CVE Vulnerability Catalog

Integer overflow in the Compositing component in Google Chrome prior to 155.0.8059.39. A remote attacker can obtain cross-origin data via a crafted HTML page.

Improper input validation in the Extensions component in Google Chrome prior to 155.0.8059.39. A remote attacker leveraging social engineering can bypass web origin policy into a privileged page via a crafted Chrome extension.

Information leak vulnerability in the Paint component in Google Chrome prior to 155.0.8059.39. A remote attacker can exploit a crafted HTML page to leak sensitive information.

Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in PDF in Google Chrome on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. This is a medium severity vulnerability.

Incorrect authorization in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.

Confused deputy in UI in Google Chrome on Android prior to 155.0.8059.39 allowed a local attacker to bypass system access restrictions into a privileged page via a co-installed app.

Incorrect reference resolution in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. This is a low severity vulnerability.

Incorrect authorization in WebAppInstalls in Google Chrome on Android prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via a crafted HTML page.

Missing authorization in Chrome for iOS in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Open redirect in AppManifest in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page.

Information leak in Editing in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted HTML page.

Use of released resource in UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page.

Use after free vulnerability in the Media component of Google Chrome prior to version 155.0.8059.39. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

UI misrepresentation in FullScreen in Google Chrome on Android prior to 155.0.8059.39 allowed a remote attacker to spoof address bar via a crafted HTML page. This is a low severity vulnerability.

UI misrepresentation in Chromoting in Google Chrome on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via crafted network traffic. This is a low severity vulnerability.

Use after free vulnerability in the Modularization component of Google Chrome prior to version 155.0.8059.39. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

Incorrect authorization vulnerability in the Bluetooth component of Google Chrome prior to version 155.0.8059.39. A remote attacker can obtain sensitive information via a crafted HTML page.

Incorrect authorization in Browser in Google Chrome on Android prior to 155.0.8059.39 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app. This is a medium severity vulnerability.

Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. This is a low severity vulnerability.