CVE Vulnerability Catalog

Improper input validation in Core in Google Chrome on Windows prior to 156.0.8078.47. A remote attacker who had compromised the renderer process and leveraged social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Missing authorization in SignIn in Google Chrome on iOS prior to 156.0.8078.47. A remote attacker could bypass system access restrictions via a crafted HTML page.

Uninitialized resource in Dawn in Google Chrome prior to 156.0.8078.47. A remote attacker could read memory outside the sandbox via a crafted HTML page.

Use-after-free in Bluetooth in Google Chrome prior to 156.0.8078.47. An adjacent attacker leveraging social engineering could execute arbitrary code outside the sandbox via a crafted HTML page.

Use-after-free vulnerability in the Media component of Google Chrome prior to version 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Uninitialized resource in GPU in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

UI misrepresentation in the Ozone component of Google Chrome prior to version 156.0.8078.47. A remote attacker could spoof UI elements via a crafted HTML page.

Missing authorization in the Actor component of Google Chrome prior to version 156.0.8078.47. A remote attacker who had compromised the renderer process could bypass system access restrictions via a crafted HTML page.

Use-after-free vulnerability in the ANGLE component of Google Chrome on Windows prior to version 156.0.8078.47. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

Information leak in CustomTabs in Google Chrome on Android prior to 156.0.8078.47 allowed a local attacker to leak sensitive information via a co-installed app. (Chromium security severity: Medium)

Missing authorization in the iOSWebView component of Google Chrome on iOS prior to version 156.0.8078.47. A remote attacker could spoof UI elements via a crafted HTML page.

Race condition in the Chromoting component of Google Chrome prior to version 156.0.8078.47. A remote attacker could bypass system access restrictions via crafted network traffic.

Use-after-free vulnerability in the Browser component of Google Chrome on Android prior to version 156.0.8078.47. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

UI misrepresentation in WebAppInstalls in Google Chrome on Android prior to 156.0.8078.47. A remote attacker leveraging social engineering could spoof UI elements via a crafted HTML page.

Incorrect reference resolution in the DevTools component of Google Chrome prior to version 156.0.8078.47. A remote attacker leveraging social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Incorrect authorization in Navigation in Google Chrome on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

Information leak in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

UI misrepresentation in Payments in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

Race condition in Mobile in Google Chrome on iOS prior to 156.0.8078.47. A remote attacker could spoof UI elements via a crafted HTML page.

Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)