Information Disclosure

Server-side template injection in OpenStack Ironic through version 35.x allows authenticated administrators to disclose sensitive information by rendering unsandboxed Jinja2 templates in the instance_info['ks_template'] parameter. The vulnerability requires high-privilege user interaction and has low confidentiality impact with no integrity or availability consequences.

Availability degradation in Bouncy Castle BC-FJA cryptographic library versions 2.1.0 through 2.1.2 on Linux X86_64 systems with AVX or AVX-512f SIMD extensions affects GCM-128 and GCM-512 operations, allowing local attackers to cause denial of service without authentication. The vulnerability is associated with optimized assembly implementations (gcm128w, gcm512w) and results in availability impact with no confidentiality or integrity compromise. No public exploit code or active exploitation has been identified at time of analysis.

electerm 3.8.15 and prior exposes environment variables containing secrets through the getConstants() IPC handler, which serializes the entire process.env object and stores it as window.pre.env accessible to any JavaScript running in the renderer process. An attacker achieving JavaScript execution within the renderer-via DevTools, compromised webview, or client-side injection-can exfiltrate sensitive credentials to remote servers, enabling cloud account compromise and lateral movement. No public exploit code identified at time of analysis, but the vulnerability is trivial to exploit once renderer JavaScript execution is achieved.

Out-of-bounds read in ASUS System Control Interface IOCTL handler allows local authenticated users to trigger denial of service via oversized read operations. A local user with limited privileges can supply a read size exceeding the allocated buffer, causing a system crash (BSOD). No public exploit code or active exploitation has been confirmed at this time.

Remote unauthenticated attackers can forge JWT authentication tokens in AstrBot 3.5.15 by exploiting a hardcoded private key ('Advanced_System_for_Text_Response_and_Bot_Operations_Tool'), enabling full authentication bypass with subsequent remote code execution capabilities. Public exploit code exists on GitHub (Marven11/CVE-2025-55449-AstrBot-RCE) demonstrating weaponization of this cryptographic flaw. EPSS score of 0.00% suggests limited automated scanning activity, but the availability of working RCE exploit code significantly elevates practical risk for exposed instances.

Local privilege escalation in Raynet RayVentory Scan Engine through version 12.6 Update 8 stems from an uncontrolled search path (CWE-427): if an attacker can set the PATH environment variable used by the process, they can force execution of a malicious binary and gain elevated privileges. Publicly available exploit code exists (GitHub, Wise-Security), and CISA's SSVC framework marks technical impact as total and the flaw as automatable, but there is no confirmed active exploitation and EPSS is negligible (0.02%). Note the CVE is officially DISPUTED, since controlling the PATH environment is characterized as a site-specific misconfiguration rather than an inherent product flaw.

Vvveb before 1.0.8.2 exposes the application's secret cron key through an unauthenticated cron controller endpoint, allowing remote attackers to retrieve this sensitive credential and trigger scheduled tasks outside their intended execution windows. The vulnerability affects all deployments with the vulnerable cron controller accessible over the network, with CVSS 5.3 reflecting confidentiality impact from information disclosure without authentication requirements.

VINCE versions 3.0.38 and earlier fail to properly verify sender address authenticity due to encoding confusion, allowing unauthenticated remote attackers to forge email From addresses and trigger automated actions such as ticket creation or updates. The vulnerability combines information disclosure with integrity impact, affecting the reliability of ticket management workflows that depend on sender validation.

Unauthenticated information disclosure in FacturaScripts allows remote attackers to trigger phpinfo() output on fresh deployments via /?phpinfo=TRUE, exposing full PHP configuration, environment variables (including database credentials and API keys), filesystem paths, and loaded extensions. The vulnerability affects all versions with the Installer controller enabled and no patch has been released as of April 2026; publicly available proof-of-concept code exists demonstrating exploitation against PHP 8.1.34.

Go's html/template library incorrectly escapes data passed into <script> tags when the tag contains an empty or whitespace-only 'type' attribute, allowing a trusted template author to inadvertently expose sensitive information to client-side scripts. Affects html/template versions prior to 1.26.3 and 1.25.10. CVSS 6.1 with user interaction required; EPSS 0.01% indicates minimal real-world exploitation likelihood despite moderate base score.

The Go toolchain's 'go bug' command creates temporary files with predictable names in the system temporary directory, allowing local attackers with temporary directory access to create symlinks that cause arbitrary file overwrite. Affects Go 1.26.0 through 1.26.2 and 1.25.0 through 1.25.9. While CVSS 5.3 and EPSS 0.01% suggest moderate local impact, the vulnerability enables information disclosure and integrity compromise of arbitrary files via symlink redirection, confirmed patched in Go 1.26.3 and 1.25.10.

Go's net/http/httputil.ReverseProxy fails to account for url.ParseQuery's configurable query-parameter count limit (GODEBUG=urlmaxqueryparams=N) when sanitizing forwarded requests. An unauthenticated remote attacker can craft an HTTP request with a number of query parameters exceeding that limit, causing the proxy's Rewrite or Director function to never inspect parameters appended beyond the threshold - allowing hidden parameters to be silently forwarded to the backend. This is a security control bypass with confidentiality and potential integrity implications wherever the Rewrite function is relied upon as a gatekeeper for query-parameter validation. No public exploit has been identified at time of analysis; the Go team has released patches in versions 1.25.10 and 1.26.3.

