Remote Code Execution

OS command injection in NVIDIA NemoClaw's Telegram bridge component on Linux enables a local attacker with low-privileged access to execute arbitrary operating system commands. Exploitation yields full confidentiality, integrity, and availability compromise on the affected host, with potential for privilege escalation beyond the invoking user. No active exploitation is confirmed in CISA KEV and no public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) and minimal privilege requirement (PR:L) lower the practical bar for exploitation once local access is obtained.

Sandbox escape in NVIDIA OpenShell for Linux lets a low-privileged actor already operating inside the sandbox break its isolation boundary, potentially achieving code execution, privilege escalation, data tampering, and information disclosure on the host. The flaw is rooted in an uncontrolled search path element (CWE-427), so a resource the sandbox loads can be redirected to attacker-supplied code. No public exploit identified at time of analysis and it is not listed in CISA KEV, but the assigned 9.9 CVSS reflects the full compromise achievable once the sandbox boundary is breached.

OS command injection in NVIDIA OpenShell across all supported platforms allows a network-accessible malicious gateway to execute arbitrary operating system commands on a victim host when a user interacts with that gateway. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) reflects that an attacker requires no privileges on the victim system but does require the victim to interact with a malicious or attacker-controlled gateway endpoint. Successful exploitation yields full code execution, data tampering, and information disclosure - with no public exploit or CISA KEV listing identified at time of analysis.

Sandbox-escaping remote code execution is possible in Google Chrome for iOS before 152.0.7977.65, where a use-after-free in the Sync component can be triggered by a victim visiting a crafted HTML page, potentially letting a remote attacker run arbitrary code outside the renderer sandbox. Google has shipped a fixed stable build, and there is no public exploit identified at time of analysis; the flaw is not listed in CISA KEV and SSVC records exploitation status as none. Notably, Chromium's own severity rating for this bug is Low, which stands in sharp contrast to the 9.6 CVSS score in the input.

Race condition in Google Chrome Enterprise on Windows prior to version 152.0.7977.65 enables an adjacent network attacker to potentially escape the browser sandbox and execute arbitrary code on the host system via crafted network traffic. No public exploit code has been identified and CISA has not listed this in the Known Exploited Vulnerabilities catalog. Despite a CVSS base score of 7.5, Google's Chromium team assigned an internal severity of Low, and SSVC analysis independently rates exploitation as none with non-automatable attack conditions - together suggesting constrained real-world impact relative to raw score.

Remote code execution within the Chrome sandbox is achievable in Google Chrome prior to 152.0.7977.65 through a use-after-free vulnerability in V8, Chrome's JavaScript engine, triggered by a crafted HTML page. Any unauthenticated remote attacker who can induce a user to visit a malicious URL can exploit this flaw; however, execution is confined to the Chrome sandbox, meaning a chained sandbox escape would be required for full host-system compromise. No public exploit code or confirmed active exploitation is documented at time of analysis, and SSVC assessment lists exploitation as none, tempering urgency despite the high CVSS base score.

Use-after-free in the Animation component of Google Chrome prior to 152.0.7977.65 enables arbitrary code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw scores 8.8 CVSS HIGH, though Google's own internal Chromium severity rating is Low - a notable discrepancy that reflects the sandboxed containment of the impact. No public exploit code has been identified, SSVC indicates no active exploitation, and a vendor patch is confirmed available in Chrome 152.0.7977.65.

Remote code execution in Google Chrome desktop before 152.0.7977.65 arises from a use-after-free in the ServiceWorker subsystem that a crafted HTML page can trigger to run attacker code outside the renderer sandbox. Any user browsing to a malicious page with a vulnerable build is exposed, and successful exploitation yields full compromise of the host user context. No public exploit identified at time of analysis and the issue is not in CISA KEV; notably, Chromium's own severity rating is Low even though the NVD CVSS base score is 9.6, a discrepancy defenders should weigh.

Type confusion in Chrome's V8 JavaScript engine (versions prior to 152.0.7977.65) enables remote code execution within the browser sandbox when a victim is socially engineered into visiting a crafted HTML page. The vulnerability arises from a CWE-843 type confusion flaw in V8, allowing an attacker to manipulate object type assumptions at runtime to achieve arbitrary code execution. Importantly, execution is constrained to the Chrome sandbox, which Chromium's own severity rating of 'Low' reflects; no public exploit code or CISA KEV listing has been identified at time of analysis.

Use-after-free in Google Chrome's PDF rendering subsystem (all versions prior to 152.0.7977.65) allows a remote attacker to execute arbitrary code confined within the Chrome sandbox by delivering a crafted PDF file. The vulnerability is triggered through normal user interaction - opening a malicious PDF - requiring no privileges or authentication. While CVSS scores this 8.8 (High), Chrome's own severity rating is 'Low', reflecting the critical nuance that code execution is sandboxed and does not directly achieve host-level compromise. No public exploit exists and SSVC confirms no known exploitation at time of analysis.

Integer overflow in the WebRTC component of Google Chrome prior to 152.0.7977.65 enables remote code execution confined to the browser's sandbox via a crafted HTML page. The flaw requires no authentication (PR:N) and no special browser configuration, as WebRTC is enabled by default, but it does require the victim to visit an attacker-controlled page (UI:R). No public exploit code has been identified and EPSS places exploitation probability at 0.35%, consistent with SSVC's assessment of no current exploitation; notably, Google's own internal Chromium severity rating for this issue is 'Low,' suggesting the sandbox boundary and exploit reliability considerations factor into their triage.

