CVE Vulnerability Catalog

Confused deputy in the Prerender component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially bypass web origin policy via a crafted HTML page. (Severity: Medium)

Missing authorization in the Downloads component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome extension. (Severity: Medium)

Out of bounds read in the Media component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Information leak in the ServiceWorker component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page. (Severity: Medium)

Out of bounds write in the WebGL component of Google Chrome on Android prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Information leak in the Frames component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to leak sensitive information via a crafted HTML page. (Severity: Low)

Incomplete cleanup in the Browser component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Severity: Medium)

Information leak vulnerability in the ControlledFrame component in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could obtain sensitive information via a crafted HTML page.

Missing authorization in CORS in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass web origin policy via a crafted HTML page.

Race condition in FileAPI in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass site isolation via a crafted HTML page.

Incorrect authorization in Navigation in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could spoof UI elements via a crafted HTML page.

Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36. A remote attacker could obtain sensitive information via a crafted Chrome extension.

Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36. A remote attacker could potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass system access restrictions via a crafted HTML page.

In cjose versions 0.6.1 through 0.6.2.5, when encrypting a JWE using AES-CBC-HMAC content-encryption algorithms (A128CBC-HS256, A192CBC-HS384, A256CBC-HS512) with any key-management algorithm that generates a fresh content-encryption key (CEK), the CEK is all zero bytes instead of being randomly generated. The resulting JWE is encrypted and authenticated under a fixed, publicly known key, allowing anyone who obtains the JWE to recover plaintext and forge or modify content. Fixed in 0.6.2.6 by generating CEK from RAND_bytes.

The cjose C library implementing JOSE has a vulnerability in the JWE decryption path for AES Key Wrap algorithms (A128KW, A192KW, A256KW) due to lack of validation of the attacker-supplied encrypted_key length before unwrapping into a fixed-size heap buffer. A remote unauthenticated attacker can trigger an out-of-bounds heap write, leading at least to a crash (DoS) and potentially to further memory corruption. The entry points cjose_jwe_import() and cjose_jwe_decrypt() are pre-authentication and process fully attacker-controlled input.

MCP Kotlin SDK versions 0.7.0 through 0.12.0 have an unbounded buffer growth in the ReadBuffer.append function, allowing a remote attacker to exhaust memory (OOM) and crash the process. The issue occurs in the stdio transport where data is buffered without a size limit.

In Google go-attestation up to version 0.6.1, there is an uncontrolled recursion vulnerability in the Windows SIPA event log parser, allowing an attacker to cause a denial of service (DoS) by submitting a crafted event log with deeply nested elamAggregation headers. This leads to stack overflow and immediate crash of the application.

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

Maravel prior to version 10.74.0 contains a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. In environments with low cache memory or active Atomic Lazy Eviction model, token blacklist entries (jti) are truncated from 14 days to a maximum of 2 hours, and any tag flush instantly invalidates the entire index, silently resurrecting stolen or logged-out tokens.