Information Disclosure

Sandbox escape in Google Chrome's Updater component on macOS (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to break out of Chrome's security boundary via a crafted HTML page. The CVSS scope-change metric (S:C) confirms the exploit elevates impact beyond the sandboxed renderer into a higher-privilege Updater context. No public exploit code has been identified and EPSS stands at 0.18% (8th percentile), reflecting the high prerequisite barrier of requiring prior renderer compromise; however, the Mac-specific Updater's elevated privilege position makes this a meaningful chained-exploit risk in targeted macOS campaigns.

Memory disclosure in Google Chrome's WebXR implementation allows remote attackers to read sensitive data from process memory by directing a victim to a crafted HTML page. Affected versions are all Chrome releases prior to 151.0.7922.72 on desktop platforms. No public exploit code has been identified at time of analysis, and SSVC assessment indicates no current exploitation activity, making this a moderate-priority patching item despite the High confidentiality impact in the CVSS score.

Sandbox escape in Google Chrome DevTools prior to version 151.0.7922.72 requires a pre-compromised renderer process and user interaction with a crafted HTML page to break out of the browser sandbox. The root cause is insufficient input validation (CWE-20) in the DevTools component, where attacker-controlled input from the renderer is not properly sanitized before being processed. No public exploit code or CISA KEV listing is present at time of analysis; EPSS is 0.18%, indicating low observed exploitation pressure despite the meaningful impact of a successful sandbox escape.

Cross-origin data leakage in Google Chrome's WebXR implementation (versions prior to 151.0.7922.72) arises from an uninitialized memory use flaw exploitable by a remote attacker via a crafted HTML page that must be visited by the victim. The flaw allows partial disclosure of cross-origin data, with no integrity or availability impact. No public exploit code or CISA KEV listing exists at time of analysis, and the EPSS score of 0.20% at the 10th percentile confirms this is a low-probability exploitation target in the near term.

Cross-origin data leakage in Google Chrome's Paint subsystem (all versions prior to 151.0.7922.72) allows a remote attacker to read data belonging to other web origins by delivering a crafted HTML page to a victim. The root cause is an origin validation error (CWE-346) in the Paint rendering component, permitting cross-origin information to surface where it should be isolated. No public exploit code exists and EPSS registers 0.18% (8th percentile), confirming low exploitation probability - this is a medium-severity patch-cycle priority, not an emergency.

Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) can be triggered remotely by luring a victim to a crafted HTML page, exposing data that should be isolated under the Same-Origin Policy. The flaw is classified as CWE-346 (Origin Validation Error), meaning Chrome's Autofill implementation fails to properly enforce cross-origin boundaries when processing form data. No public exploit exists and the EPSS score of 0.22% (12th percentile) reflects low near-term exploitation likelihood; the issue is patched in the stable channel release 151.0.7922.72.

Cross-origin data leakage in Google Chrome's Autofill subsystem (versions prior to 151.0.7922.72) enables remote attackers to extract sensitive cross-origin information by directing a user to a specially crafted HTML page. The root cause is an inappropriate implementation within Autofill that fails to enforce proper origin boundaries (CWE-346), allowing page-level interactions to surface data from contexts the page should not be able to read. No active exploitation is confirmed (not in CISA KEV), EPSS sits at 0.22% (12th percentile), and a vendor-released patch is available in Chrome 151.0.7922.72.

Cross-origin data leakage in Google Chrome's Payments component (all versions prior to 151.0.7922.72) enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is an inappropriate implementation in the Payments subsystem (CWE-346: Origin Validation Error), violating the browser's same-origin policy for payment-related data flows. EPSS is 0.18% (8th percentile) and no CISA KEV listing or public exploit has been identified, indicating low exploitation probability despite ubiquitous product deployment.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to manipulate the browser's visual interface through a crafted HTML page, potentially deceiving users into disclosing sensitive information or interacting with falsified content. Exploitation requires user interaction (visiting the malicious page), limiting opportunistic exploitation, and the EPSS score of 0.18% (8th percentile) reflects low observed exploitation probability. No public exploit code or active exploitation (CISA KEV) has been identified; vendor patch is available at version 151.0.7922.72.

Sandbox escape in Google Chrome on Android (versions prior to 151.0.7922.72) stems from a cryptographic flaw in the WebAppInstalls component, exploitable by a local attacker via a crafted HTML page. The CVSS scope change (S:C) confirms the exploit crosses Chrome's sandbox security boundary, enabling impact on resources outside the browser process. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS is extremely low at 0.12% (2nd percentile), indicating minimal observed exploitation pressure.

Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) stems from an inappropriate implementation classified under CWE-346 (Origin Validation Error), enabling a remote attacker to exfiltrate limited cross-origin credential-related data via a crafted HTML page. Exploitation requires the target user to perform specific, undisclosed UI gestures - such as interacting with a password field or autofill prompt - on the attacker's page, limiting mass-scale automation. No public exploit code or CISA KEV listing exists; EPSS at 0.18% (8th percentile) confirms low real-world exploitation probability, consistent with the mandatory social-engineering prerequisite.

Cross-origin data leakage in Google Chrome's Cast component allows an unauthenticated attacker positioned on the same local network segment to read data from origins they should not have access to via maliciously crafted network traffic. All Chrome versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA has not listed this in the KEV catalog, placing real-world risk at low-to-moderate despite the unauthenticated attack vector.