FacturaScripts fails to strip EXIF and metadata from user-uploaded images in the Library module, allowing any authenticated user with download access to extract GPS coordinates, device information, timestamps, author names, and other personally identifiable information from downloaded files. An employee uploading a photo taken at their home inadvertently discloses their precise home address to all users with Library access. This affects all image uploads retroactively, with no patched version currently available.

Out-of-bounds read in OSGeo GDAL up to version 3.13.0dev-4 affects the GDfieldinfo function in HDF-EOS module when processing malformed HDF4 files. A locally authenticated attacker can trigger memory disclosure by crafting a specially formatted HDF4 file. Publicly available exploit code exists. The vulnerability is fixed in GDAL 3.13.0RC1 and later.

Privilege escalation in CISA's manage.get.gov 1.x allows organization administrators to assign domain manager privileges for domains outside their portfolio, including legacy domains not associated with any organization. The vulnerability enables cross-portfolio domain takeover scenarios where an authenticated admin can grant themselves or others unauthorized domain management access. Fixed in version 1.176.0 released April 30, 2026. No public exploit identified at time of analysis, EPSS risk assessment not available for this CVE.

Out-of-bounds read in OSGeo GDAL up to version 3.13.0dev-4 occurs in the HDF-EOS Grid File Handler when parsing malformed HDF4 files, allowing local authenticated attackers to read memory beyond buffer bounds. The vulnerability exists in the memmove operation within SWapi.c and GDapi.c that processes field information without proper bounds validation. Vendor-released patch available in version 3.13.0RC1; publicly available exploit code exists.

PHP 8.2.31 addresses a buffer overflow vulnerability (CVE-2026-7568) affecting PHP 8.2.x versions that results in information disclosure through out-of-bounds memory reads. The vulnerability requires specific attack preconditions (CVSS AC:H/AT:P) and unauthenticated remote access; exploitation impact is limited to partial disclosure of memory contents. No public exploit code or active exploitation has been identified at the time of analysis.

A buffer over-read vulnerability in PHP 8.2 prior to version 8.2.31 allows remote attackers to disclose sensitive information through a network vector with high attack complexity and partial attack time requirements. The vulnerability (CWE-125) affects information availability and system availability, with CVSS 6.3 indicating moderate risk. Vendor-released patch available in PHP 8.2.31.

Use-after-free memory corruption in PHP 8.2 prior to version 8.2.31 allows remote attackers to cause information disclosure or denial of service via network requests with low attack complexity. The vulnerability is addressed in PHP 8.2.31, released as a security update bundling fixes for eight CVEs including CVE-2026-7261. Patch availability is confirmed from the PHP development team.

Prototype pollution in query-string-parser 1.0.0 enables remote unauthenticated attackers to inject malicious properties into JavaScript object prototypes via crafted query parameters, achieving arbitrary code execution, privilege escalation, or denial of service in Node.js applications. CVSS 9.8 critical severity with network attack vector and no authentication required. EPSS score of 0.02% (4th percentile) indicates low observed exploitation probability despite critical rating. Publicly available proof-of-concept exists (GitHub Gist), but no CISA KEV listing confirms active exploitation. SSVC framework rates this as automatable with total technical impact but currently unexploited, suggesting opportunistic future risk rather than immediate widespread targeting.

Prototype pollution in the npm package parse-ini v1.0.6 lets remote attackers inject properties onto Object.prototype through crafted INI input parsed by index.js, potentially corrupting application state, enabling denial of service, or escalating to remote code execution in downstream Node.js applications. The flaw carries a CVSS 9.8 rating with total technical impact and is flagged automatable by CISA's SSVC, but EPSS is very low (0.02%, 5th percentile) and there is no public exploit identified at time of analysis beyond a reference gist. parse-ini is an obscure, low-adoption library, so real-world exposure is narrow despite the critical score.

Medtronic MyCareLink Patient Monitor stores per-product credentials in a recoverable (non-hashed or weakly encrypted) format, allowing physical attackers with device access to extract these credentials and modify encrypted drive data without authentication. Affected models include the 24950 and 24952 monitors. The vulnerability requires physical access to the device (CVSS AV:P) but grants full confidentiality, integrity, and availability impact to stored patient data.

Medtronic MyCareLink Patient Monitor models 24950 and 24952 expose an unauthenticated UART login prompt via an internal serial interface, allowing attackers with physical access to potentially gain administrative control without authentication. The vulnerability achieves high confidentiality, integrity, and availability impact (CVSS 6.8) but requires direct physical access to internal hardware connections, limiting real-world exploitation to scenarios involving device tampering or insider threats.

