CVE Vulnerability Catalog

Information leak vulnerability in CORS in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could obtain cross-origin data via a crafted HTML page. (Severity: Medium)

Out of bounds read in Chromoting in Google Chrome on Windows prior to 153.0.8010.36. A local attacker could read memory outside the sandbox via a local program. (Severity: High)

Information leak in WebMCP in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could obtain cross-origin data via a crafted HTML page.

Race condition in Mobile in Google Chrome on iOS prior to 153.0.8010.36. A remote attacker leveraging social engineering could bypass web origin policy via a crafted HTML page.

Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in CORS in Google Chrome prior to 153.0.8010.36. A remote attacker who had compromised the renderer process could bypass web origin policy via a crafted HTML page.

Uninitialized resource in Media in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Severity: Medium)

Incorrect authorization in GPU in Google Chrome on Mac prior to 153.0.8010.36. A remote attacker who had compromised the renderer process could potentially obtain cross-origin data via a crafted HTML page.

Information leak in Downloads in Google Chrome prior to 153.0.8010.36. A remote attacker who had compromised the renderer process could obtain cross-origin data via a crafted HTML page.

Confused deputy in the Prerender component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially bypass web origin policy via a crafted HTML page. (Severity: Medium)

Missing authorization in CORS in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass web origin policy via a crafted HTML page.

A flaw was found in DPDK lib/vhost. Missing length validation before reading command_data in the virtio-net control-queue handler can cause an out-of-bounds read and a host process crash.

Adobe Experience Manager is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and gain unauthorized limited write access. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page.

In setTo of ResourceTypes.cpp, there is a possible out-of-bounds heap read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In the get_eht_operation_channel_width function of ieee802_11_common.c, there is a possible out of bounds read due to an incorrect bounds check. This could lead to remote (proximal/adjacent) information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

In multiple locations, there is a possible improper data sanitization due to a logic error. This could lead to local information disclosure without additional privileges or user interaction.

In openFile of AppFuseBridge.java, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure without additional privileges or user interaction.

In screenArgsForPermissionCheckIfAny of multiple locations, there is a possible risk of unauthorized access due to a confused deputy. This could lead to local information disclosure without additional privileges or user interaction.

In updateInternal of MediaProvider.java, there is a possible exposure of file contents due to a race condition. This could lead to local information disclosure without additional privileges or user interaction.

In getAllSessions of multiple files, there is a possible confused deputy due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.