CVE Vulnerability Catalog

Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Missing authorization vulnerability in the Extensions component in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could potentially execute arbitrary code outside the sandbox via crafted network traffic.

Use after free vulnerability in the V8 component in Google Chrome prior to 153.0.8010.36. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free vulnerability in the DevTools component in Google Chrome prior to 153.0.8010.36. A local attacker could execute arbitrary code outside the sandbox via a local program.

Uncontrolled search path element in CredentialProvider in Google Chrome on Windows prior to 153.0.8010.36. A local attacker could execute arbitrary code outside the sandbox via a local program. (Severity: Medium)

Use after free in Core in Google Chrome on Windows prior to 153.0.8010.36. A remote attacker who compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Use after free in Views in Google Chrome prior to 153.0.8010.36. A local attacker could execute arbitrary code outside the sandbox via a local program.

Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Incorrect authorization in Updater in Google Chrome on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Severity: Low)

Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Severity: Medium)

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Memory corruption in V8 in Google Chrome prior to 153.0.8010.36. A remote attacker could potentially execute arbitrary code inside the sandbox via a crafted Chrome extension.

Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36. A remote attacker who had compromised the renderer process and leveraged social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Incorrect authorization in WebView in Google Chrome on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Severity: Medium)