Remote attackers can cause excessive resource allocation and flooding attacks in DivvyDrive 4.8.2.19 through 4.8.3.1 by exploiting uncontrolled object attribute modification combined with absent resource throttling. The vulnerability permits low confidentiality impact but high integrity and availability compromise when a user interacts with attacker-controlled content. TR-CERT has issued an advisory, though no CISA KEV listing or public exploit code has been identified at time of analysis. EPSS data not available to assess exploitation probability.

Cryptobox external sharing feature leaks information via sharing link URLs that enables offline brute-force attacks against access codes. Remote unauthenticated attackers with knowledge of a sharing link can retrieve sufficient data from the server to conduct offline enumeration of the associated access code, compromising the confidentiality of shared content. No public exploit code has been identified, but the low attack complexity and network accessibility make this a practical vulnerability.

A low privileged remote attacker can gain the root password due to improper removal of sensitive information before storage or transfer. Rated high severity (CVSS 8.0), this vulnerability is remotely exploitable, low attack complexity.

Happy Addons for Elementor through version 3.20.8 exposes sensitive system information to unauthorized users via an information disclosure vulnerability, allowing remote unauthenticated attackers to retrieve embedded sensitive data without authentication or user interaction. The vulnerability affects all installations of the plugin up to and including version 3.20.8, with a CVSS score of 5.3 reflecting the confidentiality impact of exposed system data.

Improper restriction of excessive authentication attempts in Hitachi Virtual Storage Platform series (G-series, F-series, E-series, and One Block models) allows unauthenticated remote attackers to conduct brute-force credential attacks and potentially obtain sensitive information through repeated authentication probes without rate-limiting or account lockout mechanisms. The vulnerability affects multiple firmware versions across 28 distinct storage array models and is remotely exploitable without authentication from the network.

Security control bypass in vm2 sandbox allows direct access to internal VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL variable by exploiting a performance optimization in the code transformer that skips AST analysis when code lacks catch, import, or async keywords. Affected versions <= 3.10.5 expose internal security functions (handleException, wrapWith, import) and enable with-statement scope manipulation, creating a latent attack surface for future sandbox escapes. All applications using vm2 to execute untrusted code are affected; exploitation requires no special configuration or authentication.

Information disclosure in vm2 allows sandboxed code to extract host absolute file paths, library locations, and internal function names via stack trace inspection, enabling attackers to map the host server's directory structure and architecture without authentication or user interaction. The vulnerability affects all versions up to 3.10.5 and is triggered through either default error.stack formatting or custom Error.prepareStackTrace handlers; vendor-released patch available in version 3.11.0.

Host object identity crosses the vm2 sandbox boundary when Promise resolution delivers objects to sandbox callbacks, allowing sandboxed code to mutate host objects and perform identity checks via WeakMap. The vulnerability stems from Promise.prototype.then wrapping that uses ensureThis() for conversion instead of stronger cross-realm proxying; when no prototype mapping exists, ensureThis() returns the original host object unmodified. This sandbox escape affects vm2 versions up to 3.10.5 and is fixed in 3.11.0.

Istio versions prior to 1.28.6 and 1.29.2 allow authenticated attackers to perform Server-Side Request Forgery (SSRF) attacks via RequestAuthentication resources with malicious jwksUri values pointing to internal services, enabling istiod to fetch sensitive data from localhost or link-local IPs and distribute it to Envoy proxies through xDS configuration. The vulnerability requires an authenticated user to create or modify a RequestAuthentication resource, limiting the attack surface to cluster administrators or users with API access. A partial mitigation was released in earlier versions (1.29.1, 1.28.5, 1.27.8) but was incomplete; the complete fix is in versions 1.28.6 and 1.29.2.

OpenEXR versions 3.0.0-3.2.8, 3.3.0-3.3.10, and 3.4.0-3.4.10 suffer from unbounded shift operations in the readVariableLengthInteger() function when parsing variable-length integers from untrusted EXR files. Attackers can craft malicious EXR files with excessive continuation bytes to trigger left shifts exceeding 64 bits on a 64-bit integer, causing undefined behavior that may lead to information disclosure or denial of service. The vulnerability is remotely exploitable without authentication or user interaction against any application processing untrusted EXR input; no public exploit code has been identified at the time of analysis.

Spring Cloud Config Server exposes sensitive information in plaintext logs when trace logging is enabled, allowing high-privilege local users to access configuration data including credentials and API keys. The vulnerability affects versions 3.1.0-3.1.13, 4.1.0-4.1.9, 4.2.0-4.2.6, 4.3.0-4.3.2, and 5.0.0-5.0.2. No public exploit identified at time of analysis; vendor-released patches are available for all affected version lines.

Forminator Forms plugin for WordPress versions up to 1.53.0 allows authenticated subscribers to configure scheduled exports without authorization checks, enabling attackers to exfiltrate all form submissions by redirecting them to attacker-controlled email addresses. The vulnerability exists in the listen_for_saving_export_schedule() function which lacks the capability verification present in the parallel listen_for_csv_export() function, creating a direct authorization bypass for authenticated low-privilege users to access sensitive data collection and delivery mechanisms.

