (Low) with EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none,' this vulnerability presents minimal immediate operational risk. No public exploit code exists and the issue is not listed in CISA KEV; a vendor-released patch is available in the stable channel update.

Side-channel memory leakage in Chrome's WebCodecs API prior to version 151.0.7922.72 enables a remote, unauthenticated attacker to extract potentially sensitive data from the browser's process memory by luring a victim to a crafted HTML page. The vulnerability stems from improper protection of physical side-channels (CWE-1300) within the WebCodecs media processing subsystem. No active exploitation has been identified - SSVC rates exploitation as none and EPSS places this in the 7th percentile - but the high confidentiality impact score reflects that successful exploitation could expose in-memory session data or other sensitive content.

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable through a CSS policy bypass, enabling remote unauthenticated attackers to exfiltrate data across origin boundaries when a victim visits a crafted HTML page. The root cause is improper origin validation (CWE-346) in Chrome's CSS subsystem, allowing CSS mechanisms to circumvent same-origin policy enforcement and read restricted cross-origin content. No public exploit code exists and no active exploitation has been identified; EPSS probability is 0.18% (8th percentile), consistent with the SSVC 'Exploitation: none' assessment and Chrome's own 'Low' severity designation for this issue.

Process memory leakage in Google Chrome's IME (Input Method Editor) implementation on macOS allows remote unauthenticated attackers to obtain potentially sensitive data from Chrome's process memory by luring a user to a specially crafted HTML page. The flaw affects all Chrome for Mac versions prior to 151.0.7922.72, is platform-scoped to macOS only, and carries a CVSS 6.5 (Medium) despite Chromium's own 'Low' severity designation. No public exploit code exists and EPSS sits at 0.17% (7th percentile), indicating very low current exploitation probability.

Information disclosure in the Views UI component of Google Chrome on macOS allows a local attacker to read potentially sensitive data from browser process memory by inducing a user to open a crafted HTML page on versions prior to 151.0.7922.72. The flaw is Mac-platform-specific, categorized by Chromium itself as Low severity, and carries no integrity or availability impact. No public exploit exists and no active exploitation has been identified; EPSS probability sits at 0.11% (2nd percentile) and CISA SSVC classifies exploitation as none.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote, unauthenticated attacker to misrepresent security-critical interface elements - such as the address bar or origin indicators - by serving a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-delivered and requires no privileges, but does require the user to interact with the malicious page, limiting its reach. No public exploit or active exploitation has been identified; EPSS at 0.17% (7th percentile) and SSVC exploitation status of 'none' collectively indicate low real-world risk at this time.

UI spoofing in Google Chrome's Passwords component allows an attacker occupying a privileged network position (man-in-the-middle) to manipulate password-related interface elements via malicious network traffic. All Chrome releases prior to 151.0.7922.72 on desktop are affected. Exploitation requires both a privileged network position and user interaction, substantially constraining real-world risk; no public exploit code exists and EPSS sits at the 2nd percentile, consistent with no observed exploitation in the wild.

Uninitialized memory access in Google Chrome's WebXR implementation on Android exposes potentially sensitive browser process memory contents to remote attackers who can direct a victim to a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected by this information disclosure weakness (CWE-457). No public exploit identified at time of analysis and SSVC confirms no active exploitation, placing this in routine patch-cycle priority despite the high confidentiality impact rating in the CVSS base score.

Information disclosure in Google Chrome's Views UI framework on macOS prior to version 151.0.7922.72 exposes potentially sensitive data from browser process memory to local attackers. The flaw is triggered by an inappropriate implementation in the Views rendering layer, reachable via a specially crafted HTML page. No public exploit code exists and the EPSS score sits at the 2nd percentile, indicating very low observed exploitation probability; Chrome's own severity rating of 'Low' is consistent with the local-only attack vector and read-only confidentiality impact.