Remote code execution inside the Chrome sandbox is possible through a race condition in the Extensions component, exploitable via crafted network traffic against Google Chrome versions prior to 152.0.7977.65. Despite a CVSS score of 8.1, Chrome's own team rates this vulnerability Low severity - a notable divergence explained by the sandbox constraint: successful exploitation yields in-sandbox code execution rather than full OS-level compromise. No public exploit identified at time of analysis, and SSVC confirms no known active exploitation and that the attack cannot be automated reliably.

Use-after-free in Google Chrome's DevTools component (all versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code inside the Chrome sandbox by distributing a crafted extension through social engineering. The CVSS 8.8 score reflects high confidentiality, integrity, and availability impact within the process scope, though exploitation is constrained by the mandatory user interaction required to install the malicious extension. No public exploit code exists and SSVC rates active exploitation as none at time of analysis, placing real-world urgency below what the raw score implies.

Improper state validation in Google Chrome's HTML parser (all versions prior to 152.0.7977.65) enables remote code execution within the browser's renderer sandbox when a user visits a crafted HTML page. The flaw (CWE-754) requires no authentication and minimal user interaction - simply loading malicious HTML is sufficient - but execution is constrained to the renderer sandbox (scope unchanged, S:U). Despite an 8.8 CVSS score, EPSS sits at 0.21% (12th percentile) and CISA SSVC confirms no current exploitation, with no public exploit or KEV listing identified at time of analysis.

Remote code execution in Google Chrome prior to 152.0.7977.65 stems from improper input validation in the browser's Media component, enabling a remote attacker to potentially execute arbitrary code outside the sandbox when a user visits a crafted HTML page. The vulnerability carries a CVSS base score of 8.8, affects all desktop Chrome builds below 152.0.7977.65 across Windows, macOS, and Linux, and is classified under CWE-20. No public exploit has been identified at time of analysis, and CISA SSVC rates current exploitation as none despite a total technical impact rating.

Remote code execution outside the browser sandbox is achievable in Google Chrome prior to 152.0.7977.65 via improper input validation in the Media component, triggered by visiting a crafted HTML page. The sandbox escape aspect is the critical differentiator here - Chrome's multi-process sandbox is its primary defense-in-depth layer, so bypassing it yields native OS-level code execution under the victim's account. No public exploit identified at time of analysis, and SSVC classifies exploitation as none with the attack non-automatable due to required user interaction.

Sandbox escape in Google Chrome's Media component on Windows allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside Chrome's sandbox via a crafted HTML page. Affected versions are all Chrome releases on Windows prior to 152.0.7977.65. No public exploit code or active exploitation has been identified at time of analysis; SSVC assessment confirms exploitation status as none, and EPSS probability is low at 0.26% (17th percentile), though SSVC technical impact is rated total given full sandbox bypass capability.

Insufficient control flow management in Google Chrome's DevTools component (versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code inside the browser sandbox by tricking a user into loading a crafted HTML page via social engineering. The flaw is rooted in CWE-691 and permits attacker-controlled code paths within the DevTools subsystem, with execution constrained to within the Chrome sandbox (S:U). No public exploit code has been identified at time of analysis, and both EPSS (0.21%, 12th percentile) and SSVC (exploitation: none, automatable: no) indicate low current exploitation probability despite the high CVSS 8.8 base score.

Type confusion in Google Chrome's DevTools component prior to version 152.0.7977.65 enables remote code execution within the browser sandbox when a victim is social-engineered into visiting a crafted HTML page. The flaw affects all Chrome platforms where DevTools is accessible and results in high confidentiality, integrity, and availability impact to the sandboxed process. No public exploit code has been identified at time of analysis, and SSVC assessment confirms no observed active exploitation, though the technical impact rating is classified as total.

Use-after-free in V8, Google Chrome's JavaScript engine, prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code within the Chrome sandbox by luring a user to a crafted HTML page. The CVSS 8.8 vector (AV:N/AC:L/PR:N/UI:R) confirms low-complexity, unauthenticated network delivery requiring only a single user visit, with high confidentiality, integrity, and availability impact scoped to the renderer process. No public exploit code has been identified at time of analysis, and SSVC rates exploitation as none with a non-automatable attack path, though technical impact is assessed as total within the sandbox.

Remote code execution within the Chrome sandbox is achievable via a race condition in the V8 JavaScript engine, affecting all Google Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker (per CVSS PR:N) can trigger the vulnerability by luring a user to a crafted HTML page, exploiting a timing window in V8's memory management to execute arbitrary code. No public exploit code or active exploitation has been identified at time of analysis; EPSS sits at 0.24th percentile and CISA SSVC records exploitation status as none, classifying this as a theoretical-but-patched risk for organizations that deploy promptly.

Use-after-free in Chrome's Chromoting (remote desktop) component allows a remote, unauthenticated attacker to potentially execute arbitrary code outside the browser sandbox via crafted network traffic, affecting all Chrome versions prior to 152.0.7977.65. The sandbox-escape dimension elevates this beyond a typical renderer vulnerability, as successful exploitation could yield code execution in a broader process context. No public exploit identified at time of analysis and SSVC indicates no observed exploitation, but the technical impact is rated total.

Sandbox-escaping remote code execution affects Google Chrome on macOS before 152.0.7977.65 through a use-after-free in the browser's Bluetooth component (CVE-2026-79091). A remote attacker who lures a victim into opening a crafted HTML page can trigger the freed-memory reuse to run arbitrary code outside the renderer sandbox, giving control of the host process. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the sandbox-escape scope change drives a 9.6 CVSS base score despite Chromium's own Medium severity rating.