Sandbox escape in Google Chrome for Android (prior to 151.0.7922.72) stems from a type confusion flaw (CWE-843) in the Tab component, enabling an attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a crafted HTML page. This is a second-stage exploit primitive requiring renderer pre-compromise, reflected in the AC:H and S:C CVSS metrics. No active exploitation has been confirmed (not in CISA KEV), and EPSS sits at 0.20% (10th percentile), consistent with a chained, complex attack rather than opportunistic mass exploitation. Patch is available as Chrome 151.0.7922.72.

Omnibox spoofing in Google Chrome for Android prior to 151.0.7922.72 allows a local attacker to display falsified URLs in the browser's address bar by delivering a malicious file to the target device. The flaw stems from insufficient validation of untrusted input in the Mobile component, classified under CWE-20. With EPSS at 0.11% (2nd percentile) and no CISA KEV listing, real-world exploitation risk is low, though successful exploitation could undermine user trust in the displayed URL and facilitate phishing on compromised or shared devices.

Cross-origin data leakage in Google Chrome's favicon subsystem (all versions prior to 151.0.7922.72) allows remote attackers to infer cross-origin state by serving a crafted HTML page that exploits inappropriate favicon handling behavior. The CVSS vector (PR:N/UI:R/C:L) confirms unauthenticated network exploitation requiring victim interaction, with limited confidentiality impact. No public exploit code has been identified and EPSS probability stands at 0.22% (12th percentile), indicating this remains a researcher-reported issue with no observed mass exploitation.

Cross-origin data leak in Google Chrome on Windows (prior to 151.0.7922.72) stems from uninitialized memory use in the WebNN subsystem, exposing fragments of memory that may contain data from other origins. A remote attacker can trigger this flaw by luring a victim to a crafted HTML page, requiring no authentication but necessitating user interaction. No public exploit identified at time of analysis; EPSS sits at just 0.20% (10th percentile), consistent with a medium-severity information disclosure with no code execution potential.

Cross-origin data leakage in Google Chrome prior to version 151.0.7922.72 allows remote attackers to read data across origin boundaries by inducing a user to visit a specially crafted HTML page. The flaw resides in Chrome's network layer and is classified as CWE-346 (Origin Validation Error), meaning the browser fails to properly enforce origin boundaries during certain network operations. No active exploitation has been confirmed (not in CISA KEV), and EPSS places exploitation probability at 0.18% (8th percentile), indicating low current threat activity despite widespread browser deployment.

Side-channel information leakage in Chrome's Autofill component exposes cross-origin data to remote attackers who have already achieved renderer process compromise. All Chrome versions prior to 151.0.7922.72 are affected across all platforms. With an EPSS of 0.22% (12th percentile), no CISA KEV listing, and a mandatory renderer-compromise prerequisite, real-world exploitation risk is substantially lower than the CVSS base score implies - this is a chained second-stage disclosure, not a standalone attack. No public exploit identified at time of analysis.

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to manipulate the displayed URL via malicious network traffic, deceiving users about the true origin of page content. The flaw is iOS-platform-specific and classified under CWE-451 (UI Misrepresentation of Critical Information), making it a phishing-enablement vulnerability rather than a code execution or data-exfiltration primitive. No public exploit or active exploitation has been identified at time of analysis; EPSS probability is very low at 0.20% (10th percentile).

Cross-origin data leakage in Google Chrome's Cast subsystem (versions prior to 151.0.7922.72) allows unauthenticated attackers on the same local network segment to extract sensitive cross-origin browser data via crafted network traffic. The insufficient input validation in the Cast component bypasses browser isolation boundaries, exposing data from origins the victim is actively browsing. No public exploit code or active exploitation (CISA KEV) has been identified, and an EPSS of 0.12% (2nd percentile) reflects very low near-term exploitation probability.

Cross-origin data leakage in Google Chrome prior to 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a user to a crafted HTML page exploiting an origin validation flaw in the CSS engine. The vulnerability is classified under CWE-346 (Origin Validation Error) and is confirmed patched in the 151.0.7922.72 stable channel release. No public exploit code has been identified, SSVC rates exploitation as none, and EPSS sits at 0.18% - all consistent with low near-term exploitation likelihood.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 allows a remote attacker to deceive users about the origin or content of a web page by exploiting a race condition via a crafted HTML page. The vulnerability requires the victim to visit the attacker-controlled page (UI:R), but no authentication or elevated privileges are needed. No public exploit code or CISA KEV listing exists at time of analysis; EPSS places exploitation probability at 0.14% (4th percentile), indicating low observed exploitation activity despite medium CVSS severity.

Domain spoofing via incorrect security UI in Google Chrome's built-in Passwords feature affects all Chrome versions prior to 151.0.7922.72. Remote unauthenticated attackers can serve a crafted HTML page that causes Chrome to misrepresent the origin domain within the password management UI, enabling deception of users into associating saved credentials with an attacker-controlled domain. No public exploit code has been identified at time of analysis, and EPSS at 0.18% (8th percentile) signals very low automated exploitation probability, though Chrome's ubiquitous deployment makes even low-probability credential phishing scenarios broadly impactful.