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to deceive users by manipulating security indicators through a crafted HTML page. The vulnerability causes incorrect rendering of Chrome's browser-managed security UI elements - such as origin display or HTTPS trust badges - potentially causing victims to mistake malicious pages for legitimate or secure ones. No active exploitation has been confirmed (not in CISA KEV), EPSS at 0.17% (7th percentile) indicates low near-term exploitation probability, and a vendor-released patch is available in version 151.0.7922.72.

Domain spoofing in Google Chrome on Android (prior to 151.0.7922.72) enables remote unauthenticated attackers to present misleading security UI indicators to users via a crafted HTML page. The flaw stems from CWE-451 - user interface misrepresentation of critical information - where Chrome's Android UI fails to accurately convey the true origin or domain of the page being visited. No public exploit code exists, EPSS sits at 0.17% (7th percentile), and SSVC confirms exploitation status as none, collectively indicating low urgency despite the broad user base.

Cross-origin data leakage in Google Chrome's SVG implementation affects all versions prior to 151.0.7922.72, exploitable by a remote attacker who can convince a user to visit a crafted HTML page. The flaw violates the browser's Same-Origin Policy via improper SVG origin validation (CWE-346), allowing an attacker's page to infer or extract data belonging to cross-origin resources the victim's browser can reach. No active exploitation has been identified - CISA KEV is absent, SSVC exploitation status is 'none', and EPSS sits at a low 0.17% (7th percentile) - placing real-world urgency in the lower-priority tier despite the network attack vector.

Cross-origin data leakage in Google Chrome's network layer prior to version 151.0.7922.72 enables remote attackers to read sensitive cross-origin data by luring a victim to a crafted HTML page. Rooted in an inappropriate network implementation (CWE-346, Origin Validation Error), the flaw breaks the browser's cross-origin boundary enforcement without requiring any attacker authentication. No public exploit has been identified at time of analysis; EPSS places exploitation probability at 0.17% (7th percentile), and SSVC confirms no active exploitation, making this a low-urgency but valid information disclosure risk given Chrome's ubiquitous deployment.

UI spoofing in Google Chrome's Views component (prior to 151.0.7922.72) enables a remote unauthenticated attacker to deceive a victim about browser UI state or page origin by serving a crafted HTML page that triggers CWE-451 misrepresentation of critical interface elements. The CVSS vector (PR:N/UI:R) confirms the attack requires no authentication but does require the victim to visit the attacker-controlled page, limiting automated mass exploitation. No public exploit exists and SSVC rates current exploitation as none, with EPSS at only 0.17% (7th percentile), consistent with a low-severity, user-interaction-dependent flaw.

Cross-origin data leakage in Google Chrome's CORS implementation enables a post-exploitation information disclosure step for attackers who have already compromised the renderer process. All Chrome versions prior to 151.0.7922.72 are affected, with exploitation requiring both a pre-existing renderer compromise and user interaction with a crafted HTML page. No public exploit code exists and no CISA KEV listing; EPSS at 0.17% (7th percentile) and SSVC Exploitation: none confirm this is a low-priority, chained-attack-only vulnerability in practice.

UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) permits remote attackers to deceive users by rendering fraudulent payment-related interface elements through a specially crafted HTML page. The flaw carries a CVSS score of 4.3 and Chromium's own 'Low' severity rating, consistent with EPSS at 0.17% (7th percentile), signaling negligible real-world exploitation probability. No public exploit code exists and the vulnerability is absent from CISA's KEV catalog; Google has issued a patch in stable channel version 151.0.7922.72.

Cross-origin data leakage in Google Chrome's MHTML parser prior to version 151.0.7922.72 enables remote attackers to read data from origins they should not have access to, violating the Same-Origin Policy. The vulnerability requires user interaction - a victim must open a crafted MHTML page - and produces a limited confidentiality impact with no integrity or availability exposure. No public exploit code exists and no active exploitation has been identified; EPSS of 0.17% (7th percentile) and Chromium's own 'Low' severity rating confirm this is a low-urgency finding despite broad product deployment.

Uninitialized GPU memory use in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to leak cross-origin data by luring victims to a crafted HTML page. The flaw is confined to the Android build of Chrome and results in limited confidentiality exposure with no integrity or availability impact. No public exploit code or active exploitation has been identified; EPSS stands at a very low 0.19%, and Chromium itself rated the issue 'Low' severity.