Sandbox-escaping remote code execution affects Google Chrome desktop before 152.0.7977.65, where a use-after-free in the ServiceWorker component lets a remote attacker run arbitrary code outside the renderer sandbox when a victim opens a crafted HTML page. The CVSS 3.1 score of 9.6 reflects the scope change (sandbox escape) and full CIA impact, though Google rated the Chromium severity only Medium and CISA's SSVC framework marks exploitation as none. No public exploit or CISA KEV listing exists at time of analysis, so risk is currently theoretical but high-impact.

Sandbox-escaping remote code execution affects Google Chrome on macOS prior to 152.0.7977.65, where a use-after-free in the Network component lets a remote attacker who convinces a victim to install a crafted extension run arbitrary code outside the renderer sandbox. Google rates the Chromium severity Medium, but the CVSS 9.6 reflects the scope-changing sandbox escape. No public exploit is identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.24%.

Remote code execution outside Chrome's renderer sandbox is possible on macOS in all Chrome builds prior to 152.0.7977.65, triggered by improper input validation in the ANGLE graphics engine. An unauthenticated remote attacker (confirmed by PR:N in the provided CVSS vector) can exploit this by directing a macOS user to a specially crafted HTML page, which causes ANGLE to process malformed graphics input and execute attacker-controlled code outside the sandbox boundary. No CISA KEV listing or public exploit code exists at time of analysis, and an EPSS of 0.21% (12th percentile) indicates low current exploitation probability, though the zero-privilege-required, low-complexity attack path warrants prompt patching.

Out-of-bounds read in Google Chrome's ANGLE graphics engine on Windows prior to version 152.0.7977.65 enables remote attackers to potentially execute arbitrary code outside the browser sandbox. Exploitation requires no authentication and only that a victim navigate to a crafted HTML page, yielding a CVSS 8.8 score with high impact across confidentiality, integrity, and availability. A vendor-released patch is available; no public exploit or confirmed active exploitation has been identified at time of analysis.

Use-after-free in Chrome's UI layer allows a local attacker who has already achieved code execution inside the renderer process to escape the Chrome sandbox and execute arbitrary code on the underlying host system. All Google Chrome desktop releases prior to 152.0.7977.65 are affected per CPE cpe:2.3:a:google:chrome. No public exploit or CISA KEV listing exists at time of analysis, and EPSS sits at 0.12% (2nd percentile), consistent with a sophisticated chained exploit rather than mass exploitation; however, the Scope:Changed CVSS vector confirms this is a full sandbox escape with critical C/I/A impact once the preconditions are met.

Use-after-free in Google Chrome's DevTools component (all versions prior to 152.0.7977.65) allows a remote attacker to execute arbitrary code within the browser's renderer sandbox. Exploitation requires the victim to be socially engineered into installing and activating a crafted Chrome extension, making this a user-interaction-dependent attack rather than a passive drive-by. No active exploitation has been confirmed via CISA KEV, and SSVC classifies the exploitation status as none; however, SSVC also rates technical impact as total, meaning successful exploitation fully compromises confidentiality, integrity, and availability within the sandbox boundary.

Sandbox escape in Google Chrome's Media component (prior to 152.0.7977.65) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. Google has released a patched stable channel build (152.0.7977.65), with no public exploit code or active exploitation confirmed at time of analysis. EPSS sits at 0.21% (12th percentile) and SSVC rates the exploitation status as none with automatable: no, indicating this is a low-immediacy but technically severe sandbox escape requiring a two-stage attack chain.

Use-after-free in Chrome's Views UI component enables sandbox escape to arbitrary code execution outside the browser sandbox, affecting all Google Chrome versions prior to 152.0.7977.65. Exploitation requires an attacker who has already achieved renderer process compromise - making this a chained, second-stage attack rather than a direct initial access vector. No public exploit code has been identified and SSVC assessment confirms no active exploitation at time of analysis, though the technical impact is rated total due to the scope change across the sandbox boundary.

GPU improper input validation in Google Chrome on Android (prior to 152.0.7977.65) enables a remote attacker who has already compromised the renderer process to escape Chrome's sandbox and execute arbitrary code at the OS level via a crafted HTML page. This is a chained sandbox escape - a second-stage exploit requiring a separate renderer compromise as a prerequisite, which the AC:H CVSS rating accurately reflects. No public exploit code has been identified and the vulnerability is absent from CISA KEV, but the full S:C/C:H/I:H/A:H impact ratings indicate that a successful chain yields complete browser compromise on Android.

Type confusion in Chrome's ANGLE graphics abstraction layer (all versions prior to 152.0.7977.65) enables remote attackers to potentially execute arbitrary code outside the browser sandbox by directing a user to a specially crafted HTML page. The CVSS 8.8 score reflects network-accessible delivery with no privilege requirements, full confidentiality, integrity, and availability impact, though user interaction is necessary. No public exploit identified at time of analysis; SSVC rates exploitation as 'none', yet technical impact is rated 'total' given the sandbox-escape language in the description.