UI spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to misrepresent browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page, potentially deceiving users into believing they are interacting with a trusted site or legitimate browser chrome. The vulnerability maps to CWE-451 (UI Misrepresentation of Critical Information) and carries a High integrity impact despite no direct confidentiality or availability loss, because successful spoofing can facilitate credential theft or social engineering at scale. No public exploit identified at time of analysis, and EPSS at 0.17% (7th percentile) reflects low current opportunistic exploitation probability.

Domain spoofing in Google Chrome on iOS prior to 151.0.7922.72 allows a remote unauthenticated attacker to misrepresent the displayed origin in the browser's security UI by delivering a crafted HTML page to a victim. The flaw (CWE-451) enables phishing-class attacks where the address bar or site identity indicator shows a trusted domain while content is served from a different origin. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), indicating low automated exploitation likelihood, but the integrity impact is high for targeted phishing campaigns against iOS Chrome users.

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables remote attackers to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to a victim. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N) confirms the attack is network-reachable with no attacker authentication, though it requires the victim to interact with a malicious page. No public exploit code or active exploitation has been identified; EPSS sits at 0.17% (7th percentile), indicating low current exploitation interest despite the vendor-confirmed patch.

Cross-origin data leakage in Google Chrome's Passwords component (prior to 151.0.7922.72) allows a remote attacker to read credential or password-related data across origin boundaries by enticing a user to visit a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the Passwords feature, where Chrome fails to properly enforce same-origin constraints. No public exploit code has been identified and SSVC signals no known active exploitation, placing this in the medium-priority tier despite Chrome's ubiquitous deployment footprint.

UI spoofing in Google Chrome's Passwords component prior to version 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to manipulate the browser's password-related interface via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Passwords subsystem, allowing integrity-impacting spoofing of security-sensitive UI elements such as password prompts or save/fill dialogs. No public exploit code has been identified at time of analysis, and EPSS places exploitation probability at 0.21% (11th percentile), consistent with the elevated prerequisite of a prior renderer compromise.

Cross-origin data leakage in Google Chrome's built-in Passwords component (versions prior to 151.0.7922.72) allows a remote, unauthenticated attacker to read cross-origin data by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error) within the password management subsystem, meaning the browser fails to correctly validate origin boundaries when the Passwords component processes or exposes credential-related data. EPSS exploitation probability is very low at 0.21% (11th percentile), no public exploit code exists, and this CVE is not listed in the CISA KEV catalog, indicating low observed real-world exploitation pressure despite the ubiquity of the affected product.

UI spoofing in Google Chrome for iOS prior to version 151.0.7922.72 enables a remote attacker to misrepresent critical browser interface elements - such as the address bar or security indicators - by delivering a crafted HTML page to the victim (CWE-451). The CVSS vector assigns high integrity impact (I:H) with no privileges required from the attacker, but mandates user interaction (UI:R), meaning the victim must visit the malicious page. No public exploit identified at time of analysis, and an EPSS score of 0.17% at the 7th percentile indicates very low observed exploitation interest; Chromium's own severity rating of Medium aligns with this assessment.

Cross-origin data leakage in Google Chrome for iOS (versions prior to 151.0.7922.72) allows remote attackers to read cross-origin data by delivering a crafted HTML page that socially engineers the victim into performing specific UI gestures. The root cause is an inappropriate implementation classified under CWE-346 (Origin Validation Error), meaning Chrome's iOS-specific code fails to correctly enforce same-origin policy boundaries under particular interaction sequences. No active exploitation has been confirmed - CISA KEV status is absent, SSVC exploitation rating is 'none', and EPSS sits at 0.21% (11th percentile) - placing this firmly in the low-priority tier despite its network delivery vector.

UI spoofing via race condition in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about page origin or security context by serving a crafted HTML page. The vulnerability stems from CWE-362 (concurrent execution with improper synchronization), allowing an attacker to manipulate browser UI elements - such as the address bar or security indicators - during a timing window. No active exploitation is confirmed (EPSS 0.17%, 7th percentile; not listed in CISA KEV), and Google has released a patch in the stable channel update.

Cross-origin data leakage in Google Chrome's Autofill subsystem prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The flaw is rooted in insufficient policy enforcement (CWE-346: Origin Validation Error) within Chrome's Autofill feature, which fails to correctly gate form data access by origin. No public exploit code has been identified and CISA SSVC rates active exploitation as none, placing real-world risk well below what the network-based attack vector alone might suggest.

UI spoofing in Google Chrome's WebAppInstalls component (all versions prior to 151.0.7922.72) allows a remote attacker to misrepresent critical interface elements through a crafted HTML page, deceiving users into interacting with fraudulent Chrome UI. The flaw stems from inappropriate implementation in the Progressive Web App installation flow, rated CVSS 6.5 with high integrity impact reflecting the attacker's ability to manipulate perceived interface state. No public exploit identified at time of analysis, and an EPSS of 0.17% (7th percentile) confirms negligible observed exploitation activity.

Cross-origin data leakage in Google Chrome's ReportingAndNEL subsystem (versions prior to 151.0.7922.72) allows a remote attacker to exfiltrate limited cross-origin information by delivering a crafted HTML page to a victim user. The flaw stems from an origin validation error (CWE-346) in the Network Error Logging and Reporting API implementation. No public exploit code has been identified and SSVC confirms exploitation status as none, but the combination of a network attack vector, no privilege requirement, and ubiquitous browser deployment makes patch application a straightforward priority.

