Google Chrome before 156.0.8078.47 contains a memory corruption flaw in its Extensions component (CWE-119). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires no account, but the victim must open the malicious page. The CVSS base score is 8.8, while Chromium rates the issue Medium; the description does not report a full system compromise.
Google · Chrome
Google Chrome on macOS contains an improper input validation flaw in ANGLE, the graphics layer that processes WebGL and OpenGL ES calls. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user loads the malicious page, and the attacker still needs a separate sandbox escape for full system compromise.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free vulnerability (CWE-416) in the DevTools component. A remote attacker who lures a user to a crafted HTML page may be able to execute arbitrary code outside the browser sandbox. NVD rates the flaw CVSS 9.6 (critical), while Google rates it Low in Chromium severity.
Google · Chrome
A use-after-free vulnerability in the Transactions Platform component of Google Chrome desktop allows a remote attacker to execute arbitrary code inside the browser sandbox. Exploitation requires that the victim loads a crafted HTML page, for example through phishing or a malicious link. According to the research notes, full compromise would normally require a second sandbox-escape vulnerability, but this is not confirmed by the sources.
Google · Chrome
A use-after-free flaw in the SignIn component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs to lure the user to a crafted HTML page, and no login is required. CISA's SSVC assessment rates the technical impact as total, but exploitation is rated none and the bug is not automatable, and Chromium rates the severity as Low.
Google · Chrome
A use-after-free flaw in the Extensions component of desktop Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs only to lure a user to a crafted HTML page, and no login is required. Per the description, the impact is limited to the sandbox, so a full compromise would normally also need a sandbox-escape flaw. CISA SSVC rates exploitation as none and automatable as no.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a use-after-free vulnerability (CWE-416) in the Extensions component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. User interaction is required, and full compromise typically needs a second flaw to escape the sandbox.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability in the Compositing component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires no privileges, but a user must open the page, and code execution is limited to the sandbox unless it is combined with a further sandbox escape.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in ShadowDOM. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires that the victim loads the page, and the CVE alone does not describe a sandbox escape.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in the API component (CWE-119). A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The official record does not claim a sandbox escape, and Chromium rates the issue Medium.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free flaw in the Script component (CWE-416). A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. Exploitation requires that a user visits the malicious page; no privileges are needed.
Google · Chrome
A use-after-free vulnerability in the Media component of Google Chrome on Android before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a user to open a crafted HTML page, for example via a phishing link. Chromium rates the severity as Low, while CVSS 3.1 scores it 8.8 (High). The description does not mention a sandbox escape, so full device compromise would normally require a further vulnerability.
Google · Chrome
A memory corruption flaw in Skia, the 2D graphics library used by Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs only to lure a user to a crafted HTML page, and no authentication is required, but the user must load the page. According to the CVE record, code execution is confined to the sandbox, and a full system compromise would require a further vulnerability. Google rates the Chromium security severity as Medium, and no active exploitation is known.
Google · Chrome
Google Chrome before 156.0.8078.47 contains a use-after-free flaw (CWE-416) in its Extensions component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a victim to a crafted HTML page. The attack requires no credentials but needs user interaction, and no sandbox escape has been reported.
Google · Chrome
A memory corruption flaw (CWE-119) in the Frames component of desktop Google Chrome allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. Exploitation requires the victim to open a crafted HTML page, so user interaction is needed but no authentication. The CVSS 3.1 base score is 8.8 (High).
Google · Chrome
Google Chrome prior to 156.0.8078.47 contains a use-after-free vulnerability in the WebProtect component (CWE-416). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Exploitation requires that the user visits the page, and no privileges are needed. Chromium-based browsers such as Microsoft Edge may be affected as well.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome versions before 156.0.8078.47 contain a use-after-free vulnerability (CWE-416) in SiteIsolation, Chrome's process isolation component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CVSS base score is 8.8 (High), and user interaction, such as opening the page, is required.
Google · Chrome
Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in the Audio component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, for example via a web link or email link.
Google · Chrome
Google Chrome for Android contains an input validation flaw in the Omnibox (address and search bar). A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. User interaction is required; the NVD CVSS 3.1 base score is 8.8.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome versions before 156.0.8078.47 contain a use-after-free vulnerability (CWE-416) in the FileSystem component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The user must visit the page, and no authentication is required. The CVSS v3.1 base score is 8.8 (High).
Google · Chrome
Google Chrome for Android contains a memory corruption flaw in its Text component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page, for example through a phishing link or a malicious website. The NVD rates the issue CVSS 8.8 (High), and the Chromium project rates it Medium.
Google · Chrome
Google Chrome desktop builds before 156.0.8078.47 contain an out-of-bounds read in the Focus component. A remote attacker can exploit it by luring a user to a crafted HTML page, which may allow arbitrary code execution inside the browser sandbox. User interaction is required, but no privileges are needed. The CNA rates the issue High (CVSS 8.8).
Google · Chrome
Google Chrome before 156.0.8078.47 contains a memory corruption flaw in an API. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The attack requires no authentication but needs user interaction, such as opening the page.
Google · Chrome