Kubetail Dashboard prior to version 0.14.0 fails to validate the Origin header on WebSocket connection upgrades, enabling Cross-Site WebSocket Hijacking (CSWSH) attacks. An authenticated user visiting a malicious web page can be exploited to stream their Kubernetes container logs-including credentials, tokens, and PII often present in logs-to an attacker-controlled server. The vulnerability affects both desktop deployments at localhost:7500 and cluster deployments behind HTTP basic auth, with browser ambient credentials automatically attached to the WebSocket handshake.

Tor before version 0.4.9.7 mishandles memory accounting in the conflux out-of-order queue during queue clearing operations, leading to a denial-of-service condition through resource exhaustion. Unauthenticated remote attackers can exploit this via network-level packet manipulation to trigger improper queue state management, causing availability degradation on affected Tor relays and clients. The vulnerability has a low severity CVSS score (3.7) due to attack complexity and availability-only impact, with no confirmed active exploitation at time of analysis.

Tor before version 0.4.9.7 can incorrectly attempt or accept BEGIN_DIR cells over conflux legs, a Tor relay multiplexing feature, enabling potential integrity violations in circuit construction. The vulnerability has a CVSS score of 3.7 (low severity) with impact limited to integrity rather than confidentiality or availability. No public exploit code or active exploitation has been identified at the time of analysis.

Free5GC Access and Mobility Function (AMF) versions up to 1.4.3 fail to enforce 3GPP TS 33.501 §6.9.5.1 concurrent security procedure rules, allowing NAS Security Mode Command (SMC) to execute simultaneously with N2 handover procedures. This causes security context mismatches between the UE and network when SMC activates a new KAMF while N2 HandoverRequest carries Next Hop (NH) and Next Hop Chaining Counter (NCC) derived from the old KAMF, resulting in different KgNB key derivation at the target gNB and UE and breaking access stratum (AS) security integrity. Source code analysis confirms missing cross-procedure validation in SecurityMode() and handleHandoverRequiredMain() functions; packet evidence demonstrates Rule 2 violation (SMC initiated during ongoing N2 handover).

Free5GC Access and Mobility Management Function (AMF) v4.2.1 and earlier fails to verify UE Security Capabilities in NGAP PathSwitchRequest messages, allowing a malicious gNB to overwrite the AMF's stored security algorithm preferences with arbitrary values. These corrupted capabilities are then propagated in PathSwitchRequestAcknowledge and subsequent HandoverRequest messages, causing all inter-gNB handovers for affected UEs to fail due to algorithm mismatches. This results in persistent handover denial-of-service until UE re-registration. The vulnerability is directly contrary to 3GPP TS 33.501 §6.7.3.1 verification requirements and has been demonstrated with a public proof-of-concept using Free5GC v4.2.1 and UERANSIM.

DNS rebinding vulnerability in Gotenberg allows unauthenticated remote attackers to bypass SSRF protections and access internal services via Chromium URL conversion routes. When a URL is submitted for PDF conversion, Gotenberg validates the resolved IP address against a deny-list but discards the pinned result. Chromium then performs independent DNS resolution multiple times, creating a race condition where an attacker controlling DNS can return a public IP during validation and a private IP during connection, allowing access to loopback services, cloud metadata endpoints, or internal networks. Exploitation succeeds approximately 10% per attempt with trivial automation.

Spring Cloud AWS SNS HTTP/HTTPS endpoint handlers (@NotificationMessageMapping, @NotificationSubscriptionMapping, @NotificationUnsubscribeConfirmationMapping) in versions 3.0.0-3.4.2, 4.0.0, and 4.0.1 fail to verify the cryptographic signature of incoming SNS messages, allowing unauthenticated attackers who know the endpoint URL to send forged SNS notifications, subscription confirmations, or unsubscribe requests. This enables attackers to trigger arbitrary message processing, auto-confirm malicious topic subscriptions, or force unsubscription from legitimate topics. Fixed in Spring Cloud AWS 4.0.2 with signature verification enabled by default; 3.x line receives no patch and must use workarounds.

Vercel CLI leaks authentication tokens in JSON output when running in non-interactive mode with credentials passed via command-line arguments. Affected versions 50.16.0 through 52.0.0 expose plaintext tokens in suggested follow-up commands when operations cannot complete autonomously, allowing token capture in CI/CD logs and automation transcripts. Information disclosure risk is elevated in automated deployment pipelines where CLI output is logged.

Weblate versions before 5.17.1 allow authenticated users to enumerate translations in projects they cannot access via the screenshots, tasks, and component link API endpoints. An attacker with valid credentials but no project access can probe these APIs to discover the existence and metadata of private translations, leading to information disclosure of project structure and language coverage that should remain hidden. The vulnerability requires authentication but has a low attack complexity, affecting confidentiality only without enabling further compromise.

Hono's bodyLimit() middleware fails to reliably enforce maxSize restrictions on chunked or unknown-length HTTP requests (Transfer-Encoding: chunked), allowing oversized payloads to reach application handlers and return HTTP 200 instead of 413 Payload Too Large. Versions prior to 4.12.16 are vulnerable when handlers do not fully read the request body, read only initial chunks before returning, or catch and suppress read errors. This bypasses the documented guarantee that oversized requests are rejected before business logic execution.