Cross-origin data leak in Google Chrome's GuestView component (all desktop versions prior to 151.0.7922.72) enables remote attackers to read cross-origin content by luring a victim to a crafted HTML page. The flaw stems from insufficient policy enforcement (CWE-346, Origin Validation Error) within the GuestView subsystem, which handles embedded guest content such as <webview> elements in Chrome Apps and extensions. No public exploit code has been identified and CISA has not added this to the KEV catalog; an EPSS of 0.21% at the 11th percentile confirms low exploitation probability at time of analysis.

UI spoofing via the DigitalCredentials API in Google Chrome prior to 151.0.7922.72 allows a remote, unauthenticated attacker to deceive users about the legitimacy or origin of credential-related dialogs through a crafted HTML page. The vulnerability stems from an inappropriate implementation in Chrome's handling of the DigitalCredentials web API (CWE-451), enabling misrepresentation of critical UI information. No active exploitation is confirmed (no CISA KEV listing), and with an EPSS score of 0.17% at the 7th percentile, real-world exploitation probability is currently very low.

Cross-origin data leakage in Google Chrome's Dawn WebGPU component (versions prior to 151.0.7922.72) enables remote attackers to read cross-origin data via a crafted HTML page that triggers uninitialized memory use (CWE-457). Exploitation requires the victim to visit an attacker-controlled page but demands no authentication and operates against default Chrome configurations. No public exploit has been identified at time of analysis and the EPSS score of 0.23% (14th percentile) reflects a currently low exploitation likelihood, consistent with Chromium's own Medium severity rating.

Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) enables an attacker who has already achieved renderer-process compromise to break out of Chrome's sandbox via a crafted HTML page. The vulnerability stems from insufficient input validation (CWE-20) in the Extensions subsystem, with a CVSS Scope:Changed rating confirming the impact extends beyond the browser process to the host OS. No public exploit has been identified and EPSS sits at 0.17% (7th percentile), consistent with absence from CISA KEV - but the sandbox escape class carries disproportionate risk relative to its 5.8 base score because it enables full host-level code execution when chained with a renderer RCE.

Cross-origin data leakage in Google Chrome's WebGL implementation on Android allows a remote attacker to read memory contents belonging to other origins via a crafted HTML page. Affected versions are all Chrome for Android releases prior to 151.0.7922.72. The vulnerability stems from uninitialized memory use (CWE-457) in the WebGL subsystem, exposing stale memory that may contain sensitive cross-origin data. No public exploit code exists and EPSS sits at 0.23% (14th percentile), indicating low current exploitation probability; this is not listed in CISA KEV.

Sandbox escape in Google Chrome's Extensions component (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to break out of the browser sandbox via a crafted HTML page. The CVSS Scope:Changed metric confirms this is a true sandbox escape, elevating impact beyond the renderer isolation boundary. No public exploit code exists and EPSS stands at 0.17% (7th percentile), reflecting the chained, high-complexity nature of the attack. Google has released a patched stable channel build (151.0.7922.72).

Side-channel GPU information leakage in Google Chrome on Android prior to 151.0.7922.72 enables remote attackers to extract cross-origin data by serving a crafted HTML page. The vulnerability exploits the GPU rendering pipeline to observe timing or state artifacts that escape the Same-Origin Policy boundary, allowing partial disclosure of data from other origins loaded in the browser. No active exploitation has been confirmed (not in CISA KEV), and the EPSS score of 0.17% (7th percentile) reflects low observed exploitation probability; a vendor-released patch is available.

Memory disclosure in Google Chrome's MediaRecording subsystem allows remote attackers to read sensitive data from the browser process by enticing a user to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across supported platforms. No public exploit exists and EPSS probability stands at only 0.21% (11th percentile); SSVC also assesses exploitation as none and the attack as non-automatable, making this a patch-track rather than emergency-response priority despite the CVSS 6.5 base score.

Cross-origin data leakage in Google Chrome's Cast feature affects all versions prior to 151.0.7922.72, enabling a remote attacker to read data across origin boundaries by luring a user to a crafted HTML page. The flaw stems from improper origin validation (CWE-346) within the Cast subsystem, violating the Same-Origin Policy. No public exploit has been identified and EPSS sits at 0.21% (11th percentile), indicating limited real-world exploitation pressure at time of analysis.

Side-channel information leakage in Chrome's WebXR implementation allows remote attackers to read potentially sensitive data from process memory by luring a user to a crafted HTML page. Affected are all Google Chrome desktop versions prior to 151.0.7922.72. No active exploitation has been identified (not in CISA KEV), EPSS sits at the 11th percentile, and SSVC rates this as non-automatable with partial technical impact, indicating limited real-world threat despite the high confidentiality CVSS sub-score.

Cross-origin data leakage via an inappropriate GetUserMedia implementation in Google Chrome prior to 151.0.7922.72 enables a renderer-level attacker to exfiltrate data across origin boundaries using a crafted HTML page. Exploitation is gated behind a prior renderer process compromise, making this a chained or post-exploitation capability rather than a standalone initial-access vector. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), reflecting low real-world exploitation probability despite the broad deployment footprint of Chrome.