Out-of-bounds write in ANGLE (Chrome's graphics abstraction layer) prior to version 152.0.7977.65 enables remote attackers to execute arbitrary code outside the browser sandbox by serving a crafted HTML page. The vulnerability carries a CVSS score of 8.8 and targets Chrome's Almost Native Graphics Layer Engine, a critical rendering subsystem, making exploitation viable against any unpatched Chrome user who visits a malicious page. No public exploit code or CISA KEV listing exists at time of analysis; EPSS probability is low at 0.30%, and SSVC assesses exploitation as 'none', suggesting real-world exploitation remains limited despite the high theoretical severity.

Remote code execution outside the browser sandbox is achievable in Google Chrome prior to 152.0.7977.65 via a race condition in ANGLE, the graphics API translation layer. Exploitation requires a victim to visit a crafted HTML page (UI:R), and the high attack complexity (AC:H) reflects the timing-sensitive, probabilistic nature of race condition exploitation. No public exploit code has been identified and CISA KEV does not list this CVE, though SSVC rates technical impact as total if exploitation succeeds.

Sandbox escape in Google Chrome for Android (versions prior to 152.0.7977.65) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside Chrome's sandbox by delivering a crafted HTML page to the victim. The vulnerability stems from improper input validation in Chrome's Input subsystem on Android, confirmed by the CVSS scope-change metric (S:C) indicating the exploit crosses the sandbox boundary. No public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS of 0.25% reflects the low automated exploitation probability attributable to the chained attack requirement.

Remote code execution outside the browser sandbox is potentially achievable in Google Chrome versions prior to 152.0.7977.65 through an integer overflow in the WebGL graphics subsystem triggered by visiting a crafted HTML page. The vulnerability affects all Chrome desktop platforms with a high-impact CVSS score of 8.8, though Chromium's internal severity rating of Medium and a low EPSS score of 0.25% (16th percentile) together suggest real-world exploitation remains uncommon at time of analysis. No public exploit code and no confirmed active exploitation have been identified; a vendor-released patch is available in stable channel update 152.0.7977.65.

Remote code execution within the Chrome sandbox is possible in Google Chrome prior to 152.0.7977.65 via a stack-based buffer overflow in the V8 JavaScript engine, triggered by a crafted HTML page visited by an unpatched user. The vulnerability requires no authentication or elevated privileges from the victim - only that they visit an attacker-controlled page - and achieves arbitrary code execution within Chrome's renderer sandbox. No public exploit has been identified at time of analysis, and EPSS at 0.39% (31st percentile) indicates low current exploitation probability despite the 8.8 CVSS score; notably, Google's own internal severity rating is Medium, reflecting the sandbox containment.

Sandbox escape via a TOCTOU race condition in Google Chrome's Start component on Android prior to 152.0.7977.65 allows a local attacker to execute arbitrary code outside Chrome's sandbox. Exploitation requires a co-installed malicious application placed via social engineering, making opportunistic mass exploitation infeasible despite a CVSS base score of 8.1. No public exploit code exists and this vulnerability is absent from CISA KEV; EPSS sits at 0.15% (4th percentile), confirming low observed exploitation pressure. Vendor patch is available at version 152.0.7977.65.

Heap buffer overflow in Google Chrome's Media component prior to version 152.0.7977.65 enables remote code execution inside the renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 (AV:N/AC:L/PR:N/UI:R/S:U) reflects low attack complexity and no authentication requirement, but the unchanged scope (S:U) confirms execution is sandboxed - a full system compromise would require a separate sandbox escape not described in this CVE. No public exploit code has been identified and no CISA KEV listing exists; EPSS of 0.28% (20th percentile) indicates low observed exploitation activity, which is consistent with a patch-and-monitor posture rather than emergency response.

Heap-based buffer overflow in Google Chrome's WebRTC component (versions prior to 152.0.7977.65) enables a remote attacker to execute arbitrary code inside the Chrome renderer sandbox by delivering a crafted HTML page to a victim user. The CVSS score of 8.8 reflects broad impact (C:H/I:H/A:H) with no authentication prerequisite, though code execution is initially sandboxed and scope is unchanged (S:U). No public exploit code has been identified at time of analysis; SSVC records exploitation status as none and EPSS probability is low at 0.28% (20th percentile), suggesting this has not yet been leveraged at scale despite the high-severity rating.

Sandbox-escaping remote code execution in Google Chrome on macOS (versions prior to 152.0.7977.65) stems from a use-after-free in the Views UI component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code outside the browser sandbox. Google has shipped a fixed Stable channel build, and there is no public exploit identified at time of analysis. Despite a 9.6 CVSS, real-world signals are muted: EPSS is 0.33% (25th percentile), CISA SSVC lists exploitation as none, and Chromium rated the bug Medium severity.

Sandbox-escaping remote code execution affects Google Chrome for macOS before 152.0.7977.65 through a use-after-free in the Views UI component, letting a remote attacker who lures a victim to a crafted HTML page run arbitrary code outside the renderer sandbox. Google has shipped a fixed stable-channel build; there is no public exploit identified at time of analysis and CISA has not listed it in KEV. Despite an NVD CVSS of 9.6 driven by the scope change, Chromium's own team rated the security severity Medium, and EPSS exploitation probability is low at 0.41%.

Remote code execution in Google Chrome desktop before 152.0.7977.65 lets a remote attacker escape the browser sandbox by luring a victim to a crafted HTML page, exploiting a use-after-free in the Views UI framework to run arbitrary code with the browser process's privileges. The CVSS 9.6 score reflects a scope-changing sandbox escape (S:C), though Google rated the Chromium security severity only Medium and requires user interaction (visiting a malicious page). There is no public exploit identified at time of analysis, EPSS is low (0.46%), and CISA SSVC records exploitation status as none.