BSON operator injection in ShellHub Community v0.24.1 and earlier allows any authenticated user to crash the device list API endpoint by supplying MongoDB operators as filter field names or sort_by values without input validation. Two attack vectors exist in api/store/mongo/query-options.go: unvalidated filter param.Name values become raw BSON map keys, and the sort_by query parameter is passed directly into a $sort pipeline stage. A validated proof-of-concept exists against v0.24.1. No active exploitation is confirmed (not in CISA KEV), and EPSS sits at 0.06% (19th percentile), indicating low real-world exploitation probability despite a public PoC.

Unauthorized cross-owner data access in Backstage's catalog-backend-module-unprocessed plugin allows any authenticated user to read unprocessed entity records belonging to other teams or owners, bypassing the Backstage permission framework entirely. The vulnerability affects all installations of this optional plugin running versions prior to 0.6.11 of @backstage/plugin-catalog-backend-module-unprocessed, 0.0.15 of the common package, and 0.2.30 of the UI package. EPSS is 0.03% (7th percentile) and the vulnerability is not in CISA KEV, indicating low exploitation probability; however, in multi-tenant Backstage deployments the data exposure risk is real and no public exploit has been identified at time of analysis.

Timing side-channel in pyquorum's modular multiplication allows remote attackers to recover Shamir secret-sharing values by measuring operation latency. The `mul_mod` function in all versions prior to 0.2.1 uses a binary expansion loop whose iteration count and branch path vary with the Hamming weight of the secret-derived operand, creating a measurable timing oracle. Given sufficient query volume and low-latency network access to an exposed secret-sharing service, an attacker can statistically correlate timing measurements to progressively reconstruct protected secrets. No public exploit code has been identified at time of analysis; EPSS is 0.07% (21st percentile) and the vulnerability is not in CISA KEV.

Information disclosure in HP's Samsung Print Service Plugin for Android exposes high-confidentiality data to other local applications on the same device when an outdated version of the plugin is installed. CWE-926 (Improper Export of Android Application Components) indicates the root cause is improperly exported app components, allowing co-resident Android apps to access sensitive data without declared permissions. No active exploitation is confirmed (not in CISA KEV), EPSS is 0.01% at the 3rd percentile, and SSVC rates exploitation as none with non-automatable impact, making this a low-urgency but valid privacy concern requiring an application update.

Statamic CMS versions before 5.73.21 and 6.0-6.14.x disclose whether an email address is registered via differential responses from the forgot password endpoint, enabling unauthenticated attackers to enumerate valid user accounts and facilitate downstream credential-based attacks. The vulnerability has a CVSS score of 5.3 (low confidentiality impact) and no public exploit code or active exploitation has been identified.

Open redirect vulnerability in Masa CMS allows unauthenticated remote attackers to craft malicious URLs on trusted Masa CMS domains that redirect victims to attacker-controlled sites via improper validation of scheme-relative URLs (paths beginning with //). This can be exploited for phishing attacks and potential token exposure in certain authentication flows. The vulnerability affects versions prior to 7.2.10, 7.3.15, 7.4.10, and 7.5.3, with CVSS 5.3 (CVSS:4.0/AV:N/AC:L/PR:N/UI:P).

Information disclosure in PicoTronica e-Clinic Healthcare System ECHS 5.7 allows remote unauthenticated attackers to extract sensitive data via the Response Header Handler in the /cdemos/echs/api/v2/ endpoint. The vulnerability has been publicly disclosed with exploit code available, and a patch (version 5.7.1) has been released by the vendor.

Vvveb before version 1.0.8.2 allows unauthenticated remote attackers to disclose sensitive server information including absolute file paths, internal class namespaces, line numbers, and source code excerpts by accessing the admin password-reset endpoint and triggering a fatal error caused by missing namespace imports. The debug exception handler renders full stack traces to unauthenticated requests, enabling reconnaissance attacks without authentication or user interaction. No active exploitation confirmed, but the vulnerability is easily discoverable and exploitable over the network.

HCL BigFix Service Management (SX) is affected by a Broken Access Control vulnerability leading to privilege escalation. Rated high severity (CVSS 8.3), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

Uninitialized GPU memory disclosure in Google Chrome for Android (prior to 148.0.7778.96) enables a post-exploitation information leak from process memory. Exploitation requires that the attacker has already compromised the renderer process - making this a chained vulnerability, not a standalone entry point. No active exploitation is confirmed (not in CISA KEV, SSVC exploitation status: none), and EPSS sits at 0.03% (8th percentile), consistent with a low-real-world-priority issue despite the C:H confidentiality rating.

UI spoofing via insufficient WebApp policy enforcement in Google Chrome prior to 148.0.7778.96 allows a remote attacker to mislead users about the trustworthiness of browser UI elements by delivering a crafted HTML page. All Chrome users on versions below 148.0.7778.96 are affected across desktop platforms, including those on Red Hat and SUSE Linux distributions. No active exploitation has been identified (SSVC: none; EPSS 0.05%, 16th percentile), and the patch is vendor-confirmed available in the stable channel release.