Omnibox (URL bar) spoofing in Google Chrome for Android prior to 151.0.7922.72 enables a remote attacker who has already compromised the renderer process to display arbitrary URL content in the address bar via a crafted HTML page. This is explicitly a second-stage chained vulnerability - renderer compromise is a mandatory prerequisite, meaning the flaw functions as an escalation primitive rather than a standalone attack. No public exploit has been identified and the EPSS score of 0.21% (11th percentile) reflects very low opportunistic exploitation probability, though the phishing and credential-theft potential when chained with a renderer exploit is meaningful.

UI spoofing in Google Chrome's Messages component on Android allows remote unauthenticated attackers to misrepresent critical interface information to victims via crafted HTML pages. Affects all Chrome for Android versions prior to 151.0.7922.72; desktop Chrome is not listed as affected. No public exploit identified at time of analysis, and EPSS at 0.21% (11th percentile) signals low current exploitation probability consistent with the mandatory user-interaction requirement.

UI spoofing via Chrome's Credential Management component (versions prior to 151.0.7922.72) enables a remote attacker to misrepresent credential-related browser UI to a user who visits a crafted HTML page. The flaw stems from an inappropriate implementation of the Credential Management API (CWE-451), which can cause the browser to render misleading prompts that mimic legitimate credential dialogs. No public exploit code or active exploitation (CISA KEV) has been identified, and EPSS probability is very low at 0.21%, consistent with SSVC's 'Exploitation: none' classification.

UI spoofing in Google Chrome's Payments component (versions prior to 151.0.7922.72) can be achieved by a remote attacker who has already compromised the renderer process, enabling deceptive payment interfaces via a crafted HTML page. The CVSS vector scores integrity impact as High (I:H) with no confidentiality or availability impact, reflecting the ability to mislead users through falsified UI elements in a sensitive financial context. No public exploit code has been identified at time of analysis, and EPSS is very low at 0.21% (11th percentile), indicating this vulnerability is not yet being actively targeted at scale.

Uninitialized memory read in ANGLE (Chrome's graphics abstraction layer) on Windows exposes potentially sensitive process memory contents to remote attackers via a crafted HTML page. Affected are all Google Chrome releases on Windows prior to 151.0.7922.72. An attacker who persuades a user to visit a malicious page can trigger the ANGLE component to read and potentially leak uninitialized memory, risking disclosure of in-process data. No public exploit code has been identified and EPSS stands at 0.23% (14th percentile), indicating low observed exploitation probability despite the broad deployment footprint of Chrome.

Cross-origin data leakage in Google Chrome's Blink rendering engine (all versions prior to 151.0.7922.72) enables remote attackers to read data from other origins by luring a user to a crafted HTML page. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N) confirms the attack is network-delivered, requires no authentication, and succeeds with only user interaction - a single page visit. EPSS of 0.21% (11th percentile) and absence from CISA KEV indicate low exploitation probability and no confirmed active exploitation at time of analysis.

Cross-origin data leakage in Google Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) enables a remote attacker to read fragments of sensitive data from other origins by directing a user to a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) in ANGLE, Chrome's cross-platform OpenGL ES abstraction engine, which may expose residual graphics buffer contents from previously rendered cross-origin content. No public exploit code and no active exploitation have been identified at time of analysis; EPSS of 0.23% (14th percentile) reflects low near-term exploitation probability.

Cross-origin data leakage in Google Chrome's Loader component (all versions prior to 151.0.7922.72) enables a remote attacker to read data from a different web origin by inducing a victim to visit a crafted HTML page. The flaw is rooted in an inappropriate implementation of origin validation (CWE-346) within the resource-loading subsystem, undermining the browser's Same-Origin Policy enforcement. No public exploit code has been identified and EPSS sits at 0.17% (7th percentile), indicating low exploitation likelihood at this time; however, the impact class is meaningful for users with active authenticated sessions to sensitive web applications.

Omnibox (URL bar) spoofing in Google Chrome for iOS prior to 151.0.7922.72 enables a remote attacker to deceive users about the actual origin of the page they are viewing by serving a crafted HTML page. The flaw is a CWE-451 UI misrepresentation defect, meaning the browser fails to accurately convey security-critical location information to the user, creating a reliable phishing vector. No public exploit code exists and EPSS sits at 0.21% (11th percentile); SSVC confirms exploitation as none and technical impact as partial, placing this firmly in lower-priority remediation tiers despite the phishing relevance.

Cross-origin data leakage in Google Chrome's Autofill component (versions prior to 151.0.7922.72) allows remote attackers to read data from a different origin than the page being visited. Exploitation requires the victim to interact with a specially crafted HTML page, placing this firmly in the social-engineering/phishing threat model. No public exploit code has been identified and EPSS sits at 0.21% (11th percentile), indicating negligible observed exploitation activity; this is not currently listed in CISA KEV.

Cross-origin data leakage in Google Chrome's Presentation API prior to version 151.0.7922.72 enables remote attackers to exfiltrate sensitive same-browser data by delivering a crafted HTML page to an unsuspecting user. The flaw violates the Same-Origin Policy through an origin validation error (CWE-346) in the PresentationAPI component, potentially exposing session tokens, authentication state, or other sensitive content from co-resident origins. No public exploit has been identified and EPSS sits at the 11th percentile (0.21%), indicating low mass-exploitation risk at time of analysis.