Use-after-free in Google Chrome's Compositing engine (all versions prior to 152.0.7977.65) enables remote code execution within the Chrome renderer sandbox when a user visits a crafted HTML page. The CVSS 8.8 score reflects full confidentiality, integrity, and availability impact, but execution is sandbox-confined and Chromium's own severity rating is Medium, suggesting real-world exploitation complexity is non-trivial. No public exploit has been identified and CISA SSVC records exploitation status as none; a vendor patch is available in Chrome 152.0.7977.65.

Sandbox-escaping remote code execution in Google Chrome for Android (Search component) affects all builds prior to 152.0.7977.65, where a use-after-free (CWE-416) lets a remote attacker who lures a victim into opening a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Google rated the Chromium severity Medium, yet the CVSS 3.1 base score is 9.6 due to the scope change and full CIA impact. There is no public exploit identified at time of analysis and it is not in CISA KEV; EPSS is low at 0.33% (25th percentile).

Sandbox-escaping remote code execution in Google Chrome for Android before 152.0.7977.65 stems from a use-after-free in the Sessions component (CVE-2026-79129, CWE-416). A remote attacker who lures a victim into a specific UI interaction (social engineering) can corrupt freed memory to run arbitrary code outside the renderer sandbox. Google has shipped a fixed build; no public exploit identified at time of analysis, EPSS is low (0.23%, 14th percentile), and CISA SSVC lists exploitation status as none.

Use-after-free in the Audio component of Google Chrome on Android (versions prior to 152.0.7977.65) enables sandbox escape and arbitrary code execution outside the Chrome renderer sandbox. Exploitation requires an attacker to have already compromised the renderer process and then deliver a crafted HTML page to trigger the memory corruption. No public exploit code or CISA KEV listing exists at time of analysis; SSVC confirms no active exploitation observed and the attack is not automatable.

Sandbox escape in Google Chrome's FileSystem component before version 152.0.7977.65 lets a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The flaw stems from incorrect reference resolution (CWE-706) and requires user interaction via social engineering. It is patched in the stable channel; there is no public exploit identified and EPSS exploitation probability is low (0.45%).

Sandbox escape in the WebView component of Google Chrome on Android (prior to version 152.0.7977.65) allows an attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox on the target device via a crafted HTML page. This CWE-610 externally controlled reference flaw represents the second stage of a chained exploit - requiring a companion renderer exploit to be viable - which substantially raises the real-world exploitation bar despite the CVSS 8.3 High score. No public exploit has been identified at time of analysis, and EPSS places exploitation probability at 0.33% (25th percentile), consistent with no observed active exploitation.

Sandbox escape in Google Chrome's Printing subsystem prior to 152.0.7977.65 allows an attacker who has already compromised the renderer process to execute arbitrary code outside Chrome's sandbox via a crafted HTML page. This is a two-stage, chained exploit: the printing component's failure to validate renderer-supplied input (CWE-20) becomes the second link used to break containment and reach the host OS. No public exploit has been identified at time of analysis, and EPSS is low at 0.25% (16th percentile), consistent with the elevated attack complexity required.

Sandbox escape via improper privilege management in Chrome's Navigation component allows a remote attacker who has already compromised the renderer process to break out of the Chrome sandbox and execute arbitrary code at OS level. Affected versions are all Chrome releases prior to 152.0.7977.65 across desktop platforms. The attack chain is multi-stage - renderer compromise must precede the sandbox escape - and social engineering is required, but the resulting impact is full confidentiality, integrity, and availability compromise outside the sandbox. No public exploit code and no CISA KEV listing have been identified at time of analysis; EPSS exploitation probability is low at 0.40% (33rd percentile).

Sandbox-escaping remote code execution in Google Chrome (desktop) before 152.0.7977.65 stems from a use-after-free in the Views UI framework, letting a remote attacker who lures a victim to a crafted HTML page potentially run arbitrary code outside the renderer sandbox. The flaw carries a CVSS 9.6 with scope change, though Google rated the Chromium security severity only Medium; there is no public exploit identified at time of analysis and SSVC lists exploitation as none. A vendor patch is available in the 152.0.7977.65 Stable channel release.

CustomTabs in Google Chrome for Android prior to version 152.0.7977.65 exposes a missing authorization flaw (CWE-862) that allows a local attacker, operating through a co-installed malicious application, to potentially escape the Chrome sandbox and execute arbitrary code. The Chromium security team rated this Medium severity internally, and the EPSS score of 0.13% at the 3rd percentile confirms no observed exploitation activity. A vendor patch has been released in Chrome 152.0.7977.65; no public exploit code or CISA KEV listing exists at time of analysis.

Sandbox escape via GPU race condition in Google Chrome prior to 152.0.7977.65 enables an attacker who has already compromised the renderer process to execute arbitrary code outside the browser sandbox through a crafted HTML page. The flaw is a time-of-check-to-time-of-use (TOCTOU) race condition (CWE-367) in Chrome's GPU component, classified Medium severity by the Chromium team despite a CVSS score of 8.3 - reflecting the mandatory renderer pre-compromise prerequisite that makes this a chained exploit rather than a standalone attack. No public exploit has been identified and EPSS probability is 0.20% (10th percentile), consistent with this vulnerability's role as a sophisticated second-stage primitive.