Side-channel information leakage in the Media component of Google Chrome prior to 148.0.7778.96 enables remote attackers to read partial cross-origin data by enticing a user to visit a specially crafted HTML page. The flaw exploits measurable timing or resource-usage signals during media processing, violating browser Same-Origin Policy isolation at the side-channel level rather than through direct memory access. No public exploit code exists and EPSS exploitation probability is 0.03%, placing this firmly in low real-world priority - though it remains relevant for environments handling sensitive cross-origin data such as financial portals or SSO flows.

UI spoofing in Google Chrome's Media component prior to version 148.0.7778.96 enables remote attackers to deceive users via a specially crafted HTML page that abuses inappropriate media rendering behavior to misrepresent browser interface elements. The CVSS vector (PR:N/UI:R/S:U) indicates unauthenticated remote exploitation is possible but requires the victim to visit a malicious page, with limited confidentiality impact. SSVC classifies exploitation as none and automatable as no; EPSS at 0.06% (18th percentile) corroborates low exploitation likelihood, and no public exploit or active exploitation has been identified.

Cross-origin data leakage in Google Chrome's Preload subsystem (prior to 148.0.7778.96) allows a remote attacker to infer cross-origin information by luring a victim to a crafted HTML page. The flaw is a protection mechanism failure (CWE-693) in Chrome's speculative resource-fetching logic, breaking expected Same-Origin Policy isolation. No public exploit code exists and CISA has not listed this in KEV; an EPSS of 0.03% (9th percentile) and an SSVC exploitation rating of 'none' confirm negligible real-world exploitation interest at time of analysis.

Cross-origin data leakage in Google Chrome's FedCM (Federated Credential Management) component prior to version 148.0.7778.96 allows remote attackers to bypass same-origin isolation and read data from cross-origin contexts. Exploitation requires a victim to visit a crafted HTML page, constraining mass automation. EPSS is 0.02% (7th percentile), SSVC records no active exploitation, and CISA KEV has not listed this vulnerability - signals that consistently place this at lower real-world priority despite its network accessibility.

Cross-origin data leakage in Google Chrome's Search feature prior to version 148.0.7778.96 allows a remote unauthenticated attacker to read data from a different origin by luring a user to a crafted HTML page. The flaw stems from insufficient policy enforcement in the Search component (CWE-693), bypassing intended cross-origin isolation protections. No public exploit code has been identified and CISA has not added this to the KEV catalog; with an EPSS of 0.03%, real-world exploitation probability is very low at time of analysis.

UI spoofing in Google Chrome's DevTools subsystem (all versions prior to 148.0.7778.96) enables a crafted browser extension to misrepresent critical UI elements to the victim, exploiting an inappropriate implementation classified as CWE-451. The attack requires social engineering the user into installing a malicious extension, after which the extension manipulates DevTools rendering to deceive the user about browser or page state. No active exploitation is confirmed (absent from CISA KEV), EPSS is negligible at 0.01% (3rd percentile), and SSVC rates exploitation as none with partial technical impact, placing this firmly in the low-priority tier despite the Medium CVSS score.

UI spoofing in Google Chrome's DevTools prior to version 148.0.7778.96 enables a crafted extension to misrepresent critical interface information to users, exploitable only after an attacker convinces a target to install the malicious extension. Exploitation requires meaningful social engineering effort and no public exploit code or active exploitation has been identified at time of analysis - SSVC rates exploitation as none and EPSS places this at only the 3rd percentile. The Chrome security team rated this Low severity internally, consistent with the multi-step prerequisite chain and limited post-exploitation impact.

Cross-origin data leakage in Google Chrome's DevTools prior to version 148.0.7778.96 allows a network-positioned attacker to exfiltrate cross-origin data by convincing a user to install a malicious Chrome Extension that exploits insufficient policy enforcement. The attacker must socially engineer the target into installing the malicious extension, after which the extension can bypass cross-origin isolation policies through DevTools APIs. No active exploitation has been confirmed (CISA KEV absent), and EPSS places this in the 4th percentile, indicating minimal real-world exploitation pressure.

UI spoofing via malicious network traffic is possible in Google Chrome's TabGroups component in all versions prior to 148.0.7778.96, exploitable by unauthenticated remote attackers who can induce user interaction. The root cause is insufficient input validation (CWE-20) in the TabGroups feature, allowing crafted network traffic to manipulate browser UI elements and deceive users about page origin or content. No public exploit exists and EPSS sits at 0.05% (17th percentile), consistent with SSVC's 'exploitation: none' and the vendor's own 'Low' Chromium severity rating - real-world risk is low despite the broad attack surface of a ubiquitous browser.

V8 JavaScript engine information disclosure in Google Chrome prior to 148.0.7778.96 exposes potentially sensitive process memory content to remote attackers via specially crafted HTML pages. Exploitation requires user interaction - specifically visiting a malicious page - and impact is confined to partial confidentiality loss with no integrity or availability consequence. No public exploits have been identified, EPSS sits at 0.03% (7th percentile), and CISA SSVC rates exploitation as none, collectively indicating low urgency relative to the broad attack surface.