Memory disclosure in Google Chrome's Dawn WebGPU component (prior to 151.0.7922.72) enables an attacker who has already obtained code execution in the renderer process to read sensitive data from process memory via a crafted HTML page. This is a second-stage, chained vulnerability - not a standalone exploit - requiring a prior, separate renderer compromise before this flaw is reachable. Chromium's own severity rating is Low, consistent with the EPSS score of 0.19% and SSVC classification of no active exploitation and partial technical impact; no public exploit or KEV listing exists.

UI spoofing in Google Chrome's Navigation component prior to version 151.0.7922.72 enables an attacker who has already compromised the renderer process to manipulate browser UI elements via crafted HTML pages. The Chromium team assigned Low internal severity, consistent with a CVSS score of 4.3, EPSS at the 7th percentile (0.17%), and SSVC exploitation status of 'none'. No public exploit code or active exploitation has been identified, and the vulnerability is only meaningful as a second-stage element in a multi-vulnerability attack chain.

Side-channel information leakage in Google Chrome's SVG rendering engine prior to version 151.0.7922.72 allows a remote attacker to infer cross-origin data by luring a user to a crafted HTML page. Rooted in CWE-1300 (Improper Protection of Physical Side Channels), the flaw violates the browser's same-origin policy isolation by exposing measurable signals during SVG processing that reveal data from a separate origin. No public exploit has been identified, SSVC confirms exploitation status of none, and EPSS sits at 0.17% (7th percentile), placing real-world priority firmly in the low tier for most environments.

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to display misleading URL content to a victim by serving a crafted HTML page, undermining the browser's fundamental trust signal. The flaw is iOS-specific and classified by Google as low severity (Chromium severity: Low), with EPSS at 0.21% and SSVC exploitation status of none, indicating no public exploitation at time of analysis. No public exploit code exists; the primary risk is phishing and credential harvesting against users who rely on the Omnibox to authenticate site identity.

UI spoofing in Google Chrome's Passwords component before version 151.0.7922.72 allows remote attackers to manipulate credential-related UI elements via malicious network traffic, exploiting insufficient input validation in the password manager subsystem. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms the attack is network-reachable without authentication but requires user interaction, limiting automated mass exploitation. With an EPSS of 0.16% (6th percentile), no KEV listing, and no known POC, real-world exploitation risk is low despite the ubiquitous deployment footprint of Chrome.

UI spoofing in Google Chrome for Android prior to version 151.0.7922.72 stems from an inappropriate FullScreen API implementation that allows remote attackers to deceive users with a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) confirms this is network-accessible without authentication but requires user interaction with a malicious page. With an EPSS of 0.21% at the 11th percentile, no CISA KEV listing, and Chromium's own 'Low' severity designation, real-world exploitation interest is minimal and no public exploit code has been identified at time of analysis.

Cross-origin data leakage in Google Chrome's DOMStorage component (versions prior to 151.0.7922.72) permits a remote attacker to read storage data belonging to a different origin by luring a victim to a crafted HTML page. The flaw is rooted in an origin validation error (CWE-346) within the DOMStorage subsystem, violating same-origin policy enforcement. EPSS is very low at 0.17% (7th percentile), no active exploitation is confirmed, and Chromium itself rates this Low severity, placing this in the lower tier of browser security issues despite its network-reachable attack surface.

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows remote attackers to read sensitive data from other origins by luring a victim to a crafted HTML page that abuses an inappropriate implementation in the DataTransfer API. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability effects, and Chromium's own security team rated this Low severity. No public exploit code or active exploitation has been identified at time of analysis; EPSS probability of exploitation is very low at 0.17% (7th percentile).