Heap-based buffer overflow (CWE-122) in Blink, Chrome's rendering engine, grants native code execution within the renderer sandbox to attackers who have already achieved renderer process compromise, affecting all Chrome versions prior to 152.0.7977.65 across all platforms. The fix is confirmed in stable channel release 152.0.7977.65. No public exploit identified at time of analysis; EPSS at 0.28% (20th percentile) and Chromium's own Medium severity rating both reflect the high attack complexity imposed by the mandatory prior-renderer-compromise precondition.

Type confusion in Chrome's Animation component allows remote unauthenticated attackers to potentially execute arbitrary code within the browser sandbox by luring a user to a crafted HTML page. All Chrome versions prior to 152.0.7977.65 are affected across desktop platforms. No public exploit code or active exploitation has been identified at time of analysis, and EPSS places this at the 19th percentile (0.27%), suggesting limited immediate exploitation pressure despite the high CVSS score.

Sandbox-escaping remote code execution in Google Chrome's FedCM (Federated Credential Management) component affects all desktop builds prior to 152.0.7977.65. A remote attacker who lures a victim to a crafted HTML page can trigger a use-after-free (CWE-416) and execute arbitrary code outside the renderer sandbox, giving full control of the browser process. Google rates the Chromium severity High; there is no public exploit identified at time of analysis and it is not listed in CISA KEV, though the CVSS base score is Critical (9.6) because of the scope change.

Type confusion in V8, Chrome's JavaScript engine, allows remote unauthenticated attackers to execute arbitrary code within the Chrome renderer sandbox by luring a user to a crafted HTML page. All Google Chrome desktop versions prior to 152.0.7977.65 are affected across Windows, macOS, and Linux. No public exploit has been identified at time of analysis, and the EPSS score of 0.33% (25th percentile) reflects limited current exploitation probability; the vendor patch is available and should be applied promptly.

Out-of-bounds write in Chrome's Crashpad crash-reporting library on Windows, versions prior to 152.0.7977.65, enables sandbox escape and arbitrary code execution when chained with a separate renderer compromise. The flaw (CWE-787) is the second stage of a two-stage exploit: an attacker who has already gained code execution inside the sandboxed renderer can trigger the memory corruption in Crashpad to break the sandbox boundary and execute arbitrary code at Chrome process privilege on the host. No public exploit has been identified at time of analysis and SSVC rates current exploitation as none, though the total technical impact and Windows-wide scope make this a high-priority patch item.

Type confusion in V8, Chrome's JavaScript engine, enables remote code execution within the sandboxed renderer process in all Chrome versions prior to 152.0.7977.65. An unauthenticated remote attacker can trigger arbitrary code execution by luring a user to a crafted HTML page, with full high-impact across confidentiality, integrity, and availability within the sandbox boundary. No active exploitation is confirmed in CISA KEV, and EPSS sits at a low 0.27% (19th percentile), though vendor and SSVC both rate technical impact as total, warranting prompt patching as part of routine browser update cadence.

Use-after-free in Google Chrome's V8 JavaScript engine allows remote attackers to execute arbitrary code within the browser renderer sandbox on all Chrome versions prior to 152.0.7977.65. Exploitation requires only a single user interaction - visiting a crafted HTML page - with no authentication or special privileges needed (CVSS 8.8, AV:N/AC:L/PR:N/UI:R). Despite full C/I/A impact within the sandbox, EPSS probability is low at 0.46% (38th percentile), SSVC exploitation status is 'none', and no public exploit or CISA KEV listing exists at time of analysis; a vendor patch has been released at version 152.0.7977.65.

Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) allows a remote attacker to potentially escape the browser sandbox by luring a victim to a crafted HTML page. The flaw is a CWE-843 type confusion carrying a 9.6 CVSS score with a scope change, reflecting the sandbox-escape potential. No public exploit has been identified at time of analysis, and CISA SSVC currently rates exploitation status as none.

Remote code execution inside the Chrome sandbox is achievable via a use-after-free in the WebRTC component of Google Chrome prior to 152.0.7977.65, exploitable by an unauthenticated remote attacker through crafted network traffic. The flaw requires high attack complexity (AC:H), constraining opportunistic mass exploitation, and code execution is limited to within the Chrome renderer sandbox, reducing but not eliminating post-exploitation impact. No public exploit code and no active exploitation have been identified at time of analysis, consistent with SSVC Exploitation: none and an EPSS of 0.66%.

Sandbox-escaping remote code execution affects Google Chrome desktop versions prior to 152.0.7977.65, where a use-after-free flaw in the Extensions component lets a remote attacker who convinces a victim to install a crafted extension execute arbitrary code outside the renderer sandbox. Chromium rates the severity High and CVSS scores it 9.6 due to the scope change (sandbox escape) and full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, and EPSS estimates near-term exploitation probability at only 0.28% (20th percentile).

Sandbox-escaping remote code execution in Google Chrome on Windows (versions before 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's graphics abstraction layer. A remote attacker who lures a victim to a crafted HTML page can potentially corrupt memory and execute arbitrary code outside the renderer sandbox. Rated High by Chromium with a CVSS of 9.6; there is no public exploit identified at time of analysis, and EPSS exploitation probability is low (0.25%, 16th percentile).

Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) lets a remote attacker escape the browser sandbox and run arbitrary code by luring a victim to a crafted HTML page. The flaw is a use-after-free (CWE-416) rated 9.6/Critical with a scope change, meaning exploitation impacts the host beyond the compromised renderer. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none, though the EPSS score of 0.41% reflects only near-term probability, not the true severity of a sandbox-escaping RCE.

