Google Chrome vulnerabilities

A use-after-free vulnerability in the Views component of Google Chrome prior to version 150.0.7871.115 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

An inappropriate implementation in WebGL in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

A use-after-free vulnerability in Forms in Google Chrome prior to 150.0.7871.115 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Inappropriate implementation in Forms in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as high severity.

Insufficient policy enforcement in Passwords in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to bypass same origin policy via a crafted HTML page. The vulnerability has a high severity rating according to Chromium security.

An inappropriate implementation in DOM in Google Chrome prior to 150.0.7871.115 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The vulnerability has a high severity rating according to Chromium classification.

Insufficient validation of untrusted input in Codecs in Google Chrome on Windows prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A Use-After-Free vulnerability in the WebRTC component of Google Chrome prior to version 150.0.7871.115 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as High severity by the Chromium security team.

A use-after-free vulnerability in the Core component of Google Chrome on Windows prior to version 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A race condition in GetUserMedia in Google Chrome prior to 150.0.7871.115 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

A Use-After-Free vulnerability in the Input component of Google Chrome prior to version 150.0.7871.115 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

A use-after-free vulnerability was found in the Payments component of Google Chrome prior to version 150.0.7871.115. A remote attacker who convinced a user to perform specific UI gestures could potentially exploit heap corruption via a crafted HTML page.

A use-after-free vulnerability in the Actor component of Google Chrome prior to 150.0.7871.115 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome on Android prior to 150.0.7871.115 allowed a local attacker to bypass same origin policy via a crafted HTML page.

An out-of-bounds read and write vulnerability in Codecs in Google Chrome prior to 150.0.7871.115 allows a remote attacker to potentially exploit heap corruption via a crafted video file. The issue is rated as High severity by Chromium.

A use-after-free vulnerability was found in the Ozone component of Google Chrome prior to version 150.0.7871.115. A remote attacker could potentially exploit heap corruption via a crafted HTML page.

A Use-After-Free vulnerability was found in the Views component of Google Chrome prior to version 150.0.7871.115. A remote attacker, after convincing a user to perform specific UI gestures, could potentially exploit heap corruption via a crafted HTML page.

A use-after-free vulnerability in Extensions in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted Chrome Extension.

An integer overflow in the Extensions API in Google Chrome prior to 150.0.7871.115 allowed an attacker who convinced a user to install a malicious extension to perform an out-of-bounds memory read via a crafted Chrome Extension.

A Use-After-Free vulnerability in the IndexedDB component of Google Chrome prior to version 150.0.7871.115 allows a remote attacker to execute arbitrary code within a sandbox via a crafted HTML page. The issue is rated as Medium severity by the Chromium security team.

An out-of-bounds read and write vulnerability in the Tint component of Google Chrome prior to version 150.0.7871.46 allows a remote attacker to potentially perform out-of-bounds memory access via a crafted HTML page. The issue is rated as high severity.

A vulnerability in the WebAppInstalls component of Google Chrome prior to 150.0.7871.46 allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue stems from incorrect security UI handling.

Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page.

Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

An inappropriate implementation in DevTools in Google Chrome prior to 150.0.7871.47 allowed an attacker who convinced a user to install a malicious extension to perform UI spoofing via a crafted Chrome Extension.

An inappropriate implementation in the Glic component in Google Chrome prior to 150.0.7871.47 allowed a remote attacker, after convincing a user to perform specific UI gestures, to perform UI spoofing via a crafted HTML page. The issue is rated as low severity.

Inappropriate implementation in AI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Low)

Insufficient validation of untrusted input in Speech in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page.

A Use-After-Free vulnerability in the Audio component of Google Chrome on Linux prior to version 150.0.7871.47 allows a remote attacker to execute arbitrary code via a crafted HTML page. The issue is rated as Low severity by the Chromium security team.

A Type Confusion vulnerability in the CSS component of Google Chrome prior to version 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

An inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page. The issue is rated as low severity.

An inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

An inappropriate implementation in CSS in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

An incorrect security UI in Views in Google Chrome prior to 150.0.7871.47 allowed a remote attacker, after convincing a user to perform specific UI gestures, to perform UI spoofing via a crafted HTML page.

An incorrect security UI in Passwords in Google Chrome on iOS prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

An inappropriate implementation in Extensions in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. The issue is rated as Low severity by Chromium security team.

A vulnerability in the Document Picture-in-Picture feature in Google Chrome on Android prior to version 150.0.7871.47 allowed a remote attacker to perform domain spoofing via a crafted HTML page. The issue is due to incorrect security UI in this feature.

Insufficient validation of untrusted input in Google Chrome on Android prior to version 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in TabStrip in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page.

An inappropriate implementation in WebAppInstalls in Google Chrome on Windows prior to 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. The issue is rated as low severity.

Insufficient validation of untrusted input in Chrome for iOS prior to version 150.0.7871.47 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page.

Insufficient validation of untrusted input in the Network component of Google Chrome prior to version 150.0.7871.47 allows a remote attacker who has compromised the renderer process to perform UI spoofing via a crafted HTML page. The vulnerability has a low severity rating from Chromium.

An inappropriate implementation in Autofill in Google Chrome on Android prior to version 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue has been rated as low severity by the Chromium security team.

A race condition in History Embeddings in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. The vulnerability has a low Chromium security severity.

A vulnerability in WebXR in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue stems from inappropriate implementation in WebXR.

Insufficient validation of untrusted input in WebAppInstalls in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page.

An incorrect security UI in the Omnibox of Google Chrome prior to 150.0.7871.47 allowed a remote attacker to perform UI spoofing via a crafted HTML page. The issue is rated as low severity.

In Google Chrome on Android prior to version 150.0.7871.47, an inappropriate implementation in PreviewTab allowed a remote attacker, by convincing a user to perform specific UI gestures, to perform UI spoofing via a crafted HTML page.

An inappropriate implementation in the Printing module of Google Chrome prior to version 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page. The vulnerability has a Chromium security severity of Low.