Cross-origin data leakage in Google Chrome's Cast subsystem (all versions prior to 151.0.7922.72) enables a remote unauthenticated attacker to exfiltrate sensitive cross-origin data by luring a victim to a specially crafted HTML page. The vulnerability, rated Medium by the Chromium security team with a CVSS of 4.3, is bounded to a limited confidentiality impact with no code execution risk. No active exploitation is confirmed in CISA KEV, and EPSS at 0.21% (11th percentile) indicates a very low probability of widespread in-the-wild exploitation at time of analysis.

Out-of-bounds memory read in Google Chrome's WebGL implementation (versions prior to 151.0.7922.72) allows a remote attacker to disclose limited browser process memory contents when a victim visits a crafted HTML page. Impact is confined to partial confidentiality - no write primitive exists, ruling out direct code execution. No public exploit has been identified and SSVC confirms no active exploitation, placing this in a lower-priority patch tier despite its network-accessible attack vector.

Cross-origin data leakage in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, exploitable by a remote unauthenticated attacker through a crafted HTML page that a victim must visit. The flaw stems from uninitialized memory use in Skia (CWE-457), allowing stale heap or stack data to be read and potentially exfiltrated across origin boundaries, undermining the browser's same-origin policy protections. No public exploit code has been identified at time of analysis, and EPSS probability is low at 0.23% (14th percentile), but the patch is confirmed available and the product's ubiquitous deployment makes broad-surface exposure a consideration.

Out-of-bounds read in the Media component of Google Chrome on macOS enables sandbox escape for attackers who have already compromised the renderer process. Affected versions are all Chrome for Mac builds prior to 151.0.7922.72; the vendor has released a patched build. No public exploit is identified at time of analysis and EPSS is very low (0.21%, 11th percentile), but the Scope:Changed CVSS metric confirms this crosses Chrome's renderer sandbox boundary - a high-value primitive in multi-stage exploit chains targeting macOS users.

Cross-origin data leakage in Google Chrome's Cast component exposes sensitive information across origins to remote attackers who can induce a victim to visit a crafted HTML page. All Chrome desktop versions prior to 151.0.7922.72 are affected across Windows, macOS, and Linux. No public exploit code or CISA KEV listing exists at time of analysis, and EPSS at 0.21% (11th percentile) reflects low current exploitation probability, consistent with Google's own 'Medium' severity classification.

Cross-origin data leakage in Google Chrome's WebView component on Android (versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by delivering a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, making it a chained exploit rather than a standalone attack. No active exploitation is confirmed in CISA KEV, and EPSS is 0.21% (11th percentile), consistent with low observed exploitation activity despite Chrome's ubiquitous deployment footprint.

Cross-origin data leakage in Google Chrome for Android (prior to 151.0.7922.72) allows a local attacker to read clipboard contents belonging to a different browsing origin by luring a victim to a crafted HTML page. The flaw arises from insufficient input validation in Chrome's Clipboard component on Android, classified under CWE-20. No public exploit code exists and no active exploitation has been confirmed; EPSS of 0.13% at the 3rd percentile reflects a minimal real-world exploitation probability at this time.

Cross-origin data leakage in Google Chrome's WebProtect component (prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate cross-origin data by loading a crafted HTML page. The flaw stems from an inappropriate implementation of origin validation (CWE-346), allowing WebProtect to fail its primary function of enforcing same-origin boundaries within Chrome's sandboxed renderer. No active exploitation has been confirmed by CISA KEV, no public POC has been identified, and EPSS at 0.21% (11th percentile) indicates low near-term exploitation probability - though this vulnerability's relevance as a component in chained browser exploit chains elevates its strategic significance beyond the raw score.

Cross-origin data leakage in Google Chrome's GPU implementation prior to version 151.0.7922.72 allows a remote attacker who has already compromised the renderer process to read cross-origin rendered content via a crafted HTML page. The flaw stems from an origin validation error (CWE-346) in the GPU compositor layer, enabling sandbox-escaped renderer processes to access pixel or texture data belonging to other security origins. EPSS at 0.21% (11th percentile) and no CISA KEV listing indicate low current exploitation probability; no public exploit code has been identified at time of analysis.

Cross-origin data leakage in Google Chrome for iOS prior to 151.0.7922.72 exposes sensitive information from other browser origins when a user visits a specially crafted HTML page. The root cause is an inappropriate implementation of origin validation (CWE-346) within Chrome's iOS-specific code path, breaking the browser's same-origin policy boundary. No public exploit code or active exploitation has been identified; EPSS probability stands at 0.21% (11th percentile), and the vulnerability is absent from the CISA KEV catalog, indicating low near-term exploitation pressure.

Cross-origin data leakage in Google Chrome's NoStatePrefetch feature exposes confidential resources across origin boundaries when a victim visits an attacker-crafted HTML page, affecting all Chrome versions prior to 151.0.7922.72. The flaw exploits observable side-channel signals produced during background prefetch operations to infer cross-origin state, violating Same-Origin Policy protections. No public exploit or active exploitation has been identified; EPSS sits at 0.21% (11th percentile), indicating low near-term exploitation likelihood despite the product's ubiquitous deployment footprint.