Remote code execution in Google Chrome's ANGLE graphics component (versions prior to 152.0.7977.65) lets a remote attacker escape the renderer sandbox and run arbitrary code on the host after a victim opens a crafted HTML page. The flaw is a CWE-416 use-after-free rated CVSS 9.6 with scope change, reflecting the sandbox escape. There is no public exploit identified at time of analysis, it is not in CISA KEV, and EPSS is low at 0.41%, but the sandbox-escaping RCE impact makes it a high-priority browser patch.

Sandbox-escaping remote code execution in Google Chrome (desktop, versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES/Direct3D graphics translation layer. A remote attacker who lures a user to a crafted HTML page can execute arbitrary code outside the renderer sandbox, giving native code execution on the host. Rated CVSS 9.6 with a scope change; no public exploit is identified at time of analysis and EPSS is low (0.30%, 22nd percentile), though ANGLE/GPU bugs are historically attractive to attackers.

Remote code execution inside the Chrome sandbox affects Google Chrome prior to version 152.0.7977.65 through a use-after-free vulnerability in the Platform component, triggered when a user visits a specially crafted HTML page. An unauthenticated remote attacker can exploit this to execute arbitrary code within the browser sandbox, with full high-impact ratings on confidentiality, integrity, and availability. No public exploit code has been identified at time of analysis, and CISA has not added this to the Known Exploited Vulnerabilities catalog.

Out-of-bounds write in Chrome's ANGLE graphics layer on Windows allows remote attackers to execute arbitrary code inside the browser's renderer sandbox by directing a user to a crafted HTML page. All Google Chrome releases on Windows prior to 152.0.7977.65 are affected. No public exploit code has been identified at time of analysis, and the EPSS probability of 0.25% (16th percentile) indicates limited current exploitation activity despite the high CVSS score of 8.8.

Out-of-bounds write in ANGLE, Chrome's GPU abstraction layer, affects Google Chrome on Windows prior to 152.0.7977.65 and can be triggered by a remote, unauthenticated attacker via a crafted HTML page, potentially achieving arbitrary code execution within the Chrome sandbox. The CVSS score of 8.8 reflects high theoretical severity, though sandbox containment (S:U) limits immediate blast radius to the GPU process. No public exploit code or CISA KEV listing exists at time of analysis, and the low EPSS of 0.42% (35th percentile) signals limited near-term exploitation probability despite the high CVSS rating.

Out-of-bounds write in Google Chrome's ANGLE graphics layer allows a remote attacker who lures a victim to a crafted HTML page to potentially execute arbitrary code outside the browser sandbox, affecting all Chrome builds prior to 152.0.7977.65. The CVSS:3.1 score of 9.6 reflects a scope-changing sandbox escape requiring only user interaction (visiting a page). No public exploit is identified at time of analysis and the EPSS probability is low (0.25%, 16th percentile), and it is not on CISA KEV.

Sandbox-escaping remote code execution in Google Chrome's ANGLE graphics layer affects all desktop builds prior to 152.0.7977.65. A remote attacker who lures a victim to a crafted HTML page can trigger an out-of-bounds write and potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6; no public exploit identified at time of analysis and EPSS exploitation probability is low (0.30%, 22th percentile).

Sandbox-escaping remote code execution affects Google Chrome desktop builds prior to 152.0.7977.65, where improper input validation in the Media component lets a remote attacker run arbitrary code outside the renderer sandbox when a victim opens a crafted HTML page. Rated Critical (CVSS 9.6) with a scope change reflecting the sandbox breakout, this is a High-severity Chromium issue reported internally by the Chrome team; no public exploit has been identified at time of analysis and it is not listed in CISA KEV. A patched Stable-channel release is already available from Google.

Sandbox-escaping remote code execution in Google Chrome (Aura component) affects all desktop builds prior to 152.0.7977.65, where a use-after-free lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the renderer sandbox. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape, though exploitation requires the victim to load attacker-controlled content. No public exploit identified at time of analysis, and CISA SSVC currently marks exploitation status as none.

Sandbox-escaping remote code execution in Google Chrome's WebGL component affects all desktop builds prior to 152.0.7977.65. A crafted HTML page can trigger a use-after-free (CWE-416) whose exploitation, per the description, yields code execution outside the browser renderer sandbox - a notably severe outcome that Chrome typically confines. There is no public exploit identified at time of analysis and it is not on CISA KEV; EPSS is low at 0.33% (25th percentile), consistent with SSVC marking exploitation as 'none' despite total technical impact.

Out-of-bounds write in Chrome's ANGLE graphics layer (versions before 152.0.7977.65) lets a remote attacker who lures a victim to a crafted HTML page potentially execute arbitrary code outside the browser sandbox. Chromium rates it High severity; the CVSS 9.6 reflects a scope-changing sandbox escape whose only gating factor is that the user opens a malicious page. There is no public exploit identified at time of analysis and EPSS is low (0.35%, 28th percentile), but the memory-corruption-to-sandbox-escape impact makes it a priority patch for desktop fleets.

Remote code execution in Google Chrome desktop before 152.0.7977.65 stems from a heap buffer overflow in the WebGL component, and critically allows an attacker to execute code OUTSIDE the renderer sandbox (scope change) via a single crafted HTML page. Any user who browses to a malicious or compromised site is at risk, requiring only that the page load and render WebGL content. No public exploit has been identified at time of analysis, and EPSS exploitation probability is low (0.39%), but the sandbox-escape impact and network reachability make this a high-priority patch.

