CVE Vulnerability Catalog

Google Chrome prior to 147.0.7727.55 has an inappropriate implementation in Navigation, allowing a remote attacker who compromised the renderer process to leak cross-origin data via a crafted HTML page. (Severity: Low)

Google Chrome prior to version 147.0.7727.55 contains a policy bypass vulnerability in ServiceWorkers that allows a remote attacker to bypass Content Security Policy via a crafted HTML page. (Severity: Low)

Google Chrome on Android prior to 147.0.7727.55 has an incorrect security UI in Omnibox, allowing a remote attacker to spoof the URL bar contents via a crafted HTML page. (Severity: Low)

Google Chrome on Windows prior to 147.0.7727.55 has incorrect security UI in permissions, allowing domain spoofing via crafted HTML.

Google Chrome prior to version 147.0.7727.55 has a policy bypass vulnerability in IFrameSandbox. A remote attacker can convince a user to perform specific UI gestures to bypass navigation restrictions via a crafted HTML page.

Insufficient policy enforcement in DevTools in Google Chrome prior to 147.0.7727.55 allowed an attacker who convinced a user to install a malicious extension to bypass enterprise host restrictions for cookie modification via a crafted Chrome Extension. (Chromium security severity: Low)

Google Chrome prior to 147.0.7727.55 has a policy bypass in Downloads, allowing a remote attacker to bypass multi-download protections via a crafted HTML page. (Severity: Low)

Insufficient policy enforcement in History Navigation in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to inject arbitrary scripts or HTML (UXSS) via a crafted HTML page.

In Google Chrome on iOS prior to 147.0.7727.55, incorrect security UI in Omnibox allowed a remote attacker to perform UI spoofing via a crafted HTML page. Severity: Low.

In Google Chrome prior to 147.0.7727.55, incorrect security UI in Downloads allowed a remote attacker to perform UI spoofing after convincing a user to engage in specific UI gestures. Severity: Low.

Google Chrome prior to 147.0.7727.55 has a policy bypass in Audio, allowing a remote attacker who convinced a user to perform specific UI gestures to bypass sandbox download restrictions via a crafted HTML page. (Severity: Low)

Google Chrome on iOS prior to 147.0.7727.55 has an incorrect security UI in Omnibox, allowing a remote attacker to spoof the URL bar contents via a crafted domain name. (Severity: Low)

Google Chrome prior to 147.0.7727.55 has an inappropriate implementation in PDF, allowing a remote attacker to bypass navigation restrictions via a crafted HTML page. (Severity: Low)

A race condition in V8 in Google Chrome prior to 147.0.7727.55 could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Google Chrome prior to version 147.0.7727.55 has insufficient policy enforcement in PWAs, allowing a remote attacker who compromised the renderer process to install a PWA without user consent via a crafted HTML page. (Severity: Medium)

Insufficient policy enforcement in browser UI in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page.

Google Chrome prior to version 147.0.7727.55 contained a race condition in WebCodecs that allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Severity: Medium)

A cryptographic flaw in PDFium in Google Chrome prior to 147.0.7727.55 allowed an attacker to read potentially sensitive information from encrypted PDFs via a brute-force attack.

Google Chrome prior to version 147.0.7727.55 has an uninitialized use vulnerability in WebCodecs. A remote attacker can obtain potentially sensitive information from process memory via a crafted HTML page.

Google Chrome on Windows prior to 147.0.7727.55 has insufficient validation in Downloads, allowing bypass of download restrictions via crafted HTML.