Uninitialized memory use in Google Chrome's codec subsystem allows remote attackers to read potentially sensitive data from process memory by enticing a user to visit a crafted HTML page. Affected are all Chrome desktop builds prior to version 151.0.7922.72 on all supported platforms. No public exploit code has been identified and EPSS sits at a low 0.23%, indicating limited exploitation activity at time of analysis, though the high confidentiality impact (CVSS C:H) means successful exploitation could expose sensitive browser process memory including cached credentials or session tokens.

Cross-origin data leakage in Google Chrome's Skia graphics engine affects all Chrome versions prior to 151.0.7922.72, enabling remote attackers to read sensitive data across browser security boundaries when a victim visits a specially crafted HTML page. The root cause is uninitialized memory use (CWE-457) within the Skia 2D rendering library, which may expose residual memory contents - potentially including fragments from other origins - violating the Same-Origin Policy at the memory level. No public exploit code has been identified and EPSS sits at 0.23% (14th percentile), indicating low exploitation probability at time of analysis despite the vulnerability being remotely triggerable without authentication.

UI spoofing in Google Chrome's Extensions component enables an attacker who persuades a victim to install a malicious extension to misrepresent browser security indicators, affecting all Chrome desktop versions prior to 151.0.7922.72. The flaw (CWE-451) stems from incorrect rendering of security UI elements within the Extensions subsystem, granting a crafted extension the ability to deceive users about their browser's security state or extension permissions. No public exploit identified at time of analysis, and EPSS at 0.13% (3rd percentile) reflects very low exploitation probability; this CVE is not listed in CISA KEV.

Cross-origin data leakage in Google Chrome's Autofill subsystem (all versions prior to 151.0.7922.72) enables a remote attacker to read sensitive form data across origins by serving a crafted HTML page to the victim. The root cause is an origin validation error (CWE-346) where the Autofill implementation fails to enforce proper origin boundaries, violating the browser same-origin policy for autofill-populated fields. No public exploit code has been identified and the EPSS score of 0.21% places this in the 11th percentile, indicating very low current exploitation probability; a vendor patch is available.

UI spoofing in Google Chrome's Payments component on Android allows a remote attacker who has already achieved renderer process compromise to deceive victims through manipulated payment dialogs via a crafted HTML page. All Chrome for Android versions prior to 151.0.7922.72 are affected. No public exploit code exists and CISA SSVC confirms no active exploitation, placing this firmly in the lower-priority tier despite its network-accessible attack vector.

Sandbox escape potential in Google Chrome's Skia graphics library affects all versions prior to 151.0.7922.72, requiring an attacker to have already compromised the renderer process. By delivering a crafted HTML page to a victim with a pre-compromised renderer, an attacker can trigger a Skia out-of-bounds read to break the Chrome sandbox boundary and escalate access beyond the renderer's isolation. No public exploit or KEV listing is identified at time of analysis; EPSS at 0.21% (11th percentile) reflects low current exploitation probability consistent with the elevated attack chain complexity.

Cross-origin data leakage in Google Chrome's Payments subsystem prior to version 151.0.7922.72 allows a remote attacker to exfiltrate limited cross-origin information by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346) within the Payments component, meaning Chrome fails to properly validate origin boundaries when handling payment-related operations. No public exploit code has been identified and EPSS is very low (0.21%), but the ubiquitous deployment of Chrome elevates aggregate exposure.

Cross-origin data leakage in Google Chrome's ANGLE graphics component (versions prior to 151.0.7922.72) exposes residual memory contents to remote attackers via a crafted HTML page. ANGLE - Chrome's graphics abstraction layer - fails to initialize memory before use (CWE-457), allowing pixel or buffer data from one origin to be read by another. No public exploit identified at time of analysis; EPSS probability is 0.23% (14th percentile), indicating low current exploitation activity despite Chrome's massive deployment footprint.

Sandbox escape in Google Chrome's WebView component on Android enables a remote attacker who has already compromised the renderer process to break out of Chrome's security sandbox via a specially crafted HTML page. Affected versions are all Chrome releases on Android prior to 151.0.7922.72. This is a chained attack: the flaw alone is insufficient - exploitation requires a prior, separate renderer compromise, which substantially raises the real-world exploitation bar. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog; EPSS sits at a low 0.21%.

Cross-origin data leakage in Google Chrome's QUIC implementation on Android, affecting all versions prior to 151.0.7922.72, allows a remote attacker to exfiltrate data across origin boundaries by directing a user to a crafted HTML page. The root cause is an inappropriate QUIC implementation that fails to properly enforce origin validation (CWE-346), breaking the browser's same-origin security model. No public exploit code exists and no active exploitation is confirmed; EPSS of 0.21% at the 11th percentile corroborates low real-world risk at time of analysis.

Cross-origin data leakage in Google Chrome's Autofill feature on Android prior to 151.0.7922.72 allows a remote unauthenticated attacker to read limited data belonging to another origin by luring a victim to a specially crafted HTML page. The flaw is classified as CWE-346 (Origin Validation Error), meaning the Autofill subsystem fails to enforce same-origin boundaries when processing or exposing form data. No active exploitation is confirmed (SSVC: Exploitation none; EPSS 0.21%, 11th percentile), and a vendor patch is available in the 151.0.7922.72 stable release.