Heap-based buffer overflow in ANGLE (Almost Native Graphics Layer Engine) within Google Chrome for Android prior to 152.0.7977.65 enables remote code execution outside the renderer sandbox via a crafted HTML page, meaning a successful attacker escapes Chrome's process isolation boundary with full C/I/A impact. Exploitation requires no authentication and only that a victim navigate to an attacker-controlled page, making drive-by compromise via phishing or malvertising a realistic delivery path. No public exploit has been identified at time of analysis and no CISA KEV listing exists, though the sandbox-escape capability significantly elevates real-world priority beyond what the raw CVSS score alone conveys.

Sandbox-escaping remote code execution in Google Chrome's Dawn (WebGPU) component affects all desktop builds prior to 152.0.7977.65, letting a remote attacker who lures a victim to a crafted HTML page break out of the renderer sandbox and run arbitrary code in a higher-privilege context. Rated 9.6 (Critical) with scope change, it requires only that the user visit a malicious page. EPSS is low (0.25%, 16th percentile) and there is no public exploit identified at time of analysis, though Chrome-reported GPU/Dawn bugs are historically high-value targets.

Remote code execution outside the browser sandbox affects Google Chrome desktop builds prior to 152.0.7977.65, stemming from a heap buffer overflow in the ANGLE graphics translation layer. A remote attacker who lures a victim into loading a crafted HTML page can execute arbitrary code that escapes the renderer sandbox (CVSS 9.6, scope-changed). No public exploit identified at time of analysis, and EPSS is low (0.28%, 20th percentile), but the sandbox-escape impact and universal Chrome deployment make patching urgent.

Use-after-free in the WebRTC component of Google Chrome before version 152.0.7977.65 enables remote code execution confined within the browser sandbox. Exploitation requires a victim to visit a specially crafted HTML page, placing UI:R as a meaningful friction point. No public exploit code has been identified and CISA has not added this to the Known Exploited Vulnerabilities catalog; SSVC also indicates no current exploitation activity. Despite a CVSS score of 8.8 and tags indicating RCE and memory corruption potential, the EPSS score of 0.33% at the 25th percentile reflects low observed exploitation probability relative to the broader vulnerability population.

Remote code execution in Google Chrome on Windows (versions prior to 152.0.7977.65) stems from an out-of-bounds write in ANGLE, Chrome's OpenGL ES abstraction layer used for GPU rendering. A remote attacker who lures a victim to a crafted HTML page can corrupt memory in the GPU process and potentially execute arbitrary code outside the browser sandbox, giving control of the underlying host. Rated High by Chromium and CVSS 9.6 due to the scope-changing sandbox escape; there is no public exploit identified and EPSS is low (0.30%), indicating no confirmed active exploitation yet.

Sandbox escape via race condition in Google Chrome's FileSystem component (prior to 152.0.7977.65) allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the sandbox through a crafted HTML page. This is a scope-changing exploit chain primitive - it operates as a second-stage attack requiring renderer access first, not a standalone unauthenticated RCE. No public exploit code is identified at time of analysis, and EPSS sits at 0.20% (10th percentile), reflecting low current exploitation probability despite the High CVSS score.

Use-after-free in Google Chrome's Accessibility component (versions prior to 152.0.7977.65) enables remote attackers to execute arbitrary code outside the browser's renderer sandbox through social engineering. Exploitation requires user interaction with a malicious webpage or crafted UI element, making phishing or malvertising the likely delivery mechanism. A vendor patch is available in stable channel version 152.0.7977.65; no public exploit code or CISA KEV listing has been identified at time of analysis, and EPSS remains low at 0.23% (14th percentile), suggesting opportunistic exploitation is not currently observed.

Remote code execution in Google Chrome's Chromecast component (versions prior to 152.0.7977.65) stems from a use-after-free memory corruption flaw that enables remote attackers to execute arbitrary code within Chrome's renderer sandbox. Exploitation requires a victim to visit a crafted HTML page, making it network-reachable but not fully automated. No public exploit code has been identified at time of analysis, and the vulnerability is absent from the CISA Known Exploited Vulnerabilities catalog, with EPSS indicating low observed exploitation probability despite the high CVSS score.

Remote code execution in Google Chrome desktop before 152.0.7977.65 lets an unauthenticated attacker escape the renderer sandbox and run arbitrary code on the host when a victim opens a crafted web page. The bug is a use-after-free in the Views UI framework, rated High by Chromium and carrying a CVSS 9.6 due to a scope change (sandbox escape). No public exploit has been identified at time of analysis, and the EPSS probability is low (0.33%, 25th percentile).

Sandbox escape via incorrect USB authorization in Google Chrome prior to 152.0.7977.65 allows a remote attacker who has already compromised the renderer process to execute arbitrary code outside the Chrome sandbox through a crafted HTML page combined with social engineering. The attack chain is multi-stage: the USB subsystem fails to correctly authorize renderer-process requests, enabling a scoped privilege escalation out of the sandbox (S:C in CVSS). No public exploit code is identified and SSVC assessment confirms no known exploitation at time of analysis, though successful exploitation would yield total technical impact.

Race condition in Chrome's ReadAloud component allows remote code execution inside the browser sandbox when a user is socially engineered into visiting a crafted HTML page. Affected are all Google Chrome builds prior to 152.0.7977.65 across desktop platforms. The CVSS Scope:Changed metric signals a potential sandbox escape, elevating the impact beyond the renderer process to the underlying system, though EPSS (0.33%) and SSVC exploitation status of 'none' indicate no public exploit activity at time of analysis.