UI spoofing in Google Chrome's Dialog component prior to version 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to deceive users with falsified browser UI elements via a crafted HTML page. The vulnerability stems from insufficient validation of untrusted input (CWE-20) in Dialog handling, enabling manipulation of how dialog boxes are rendered. No public exploit or active exploitation has been identified; EPSS is 0.05% and SSVC classifies exploitation as none, placing real-world urgency well below what the moderate CVSS score alone might suggest.

UI spoofing in Google Chrome's SSL input validation layer affects all versions prior to 148.0.7778.96, requiring an attacker to have already compromised the renderer process before the flaw can be leveraged via a crafted HTML page. This is a chained, second-stage capability - not a standalone initial-access vector - rated Low severity by the Chromium security team and scoring 4.2 CVSS. No public exploit code exists, EPSS sits at 0.07% (21st percentile), and CISA SSVC confirms no active exploitation, placing this firmly in the lower tier of Chrome's vulnerability landscape.

Omnibox (URL bar) spoofing in Google Chrome on Android prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to display falsified URL content via a crafted HTML page exploiting insufficient input validation in the Payments subsystem. No public exploit identified at time of analysis; EPSS stands at 0.07% (21st percentile) and SSVC records exploitation status as none, consistent with the high attack complexity imposed by the mandatory renderer pre-compromise prerequisite. The primary impact is user deception - a victim may believe they are interacting with a legitimate payment origin while the Omnibox displays attacker-controlled content.

Arbitrary read/write in Google Chrome's DataTransfer component prior to version 148.0.7778.96 is exploitable by a remote attacker who has already compromised the renderer process, using a specially crafted HTML page to bypass input validation. This is a chained post-exploitation primitive rather than an initial-access vector - the renderer must already be under attacker control before this flaw becomes useful. SSVC rates exploitation as none and technical impact as partial; EPSS at 0.03% (9th percentile) and the absence of any CISA KEV listing indicate no observed active exploitation at time of analysis.

Cross-origin data leakage in Google Chrome's Autofill component (all versions prior to 148.0.7778.96) enables a remote attacker to extract sensitive Autofill data across web origins when a victim visits a specially crafted HTML page. The flaw is rooted in insufficient origin policy enforcement (CWE-346) within the Autofill subsystem, allowing data bound to one origin to be read by a different origin in violation of the browser's same-origin policy. No active exploitation has been confirmed - the vulnerability is absent from CISA KEV, EPSS sits at a negligible 0.01%, and SSVC classifies exploitation as none - making this a patch-and-monitor priority rather than an emergency response.

Cross-origin data leakage in Google Chrome's Dawn WebGPU subsystem (versions prior to 148.0.7778.96) enables remote attackers to read memory beyond buffer boundaries and expose sensitive cross-origin data when a user visits a crafted HTML page. The vulnerability (CWE-125 out-of-bounds read) affects the Dawn graphics abstraction layer, Chrome's implementation of the WebGPU API, and was rated Medium severity by the Chromium security team. No active exploitation has been identified; EPSS at 0.02% (6th percentile) and SSVC exploitation status of 'none' both confirm low community-assessed real-world risk at time of analysis.

Uninitialized memory use in Chrome's WebCodecs component exposes potentially sensitive process memory contents to remote attackers via crafted HTML pages. All Chrome versions prior to 148.0.7778.96 are affected, with the flaw requiring only that a victim navigate to an attacker-controlled page. No active exploitation has been identified; EPSS sits at the 7th percentile and SSVC rates exploitation as none, placing this in the moderate-priority tier despite the high confidentiality impact signaled by CVSS.

Cross-origin data leakage in Google Chrome's Media subsystem prior to version 148.0.7778.96 can be exploited by a remote attacker through a specially crafted HTML page, causing partial disclosure of sensitive content from another origin. The flaw is rooted in CWE-346 (Origin Validation Error), meaning Chrome's Media component fails to properly enforce the Same-Origin Policy during media processing. No active exploitation is confirmed in CISA KEV, and EPSS places this at 0.02% (6th percentile), indicating low real-world exploitation probability; patch availability from the vendor makes this a routine patch-cycle priority rather than an emergency.

Cross-origin data leakage in Google Chrome's GPU process (versions prior to 148.0.7778.96) is exploitable by an attacker who has already compromised the renderer process, allowing them to read uninitialized GPU memory and exfiltrate data belonging to other web origins via a crafted HTML page. This is a second-stage vulnerability requiring a prior renderer compromise, substantially limiting real-world exploitation to multi-stage attack chains. No public exploit code exists and no active exploitation has been confirmed; EPSS is 0.03%, and CISA SSVC assesses exploitation as none at time of analysis.

Google Chrome versions prior to 148.0.7778.96 contain insufficient input validation in DevTools that allows remote attackers with a compromised renderer process to leak cross-origin data through crafted HTML pages. The vulnerability requires user interaction and a pre-compromised renderer, limiting real-world exploitation but presenting a significant attack chaining vector for multi-stage exploits. Patch available from vendor.

