CVE Vulnerability Catalog

Incorrect authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Severity: Medium)

Information leak vulnerability in Extensions in Google Chrome prior to 152.0.7977.65. A remote attacker leveraging social engineering could obtain cross-origin data via a crafted Chrome extension.

Improper handling of case sensitivity in FileSystem in Google Chrome prior to 152.0.7977.65. A remote attacker leveraging social engineering could bypass system access restrictions via a crafted HTML page.

Uninitialized resource in Skia in Google Chrome prior to 152.0.7977.65. A remote attacker who had compromised the renderer process could potentially obtain cross-origin data via a crafted HTML page.

Information leak in Mobile in Google Chrome on iOS prior to 152.0.7977.65. A local attacker could obtain sensitive information via a crafted file.

Type confusion in V8 in Google Chrome prior to 152.0.7977.65. A remote attacker leveraging social engineering could execute arbitrary code inside the sandbox via a crafted HTML page.

Observable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65. A remote attacker could potentially obtain cross-origin data via a crafted HTML page.

Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65. A remote attacker who had compromised the renderer process could bypass web origin policy via a crafted HTML page.

Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65. A remote attacker who had compromised the renderer process could bypass site isolation via a crafted PDF file.

Out of bounds write in Crashpad in Google Chrome on Windows prior to 152.0.7977.65. A remote attacker who had compromised the renderer process could execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

Integer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: Low)

Observable discrepancy in CustomTabs in Google Chrome on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Severity: Medium)

Buffer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Severity: Low)

Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Severity: Low)

Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Severity: Medium)

Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Severity: Medium)

Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Severity: Medium)