CVE Vulnerability Catalog

Type confusion in V8 in Google Chrome prior to 152.0.7977.65. A remote attacker leveraging social engineering could execute arbitrary code inside the sandbox via a crafted HTML page.

Observable discrepancy in PerformanceAPIs in Google Chrome prior to 152.0.7977.65. A remote attacker could potentially obtain cross-origin data via a crafted HTML page.

Incorrect authorization in Extensions in Google Chrome prior to 152.0.7977.65. A remote attacker who had compromised the renderer process could bypass web origin policy via a crafted HTML page.

Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65. A remote attacker who had compromised the renderer process could bypass site isolation via a crafted PDF file.

Out of bounds write in Crashpad in Google Chrome on Windows prior to 152.0.7977.65. A remote attacker who had compromised the renderer process could execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in ServiceWorker in Google Chrome prior to 152.0.7977.65. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

Integer overflow in WebRTC in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: Low)

Observable discrepancy in CustomTabs in Google Chrome on Android prior to 152.0.7977.65 allowed a local attacker to obtain cross-origin data via a co-installed app. (Severity: Medium)

Buffer overflow in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Incomplete cleanup in Chromium in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted Chrome extension. (Severity: Low)

Incorrect authorization in Select in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Severity: Low)

Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Use after free in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted Chrome extension. (Severity: Medium)

Improper input validation in Editing in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass web origin policy via a crafted HTML page. (Severity: Medium)

Incorrect reference resolution in Loader in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via crafted network traffic. (Severity: Medium)

Information leak in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Severity: Medium)

Improper initialization in the Network component in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. The issue has a medium severity rating.

Use after free in the Chromecast component in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page. The issue has a high severity rating.

Type confusion in the V8 engine in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. The issue has a high severity rating.

Use after free in the Search component in Google Chrome on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. The issue has a medium severity rating.