DevTools policy enforcement failure in Google Chrome prior to 151.0.7922.72 enables cross-origin data leakage through a malicious Chrome Extension that a victim is socially engineered into installing. The vulnerability is classified as information disclosure only (C:L/I:N/A:N), requires active user participation to exploit, and carries Chromium's lowest internal severity rating. No public exploit code exists and no active exploitation has been identified; EPSS places this at the 2nd percentile, and SSVC confirms exploitation status as none with non-automatable delivery.

UI spoofing in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker to mislead users about the origin or security context of displayed content via a crafted HTML page. Classified by Chromium as Low severity and rooted in CWE-451 (UI Misrepresentation of Critical Information), this flaw could be leveraged to facilitate phishing or social engineering by making malicious content visually indistinguishable from trusted interfaces. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating this is a routine patch-cycle issue rather than an active threat.

Side-channel information leakage in Chrome's Skia graphics engine allows remote attackers to read potentially sensitive data from browser process memory by delivering a crafted HTML page to an unpatched user. Affected versions span all Google Chrome releases prior to 151.0.7922.72. No public exploit code exists and EPSS sits at 0.17% (7th percentile), but the high confidentiality impact (C:H) combined with Chrome's ubiquitous deployment warrants timely patching despite the low current exploitation signals.

UI spoofing in Google Chrome for iOS (versions prior to 151.0.7922.72) enables remote attackers to misrepresent browser interface elements through specially crafted HTML pages, potentially deceiving users into disclosing information or taking unintended actions. The CVSS vector (AV:N/AC:L/PR:N/UI:R) confirms network-deliverable exploitation requiring only user interaction with no attacker privileges needed. EPSS at 0.21% (11th percentile), no CISA KEV listing, and Chromium's own internal 'Low' severity rating all converge on low real-world exploitation pressure; no public exploit identified at time of analysis.

Cross-origin data leakage in Google Chrome versions prior to 151.0.7922.72 stems from insufficient policy enforcement in the SVG rendering engine, allowing remote attackers to read data across origin boundaries by enticing a victim to visit a crafted HTML page. The CVSS vector (PR:N, UI:R) confirms unauthenticated exploitation but mandates active user interaction, constraining mass exploitation. No public exploit has been identified at time of analysis; EPSS stands at 0.17% (7th percentile) and SSVC signals exploitation status of none, placing this firmly in routine-patch priority.

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the browser's Web NFC API, classified under CWE-346 (Origin Validation Error). A remote attacker can serve a crafted HTML page that - when visited by a victim on an Android device - causes Chrome to violate its cross-origin isolation policy via the NFC subsystem, exposing cross-origin data to the attacker-controlled page. No public exploit has been identified at time of analysis; EPSS is 0.17% (7th percentile) and CISA SSVC rates exploitation as none, confirming low real-world urgency despite the network-accessible vector.

Cross-origin data leakage in Google Chrome's Isolated Web Apps (IWA) feature, versions prior to 151.0.7922.72, enables remote attackers to exfiltrate data across origin boundaries via crafted network traffic, contingent on user interaction. With an EPSS of 0.16% (6th percentile), no CISA KEV listing, and Chromium's own 'Low' severity classification, real-world exploitation risk is constrained despite the network-accessible vector. No public exploit has been identified at time of analysis, and impact is limited to partial confidentiality loss with no integrity or availability consequence.

Sandbox escape in Google Chrome's Printing component on Windows enables a remote attacker who has already compromised the renderer process to break out of Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on Windows. No public exploit has been identified, EPSS sits at the 7th percentile (0.17%), CISA SSVC rates exploitation as none and the attack as non-automatable, making this a low-urgency patching item despite the sandbox-escape classification.

Side-channel information leakage in Google Chrome's Network component prior to version 151.0.7922.72 enables remote attackers to infer cross-origin data by directing users to a crafted HTML page, violating Same-Origin Policy boundaries at the side-channel layer. The Chromium team rated this Low severity internally; with no public exploit code and no CISA KEV listing, the EPSS score of 0.17% (7th percentile) confirms that near-term mass exploitation is highly unlikely. The impact is limited to partial confidentiality loss (C:L) with no integrity or availability consequences, making this a low-urgency patch for most environments, though higher priority in privacy-sensitive or intelligence-adjacent deployments.

