CVE Vulnerability Catalog

Out of bounds write in ANGLE in Google Chrome on Windows prior to 153.0.8010.36 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Observable discrepancy in SVG in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Severity: Low)

Observable discrepancy in Prefetch in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Severity: Low)

Incorrect reference resolution in Storage in Google Chrome on Windows prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Low)

Use-after-free in DevTools in Google Chrome before 153.0.8010.36. A remote attacker leveraging social engineering could execute arbitrary code inside the sandbox via a crafted HTML page.

Improper initialization in Views in Google Chrome on Windows before 153.0.8010.36. A remote attacker who had compromised the renderer process and leveraged social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Race condition in Payments in Google Chrome before 153.0.8010.36. A remote attacker leveraging social engineering could spoof UI elements via a crafted HTML page.

Incorrect authorization in ServiceWorker in Google Chrome before 153.0.8010.36. A remote attacker who had compromised the renderer process could bypass web origin policy via a crafted HTML page.

Incorrect reference resolution in Extensions in Google Chrome before 153.0.8010.36. A remote attacker could potentially execute arbitrary code outside the sandbox via crafted network traffic.

Type confusion in V8 in Google Chrome before 153.0.8010.36. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Missing authorization in FileSystem in Google Chrome before 153.0.8010.36. A remote attacker who had compromised the renderer process could obtain cross-origin data via a crafted HTML page.

Incorrect authorization in Omnibox in Google Chrome before 153.0.8010.36. A remote attacker could bypass system access restrictions into a privileged page via a crafted HTML page.

Use-after-free in Sharing in Google Chrome on iOS before 153.0.8010.36. A remote attacker could execute arbitrary code outside the sandbox via crafted network traffic.

Improper certificate validation in FedCM in Google Chrome before 153.0.8010.36. A remote attacker leveraging social engineering could bypass web origin policy via crafted network traffic.

Use-after-free in the Device component in Google Chrome on Mac prior to 153.0.8010.36. A remote attacker could exploit a crafted HTML page to potentially execute arbitrary code outside the sandbox.

Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass site isolation via a crafted HTML page.

Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process and leveraged social engineering could potentially obtain sensitive information via a crafted HTML page.

Out-of-bounds read in ANGLE in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36. A remote attacker could bypass system access restrictions via a crafted HTML page.

Out-of-bounds read in ANGLE in Google Chrome on Windows prior to 153.0.8010.36. A remote attacker could potentially read memory outside the sandbox via a crafted HTML page.