A use-after-free flaw (CWE-416) in the Desktop component of Google Chrome before 155.0.8059.79 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs only to lure a user to a crafted HTML page, so any website a user visits can be a delivery route. The CVSS base score is 8.8; according to CISA SSVC data, automatable is no and technical impact is total.
Google · Chrome
A use-after-free flaw in the Network component of Google Chrome before 155.0.8059.79 can be triggered by crafted network traffic. According to the CVE record, a remote attacker can execute arbitrary code outside the browser sandbox. The attack requires that a user visits a page or loads content, but no login.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome before 155.0.8059.79 contains an incorrect authorization flaw in the Updater component. A local attacker can use a local program to execute arbitrary code outside the Chrome sandbox. Exploitation requires that the attacker already has local code execution and that the user interacts with the system, and the CVSS vector and the description are inconsistent about the attack vector.
Google · Chrome
Google Chrome contains a use-after-free flaw (CWE-416) in its Passwords component. A remote attacker who has already compromised the renderer process can execute arbitrary code outside the sandbox by luring a user to a crafted HTML page. The attack requires user interaction and a prior renderer compromise, and the attack complexity is high. The CVE description and the Chromium tracker describe the bug differently, so the exact attack chain should be verified.
Google · Chrome
Google Chrome contains a use-after-free flaw (CWE-416) in its SVG rendering component. A remote attacker can execute arbitrary code inside the browser's renderer sandbox by luring a user to a crafted HTML page. User interaction is required, but no authentication. Google and NVD rate the issue High (CVSS 8.8).
Google · Chrome
Google Chrome on macOS contains an incorrect reference resolution flaw in the Extensions component (CWE-706). A remote attacker who has already compromised the renderer process can use a crafted Chrome extension to execute arbitrary code outside the browser sandbox. The CVSS vector (AC:H, UI:R, S:C) reflects a complex attack that requires user interaction, and the flaw is a second-stage bug rather than a standalone entry point.
Google · Chrome
Google Chrome desktop before 155.0.8059.79 contains a buffer overflow in PDFium, Chrome's built-in PDF component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The CVSS score is 8.8 (High), and the sources do not state whether a separate sandbox escape is needed for full system compromise.
Google · Chrome
A use-after-free vulnerability in the Canvas component of Google Chrome desktop allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. Exploitation requires the victim to load a crafted HTML page, for example through a malicious or compromised website, a malvertising banner or a phishing link. Chromium rates the issue as High, and CVSS 3.1 scores it 8.8.
Google · Chrome
Google Chrome desktop versions prior to 155.0.8059.79 contain a use-after-free flaw in the Media component. A remote attacker can exploit it by luring a user to a crafted HTML page, which may allow arbitrary code execution inside the browser sandbox. The victim must visit the page, but no privileges are required. The advisory does not describe a sandbox escape.
Google · Chrome
A heap-based buffer overflow (CWE-122) in the ANGLE graphics layer of Google Chrome allows a remote attacker to potentially execute arbitrary code outside the browser sandbox. The attack requires only that a user visits a crafted HTML page, with no login needed. NVD lists a CVSS score of 9.6 (critical); the CVE record names Android, while secondary coverage says Windows, Mac and Linux are affected too.
Google · Chrome
A use-after-free flaw in the Media component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs only to lure a user to a crafted HTML page, and no authentication is required. A sandbox escape would be needed for full system compromise.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw in the Browser component of Google Chrome before 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the browser sandbox. Exploitation requires that a user visits a crafted HTML page, for example via a malicious or compromised website or link. Chromium rates the issue Critical, and NVD scores it 9.6 (CVSS 3.1).
Google · Chrome
Google Chrome contains a use-after-free vulnerability (CWE-416) in its SVG component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, and no authentication is needed. NVD rates the issue 8.8 (High), while Chromium rates it Critical.
Google · Chrome
Google Chrome versions before 155.0.8059.79 contain a use-after-free flaw (CWE-416) in the built-in PDF component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, but no login is needed.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome before 155.0.8059.79 contains a use-after-free flaw in the Passwords component. An attacker who has already compromised the renderer process can use a crafted HTML page to execute code outside the browser sandbox. The flaw is a sandbox-escape stage in an attack chain, not a standalone remote vulnerability, and it requires user interaction.
Google · Chrome
Google Chrome on Windows contains an incorrect authorization flaw in Mojo, Chrome's inter-process communication framework. A local attacker running a local program could potentially execute arbitrary code outside the browser sandbox. The attack requires local access and a program already running on the system, so it is not remotely exploitable. The CNA rates the Chromium security severity as High, with a CVSS v3.1 base score of 8.6.
Google · Chrome
Research and translation in progress – available shortly.
A use-after-free flaw in the FileSystem component of Google Chrome before 155.0.8059.79 allows a remote attacker to execute arbitrary code outside the browser sandbox. The attacker only needs to lure a user to a crafted HTML page, so any website, including a compromised legitimate site or a malicious ad, can be the attack vector. NVD scores the issue 9.6 (Critical), while Chromium rates it Medium, and the CVSS vector assumes a sandbox escape that the record does not detail.
Google · Chrome
Research and translation in progress – available shortly.
Google Chrome versions before 155.0.8059.79 contain a type confusion flaw in the V8 JavaScript engine (CVE-2026-110140, CVSS 8.8). A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. No user login is needed, but the user must open the page.
Google · Chrome
A use-after-free flaw in the Media component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs to lure a user to a crafted HTML page, so any browsing session is exposed until the browser is updated. Code execution is limited to the renderer sandbox; a full compromise would normally also require a sandbox escape, which is not described in the sources.
Google · Chrome
A use-after-free flaw in the ShapeDetection component of Google Chrome before 155.0.8059.79 can be abused by a remote attacker. The attacker must first have compromised the renderer process and then lure a user to a crafted HTML page to execute arbitrary code outside the browser sandbox. The CVSS base score is 8.3 (High), and the vector requires user interaction and a prior renderer compromise. No exploitation or public proof of concept has been found.
Google · Chrome
