Google Chrome vulnerabilities

Use after free in Chromecast in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Improper access control in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Severity: Medium)

Incorrect authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page. (Severity: Medium)

Use after free in Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: Low)

Race condition in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Severity: Low)

Use after free in Script in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Use after free in Chromoting in Google Chrome on Windows prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Severity: High)

Information leak in the Canvas component of Google Chrome prior to 152.0.7977.65. A remote attacker can use a crafted HTML page to leak cross-origin data.

Improper input validation in the Variations component of Google Chrome prior to 152.0.7977.65. A remote attacker can use crafted network traffic to potentially bypass web origin policy.

Incorrect authorization in the SiteIsolation component of Google Chrome prior to 152.0.7977.65. A remote attacker who compromised the renderer process and leveraged social engineering can bypass site isolation via a crafted HTML page.

Incorrect authorization in the Extensions component of Google Chrome prior to 152.0.7977.65. A remote attacker who compromised the renderer process can bypass web origin policy via a crafted HTML page.

Use after free in the WebRTC component of Google Chrome prior to 152.0.7977.65. A remote attacker can use a crafted HTML page to execute arbitrary code inside the sandbox.

Incorrect authorization in the Network component of Google Chrome prior to 152.0.7977.65. A remote attacker who compromised the renderer process can bypass site isolation via a crafted HTML page.

Information leak in the DOM component of Google Chrome prior to 152.0.7977.65. A remote attacker can use a crafted HTML page to bypass web origin policy.

Missing authorization in the Preload component of Google Chrome prior to 152.0.7977.65. A remote attacker who compromised the renderer process can bypass web origin policy via a crafted HTML page.

Use after free in Accessibility in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via UI Interaction. (Chromium security severity: High)

Improper input validation in Media in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Observable discrepancy in Glic in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chromium security severity: Low)

UI misrepresentation in CustomTabs in Google Chrome on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in DOM in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially leak sensitive information via a crafted HTML page. (Chromium security severity: Low)

Incorrect authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in Media in Google Chrome on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

UI misrepresentation in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

Type confusion in Accessibility in Google Chrome on Windows prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: High)

A vulnerability in WebAppInstalls in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page. The issue has a medium severity.

A race condition in FileSystem in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The issue has a high severity.

Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive information via UI Interaction. The issue has a medium severity.

Improper input validation in Safebrowsing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted file. The issue has a medium severity.

An information leak in Skia in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially obtain sensitive information via a crafted HTML page. The issue has a low severity.

An information leak in CustomTabs in Google Chrome on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. The issue has a medium severity.

Incorrect authorization in Extensions in Google Chrome before 152.0.7977.65. A remote attacker leveraging social engineering can bypass system access restrictions via a crafted Chrome extension.

Incorrect authorization in ServiceWorker in Google Chrome before 152.0.7977.65. A remote attacker can bypass web origin policy via a crafted HTML page.

Incorrect authorization in GetUserMedia in Google Chrome before 152.0.7977.65. A remote attacker can obtain sensitive information via a crafted HTML page.

Incorrect authorization in Forms in Google Chrome before 152.0.7977.65. A remote attacker can obtain sensitive information via a crafted HTML page.

Improper input validation in Input in Google Chrome on Android before 152.0.7977.65. A remote attacker who compromised the renderer process can potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Out-of-bounds write in ANGLE in Google Chrome prior to 152.0.7977.65. A remote attacker can exploit a crafted HTML page to execute arbitrary code outside the sandbox.

Incorrect provision of specified functionality in Proxy in Google Chrome on Windows prior to 152.0.7977.65. An adjacent attacker can potentially obtain sensitive information via crafted network traffic.

Information leak in XR in Google Chrome prior to 152.0.7977.65. A remote attacker can obtain sensitive information via a crafted HTML page.

Information leak in Intents in Google Chrome on Android prior to 152.0.7977.65. A remote attacker can leak sensitive information via a crafted HTML page.

Improper input validation in NTP Footer in Google Chrome on Windows prior to 152.0.7977.65. A remote attacker who compromised the renderer process can bypass web origin policy via a crafted HTML page.

Information leak in SignIn in Google Chrome prior to 152.0.7977.65. A remote attacker can obtain sensitive information via crafted network traffic.

Improper input validation in Chromecast in Google Chrome prior to 152.0.7977.65. A remote attacker who compromised the renderer process can potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65. A remote attacker can potentially obtain cross-origin data via a crafted HTML page.

Use after free in PDF in Google Chrome prior to 152.0.7977.65. A remote attacker can execute arbitrary code inside the sandbox via a crafted PDF file.

Uninitialized resource in ANGLE in Google Chrome prior to 152.0.7977.65. A remote attacker can obtain cross-origin data via a crafted HTML page.

In Google Chrome on Android prior to 152.0.7977.65, a race condition in WebAppInstalls allowed a remote attacker leveraging social engineering to bypass web origin policy via a co-installed app. (Chromium security severity: High)

In Google Chrome prior to 152.0.7977.65, missing authorization in Viz allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

In Google Chrome prior to 152.0.7977.65, an out of bounds read in Skia allowed a remote attacker who had compromised the renderer process to read memory inside the sandbox via a crafted HTML page. (Chromium security severity: Low)