Google Chrome vulnerabilities

Information leak in the Networking component of Google Chrome prior to 154.0.8037.57. A remote attacker can leak sensitive information via a crafted HTML page.

Incomplete cleanup in Bluetooth in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page.

Incorrect authorization in HID in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.

UI misrepresentation in the Mobile component of Google Chrome on iOS prior to 154.0.8037.57. A remote attacker can spoof UI elements via a crafted HTML page.

Integer overflow in Metrics in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page. (Severity: Low)

UI misrepresentation in the ExtensionsMenu component of Google Chrome prior to 154.0.8037.57. A remote attacker can leverage social engineering to spoof UI elements via a crafted HTML page.

Type confusion in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

UI misrepresentation in Chromoting in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. Chromium security severity: Low.

Out-of-bounds write vulnerability in V8 component of Google Chrome prior to 154.0.8037.57. A remote attacker can exploit a crafted HTML page to execute arbitrary code inside the sandbox.

Incomplete cleanup in SmartCard in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page.

Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic.

Use-after-free vulnerability in Browser component of Google Chrome prior to 154.0.8037.57. A local attacker could potentially execute arbitrary code outside the sandbox via UI interaction.

Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Missing authorization in Core in Google Chrome on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. Chromium security severity: Low.

Information leak in Mobile in Google Chrome on iOS prior to 154.0.8037.57 allowed a local attacker to leak sensitive information via physical access. Chromium security severity: Medium.

UI misrepresentation in Browser in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. Chromium security severity: Medium.

Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.

Missing authorization in WebView in Google Chrome on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page.

Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.

Incorrect reference resolution in MediaStream in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page.

Insufficient validation of untrusted input in Codecs in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to potentially perform out of bounds memory access via a crafted video file. (Chromium security severity: Low)

Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. The vulnerability was rated High severity by Chromium.

UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. The vulnerability was rated Low severity by Chromium.

Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.

Server-side request forgery in Omnibox in Google Chrome on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. The vulnerability was rated Medium severity by Chromium.

Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.

Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The vulnerability was rated High severity by Chromium.

Buffer overflow in PDFium in Google Chrome on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file. The vulnerability was rated High severity by Chromium.

Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted HTML page. The vulnerability was rated Medium severity by Chromium.

Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Low)

Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. The vulnerability was rated Medium severity by Chromium.

Type confusion in V8 in Google Chrome prior to 153.0.8010.52. A remote attacker using social engineering could execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52. A local attacker using social engineering could read memory outside the sandbox via a local program. (Severity: Medium)

Incorrect reference resolution in Tracing in Google Chrome on Windows prior to 153.0.8010.52. A local attacker could potentially execute arbitrary code outside the sandbox via a local program. (Severity: High)

Race condition in Extensions in Google Chrome on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via UI interaction.

Use after free in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.

Integer overflow in Compositing in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.

Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Race condition in PlatformIntegration in Google Chrome on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to obtain sensitive information via a crafted HTML page.

Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Confused deputy in PriceTracking in Google Chrome on iOS prior to 153.0.8010.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions into a privileged page via crafted network traffic.

Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Uninitialized resource in Skia in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.

Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page.

Use-after-free in the PDF component of Google Chrome prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

Use-after-free in the DOM component of Google Chrome prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

Incorrect authorization in the WebUI component of Google Chrome prior to 153.0.8010.47. A remote attacker who had compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Incorrect authorization in the Core component of Google Chrome on Windows prior to 153.0.8010.47. A local attacker can execute arbitrary code outside the sandbox via a local program.

Improper state validation in Skia in Google Chrome prior to 153.0.8010.47. A remote attacker who had compromised the renderer process could read memory outside the sandbox via a crafted HTML page.