Side-channel information leakage in Google Chrome's Autofill feature (versions prior to 151.0.7922.72) enables cross-origin data exfiltration by exploiting observable behavioral differences during Autofill interactions. An unauthenticated remote attacker who delivers a crafted HTML page and persuades the victim to perform specific UI gestures can infer data belonging to other origins, bypassing Same-Origin Policy protections. EPSS is very low at 0.21% (11th percentile) and no active exploitation is confirmed via CISA KEV, making this a real but modest real-world risk - primarily meaningful where sensitive Autofill data (saved addresses, payment details) is stored in the target browser profile.

Cross-origin data leakage in Google Chrome's SVG implementation (all versions prior to 151.0.7922.72) enables remote attackers to read data from cross-origin resources by luring a victim to a crafted HTML page. The flaw, rooted in an origin validation error (CWE-346) in Chrome's SVG rendering engine, breaks same-origin policy protections. No public exploit identified at time of analysis; EPSS at 0.21% (11th percentile) and SSVC exploitation status of 'none' collectively indicate low near-term exploitation probability.

Cross-origin data leakage in Google Chrome's Passwords component (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to exfiltrate password data across origin boundaries via a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346: Origin Validation Error), meaning the browser's same-origin policy is not correctly applied within the Passwords subsystem when the renderer is already under attacker control. No public exploit code exists and no confirmed active exploitation has been observed; EPSS sits at 0.21% (11th percentile), and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but architecturally significant renderer sandbox concern.

Cross-origin data leakage in Google Chrome's Passwords feature prior to version 151.0.7922.72 allows a remote attacker to read cross-origin data by convincing a victim to perform specific UI gestures on a crafted HTML page. Rated High severity by the Chromium security team - higher than the NVD CVSS base score of 3.1 suggests - reflecting the sensitivity of credential-adjacent cross-origin boundary violations. No public exploit identified at time of analysis, and SSVC assessment confirms no current exploitation activity.

Uninitialized memory use in Chrome's ANGLE graphics layer (all versions prior to 151.0.7922.72) allows a remote attacker to read potentially sensitive data from the browser's process memory by delivering a crafted HTML page. The CVSS C:H rating reflects the theoretical confidentiality impact, but SSVC rates technical impact as only partial and exploitation as none, and EPSS sits at 0.31% (24th percentile), indicating low observed real-world exploitation probability. No public exploit code has been identified at time of analysis, and no CISA KEV listing exists.

Uninitialized memory disclosure in Google Chrome's Media component on Windows exposes process memory to attackers who have already achieved renderer process compromise. Versions prior to 151.0.7922.72 are affected. A renderer-compromised attacker delivers a crafted HTML page to trigger a CWE-457 uninitialized variable read, potentially leaking sensitive in-memory data such as credentials, tokens, or cryptographic material. No public exploit has been identified at time of analysis, SSVC rates exploitation as none, and EPSS sits at 0.31% - indicating low observed exploitation pressure despite the High CVSS confidentiality impact.

Cross-origin data leakage in Google Chrome's Media component on Windows (versions prior to 151.0.7922.72) enables a remote attacker who has already compromised the renderer process to read cross-origin data via a crafted HTML page. The flaw is rooted in insufficient input validation (CWE-20) in the Media subsystem, exploitable only on Windows and only as a second-stage primitive following a prior renderer compromise. No public exploit code has been identified and EPSS is low at 0.29% (21st percentile), placing this firmly in the targeted-attacker rather than mass-exploitation threat category.

Cross-origin data leakage in Google Chrome's Skia graphics library (all versions prior to 151.0.7922.72) enables a remote attacker who has already achieved renderer process compromise to exfiltrate cross-origin data via a crafted HTML page. The flaw is a CWE-346 Origin Validation Error within Skia's rendering pipeline and is constrained to an information-disclosure impact with no integrity or availability consequence. No public exploit or CISA KEV listing exists, and EPSS at 0.29% (21st percentile) alongside SSVC Exploitation: none signal this is a low-probability exploitation scenario requiring a multi-stage attack chain.

Cross-origin data leakage in Google Chrome's Actor component (all versions prior to 151.0.7922.72) allows a remote attacker who has already compromised the renderer process to exfiltrate sensitive cross-origin data via a crafted HTML page. This is a secondary-stage information disclosure primitive - it requires both user interaction and a pre-compromised renderer, making it a chained exploit component rather than a standalone entry point. No public exploit or active exploitation has been identified; EPSS sits at 0.29% (21st percentile), consistent with low real-world exploitation likelihood at this time.

Side-channel information leakage in Google Chrome's Media component (versions prior to 151.0.7922.72) enables remote attackers to exfiltrate cross-origin data by luring a victim to a crafted HTML page that exploits observable timing or state signals in media processing. This bypasses the browser's Same-Origin Policy protections, allowing an attacker's origin to infer sensitive data loaded from a different origin. No public exploit has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation probability; a vendor-released patch is available.

Cross-origin data leakage in Google Chrome's FileSystem component prior to version 151.0.7922.72 enables a remote attacker to read data across origin boundaries by luring a victim to a crafted HTML page. The root cause is insufficient policy enforcement (CWE-346 Origin Validation Error) in Chrome's FileSystem API, which fails to enforce same-origin policy checks correctly, exposing data that should be sandboxed to its originating origin. No public exploit code has been identified at time of analysis, and the EPSS score of 0.29% (21st percentile) reflects low current exploitation likelihood; however, the vendor patch is available and should be applied promptly given Chrome's ubiquitous deployment footprint.