Sandbox escape in Google Chrome's Bluetooth component (all versions prior to 151.0.7922.72) allows an attacker who has already compromised the renderer process to break out of Chrome's sandbox by sending crafted Bluetooth IPC messages triggered via a malicious HTML page. This is a second-stage, chained exploit - not a standalone remote attack - requiring prior renderer compromise as a hard prerequisite, which is why Chromium rates it Low severity internally despite the sandbox escape classification. No public exploit code or CISA KEV listing has been identified; EPSS of 0.17% at the 7th percentile reflects low exploitation probability consistent with the high attack chain complexity.

SurfaceCapture in Google Chrome prior to 151.0.7922.72 leaks cross-origin data to remote attackers through a crafted HTML page, violating browser same-origin isolation. The flaw is classified as CWE-346 (Origin Validation Error), meaning the SurfaceCapture subsystem fails to properly enforce origin boundaries, allowing data from one origin to be read by another. No public exploit code has been identified at time of analysis, and CISA SSVC assessment confirms no active exploitation.

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) stems from insufficient policy enforcement in the NFC subsystem, enabling a remote attacker to read data across origin boundaries. An unauthenticated attacker (per PR:N in the CVSS vector) can serve a crafted HTML page that, when visited by a target on Android Chrome, bypasses same-origin policy checks tied to NFC API handling, resulting in limited confidentiality disclosure. No active exploitation has been identified at time of analysis, EPSS sits at 0.17% (7th percentile), and Chromium itself rates this Low severity - placing real-world risk well below its nominal network-accessible footprint.

Cross-origin data leakage in Google Chrome on Linux (prior to 151.0.7922.72) stems from an inappropriate implementation in the browser's Editing subsystem, enabling a remote attacker to exfiltrate limited cross-origin information when a victim interacts with a crafted HTML page. The CVSS vector (PR:L/UI:R) confirms exploitation requires both some authenticated context and active victim interaction, materially reducing opportunistic risk. No public exploit has been identified and EPSS sits at the 7th percentile, consistent with the vendor's own 'Low' severity classification.

Cross-origin data leakage in the Enterprise policy implementation of Google Chrome on Windows (versions prior to 151.0.7922.72) enables a remote attacker to extract data across origin boundaries by delivering a malicious file to a victim user. The CWE-346 (Origin Validation Error) root cause indicates Chrome's Enterprise component fails to enforce same-origin boundaries in this specific code path, exposing data that should be restricted. No public exploit has been identified and EPSS sits at the 6th percentile, with CISA SSVC confirming no current exploitation; this is a low-urgency but real information disclosure risk for enterprise Chrome deployments on Windows.

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 is achievable by remote unauthenticated attackers who can lure a victim to a crafted HTML page that abuses an inappropriate implementation in Chrome's Opaque Response Blocking (ORB) mechanism. ORB is specifically designed to prevent unauthorized cross-origin reads; this flaw undermines that protection, allowing an attacker's page to read data belonging to a different origin in violation of the same-origin policy. EPSS is 0.18% (8th percentile), SSVC classifies exploitation as none, and no active exploitation or public exploit code has been identified at time of analysis.

Cross-origin data leakage in Google Chrome's DataTransfer API implementation (prior to 151.0.7922.72) allows a remote unauthenticated attacker to read sensitive data from a different origin when a victim performs specific UI gestures - such as drag-and-drop interactions - on a crafted HTML page. The vulnerability is rated CVSS 4.3 (Medium) with an EPSS probability of just 0.18% (8th percentile), indicating very low observed exploitation activity. No public exploit code has been identified at time of analysis, and the vulnerability is not listed in CISA KEV, but Chrome's widespread deployment makes even medium-severity browser flaws worth prioritizing for rapid patching.

Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.

Memory disclosure in Google Chrome's WebXR implementation allows remote attackers to read sensitive data from process memory by directing a victim to a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on desktop platforms. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current exploitation activity, making this a moderate-priority patching item despite the High confidentiality impact in the CVSS score.