Insufficient input validation in the FileSystem API in Google Chrome prior to version 148.0.7778.96 allows a remote attacker with a compromised renderer process to perform arbitrary file read and write operations through a malicious HTML page. The vulnerability requires prior renderer compromise and user interaction with a crafted page, limiting its attack surface despite network-accessible vectors. Vendor has released a patched version.

Insufficient policy enforcement in DirectSockets API in Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary read and write operations through a crafted malicious Chrome extension. The vulnerability requires user interaction (extension installation) but affects the core security model of the browser's socket access control, exposing local network resources to unauthorized access by untrusted extensions.

Google Chrome prior to version 148.0.7778.96 contains insufficient validation of untrusted input in the Permissions system, allowing attackers on the local network segment to leak cross-origin data through malicious network traffic. The vulnerability requires network adjacency but no user interaction or authentication, affecting confidentiality with medium Chromium severity. Patch is available from Google.

Information disclosure in Google Chrome prior to 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive data from process memory through a race condition triggered by a crafted HTML page. The vulnerability requires renderer process compromise and user interaction but results in high confidentiality impact with no integrity or availability consequences. Chromium security team rates this as Medium severity; no active exploitation has been publicly confirmed.

Uninitialized memory use in the GPU component of Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to extract potentially sensitive information from process memory through a malicious HTML page. The vulnerability requires renderer process compromise as a precondition and user interaction to trigger, but once achieved, enables confidentiality breach with no code execution or denial of service impact. Vendor-released patch available in Chrome 148.0.7778.96.

Google Chrome prior to version 148.0.7778.96 contains a race condition in shared storage that allows a remote attacker with a compromised renderer process to leak cross-origin data through a crafted HTML page. The vulnerability requires user interaction and renderer compromise but can disclose sensitive information across origin boundaries, classified as medium severity by Chromium security team.

Out-of-bounds read and write in the GFX component of Google Chrome prior to version 148.0.7778.96 allows remote attackers to perform arbitrary memory read and write operations through malicious network traffic. The vulnerability requires user interaction (clicking a link or visiting a malicious page) but does not require authentication. Chromium rated the security severity as Medium; CVSS 5.4 reflects moderate impact (confidentiality and integrity compromise without availability loss). No active exploitation confirmed in CISA KEV at time of analysis.

Out-of-bounds read in Skia graphics library within Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to leak cross-origin data through a crafted Chrome Extension. The vulnerability requires user interaction and relies on renderer compromise, limiting real-world exploitation despite the information disclosure impact. Chromium classified this as Medium severity; no active exploitation has been publicly confirmed.

UI spoofing via insufficient input validation in Google Chrome prior to 148.0.7778.96 allows a remote attacker who has already compromised the renderer process to craft malicious HTML pages that deceive users about the legitimate UI elements. The attack requires renderer process compromise as a prerequisite and user interaction with the crafted page, limiting real-world applicability to multi-stage attacks. Chromium assessed this as medium severity; no public exploit code or active exploitation has been identified.

Insufficient input validation in ANGLE (Almost Native Graphics Layer Engine) in Google Chrome prior to version 148.0.7778.96 allows remote attackers who have compromised the renderer process to perform arbitrary memory read and write operations via a crafted HTML page. The vulnerability requires renderer process compromise as a precondition, user interaction, and high attack complexity, making it a post-exploitation vector rather than a primary attack surface. Patch is available from vendor.

Integer overflow in ANGLE graphics library in Google Chrome prior to version 148.0.7778.96 allows remote attackers to leak cross-origin data by delivering a crafted HTML page that triggers the vulnerability. The vulnerability requires user interaction (visiting a malicious webpage) but can bypass same-origin policy protections, exposing sensitive data from other domains. No public exploit code or active exploitation has been confirmed at analysis time.

Out-of-bounds memory read in Google Chrome's V8 JavaScript engine allows remote attackers to disclose sensitive information via a crafted HTML page. Affects Chrome versions prior to 148.0.7778.96. The vulnerability requires user interaction (opening a malicious page) but operates over the network with no authentication required. While classified as medium severity by Chromium, the impact is limited to information disclosure without code execution capability.

UI spoofing vulnerability in Google Chrome prior to 148.0.7778.96 allows remote attackers to deceive users through crafted HTML pages that manipulate the speech interface, potentially disclosing sensitive information or causing denial of service. The vulnerability requires user interaction (clicking or interacting with the malicious page) and affects the speech component's visual presentation. Chromium severity is rated Medium; no active exploitation has been publicly confirmed.

Out-of-bounds read in WebCodecs video processing in Google Chrome versions prior to 148.0.7778.96 allows remote attackers to leak sensitive memory contents via a crafted video file. The vulnerability requires user interaction to open a malicious video, but affects all users regardless of authentication. Chrome 148.0.7778.96 and later versions patch this information disclosure vulnerability, which could expose cryptographic keys, session tokens, or other sensitive data resident in adjacent memory.