Google Chrome vulnerabilities

Out of bounds read in WebXR in Google Chrome prior to 151.0.7922.72 allows a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Insufficient policy enforcement in USB in Google Chrome prior to 151.0.7922.72 allows a remote attacker to perform privilege escalation via a crafted HTML page.

Insufficient validation of untrusted input in Dawn in Google Chrome prior to 151.0.7922.72 allows a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

Type Confusion in Tab in Google Chrome on Android prior to 151.0.7922.72 allows a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Inappropriate implementation in the Updater component in Google Chrome on Mac prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file.

Inappropriate implementation in the Browser component in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform privilege escalation via a malicious file.

Use after free in the Tracing component in Google Chrome on Windows prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file.

Insufficient validation of untrusted input in the Updater component in Google Chrome prior to 151.0.7922.72 allowed a local attacker to perform OS-level privilege escalation via a malicious file.

Insufficient validation of untrusted input in the Mobile component in Google Chrome on Android prior to 151.0.7922.72 allowed a local attacker to spoof the contents of the Omnibox (URL bar) via a malicious file.

Inappropriate implementation in the Favicons component in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Uninitialized Use in the WebNN component in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in the Network component in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Insufficient policy enforcement in WebMCP in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

Inappropriate implementation in DevTools in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to inject scripts or HTML into a privileged page via a crafted HTML page.

Inappropriate implementation in Media Router in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

Side-channel information leakage in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in Permissions in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

Inappropriate implementation in Chrome for iOS allowed a remote attacker to spoof the Omnibox (URL bar) contents via malicious network traffic.

Inappropriate implementation in Media in Google Chrome on Windows allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.

Inappropriate implementation in CSS in Google Chrome allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

Insufficient validation of untrusted input in Cast in Google Chrome allowed an attacker on the local network segment to leak cross-origin data via malicious network traffic.

Inappropriate implementation in CSS in Google Chrome allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in Chrome for iOS allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass same origin policy via a crafted HTML page.

Race in Chrome for iOS allowed a remote attacker to perform UI spoofing via a crafted HTML page.

Incorrect security UI in Passwords in Google Chrome allowed a remote attacker to perform domain spoofing via a crafted HTML page.

Inappropriate implementation in Chrome for iOS allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability affects versions prior to 151.0.7922.72.

Incorrect security UI in Chrome for iOS allows a remote attacker to perform domain spoofing via a crafted HTML page. The vulnerability affects versions prior to 151.0.7922.72.

Use after free in V8 in Google Chrome allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The vulnerability affects versions prior to 151.0.7922.72.

Inappropriate implementation in Chrome for iOS allows a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability affects versions prior to 151.0.7922.72.

Inappropriate implementation in Passwords in Google Chrome allows a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability affects versions prior to 151.0.7922.72.

Insufficient validation of untrusted input in Passwords in Google Chrome allows a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page. The vulnerability affects versions prior to 151.0.7922.72.

Inappropriate implementation in Chrome for iOS allows a remote attacker to bypass navigation restrictions via a crafted HTML page. The vulnerability affects versions prior to 151.0.7922.72.

Insufficient policy enforcement in Passwords in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in CSS in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

Inappropriate implementation in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page.

Insufficient policy enforcement in Passwords in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker to bypass discretionary access control via a crafted HTML page.

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

Insufficient policy enforcement in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

Race in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

Insufficient policy enforcement in Extensions in Google Chrome prior to 151.0.7922.72 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension.

Insufficient policy enforcement in Autofill in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in WebAppInstalls in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in Network in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

Inappropriate implementation in ReportingAndNEL in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Insufficient policy enforcement in Speech in Google Chrome on Android prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to perform privilege escalation via a crafted HTML page.

Insufficient policy enforcement in GuestView in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Insufficient validation of untrusted input in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Insufficient policy enforcement in Chrome for iOS in Google Chrome on iOS prior to 151.0.7922.72 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Inappropriate implementation in DigitalCredentials in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to perform UI spoofing via a crafted HTML page.