New vulnerabilities – clearly explained

Google Chrome

Research and translation in progress – available shortly.

Google Chrome: Improper input validation in Loader allows sandbox code execution

Google Chrome versions before 156.0.8078.47 contain an improper input validation flaw in the Loader component. A remote attacker can potentially execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. Google rates the issue Low in Chromium, and the NVD base score is 8.8 with user interaction required.

Google · Chrome

Google Chrome: Use-after-free in ANGLE graphics component on Windows

A use-after-free flaw in the ANGLE graphics component of Google Chrome on Windows allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires the victim to open a crafted HTML page, for example through a link in a phishing email or a malicious website. Code execution is limited to the sandbox, so a second flaw would be needed for full system compromise. The vendor rates the issue as High severity.

Google · Chrome

Google Chrome: Improper input validation in Omnibox on Android

Improper input validation in the Omnibox (address and search bar) of Google Chrome for Android before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attack requires the victim to open a crafted HTML page; no login is needed. The CVSS 3.1 base score is 8.8, while Chromium rates the severity as Low.

Google · Chrome

Google Chrome: Memory corruption in FullScreen

A memory corruption flaw in the FullScreen component of Google Chrome desktop allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. Exploitation requires a victim to open a crafted HTML page. The vulnerability is sandbox-scoped (CVSS scope unchanged), so it is not a full system takeover on its own, but it could be chained with a sandbox escape. The NVD CVSS score of 8.8 was reported in the brief and should be re-checked against NVD, as Chromium rates the issue Low.

Google · Chrome

Google Chrome: Use after free in Input component allows sandboxed code execution

Google Chrome before 156.0.8078.47 contains a use-after-free flaw in the Input component (CWE-416). A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user visits the malicious page, and no authentication is needed.

Google · Chrome

Google Chrome: Improper input validation in PerformanceAPIs

Google Chrome before 156.0.8078.47 contains an improper input validation flaw in PerformanceAPIs. According to the CVE record, a remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must visit the malicious page, so drive-by browsing and malicious links are the main risk. The Chromium bug tracker entry describes a different issue (an information disclosure), so the real impact is uncertain.

Google · Chrome

Google Chrome: Memory corruption in Core allows code execution in sandbox

A memory corruption flaw in the Core component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox via a crafted HTML page. The victim must open the page, for example through a phishing link or a malicious website. Chromium rates the issue Low, while NVD scores it 8.8 (High). No evidence of exploitation in the wild or public proof of concept was found.

Google · Chrome

Google Chrome: Use-after-free in Prompts component allows sandbox code execution

Google Chrome before 156.0.8078.47 contains a use-after-free vulnerability in the Prompts component. A remote attacker can execute arbitrary code inside the browser sandbox by luring a user to a crafted HTML page. The victim must visit the page, and no authentication is needed on the attacker side. Chromium rates the severity as Low, and the sources do not describe a full sandbox escape.

Google · Chrome

Google Chrome: Memory corruption in Google Lens

A memory corruption flaw in the Google Lens feature of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires the victim to open a crafted HTML page. NVD rates the CVSS 3.1 base score at 8.8, while Chromium classifies the severity as Low.

Google · Chrome

Google Chrome: Memory corruption in ANGLE allows sandboxed code execution

Google Chrome on Windows before 156.0.8078.47 contains a memory corruption flaw in ANGLE, the graphics translation layer of the browser. A remote attacker can use a crafted HTML page to execute arbitrary code inside the browser sandbox. The attack requires that a user loads the page, and a sandbox escape would still be needed for full compromise.

Google · Chrome

Google Chrome: Memory corruption in XML handling allows sandboxed code execution

Google Chrome versions before 156.0.8078.47 contain a memory corruption flaw in XML handling (CWE-119). A remote attacker can craft an HTML page that may execute arbitrary code inside the browser sandbox. The victim must open the malicious page, for example through a phishing link or a malicious advertisement; no login is required.

Google · Chrome

Google Chrome: Memory corruption in CredentialProvider on Windows

Google Chrome on Windows prior to 156.0.8078.47 contains a memory corruption flaw in the CredentialProvider component. A remote attacker who can lure a user to a crafted HTML page may potentially execute arbitrary code outside the Chrome sandbox. The CVSS score is 9.6 (Critical), while the Chromium security severity is rated Medium.

Google · Chrome

Google Chrome: Use-after-free in Views

A use-after-free vulnerability in the Views component of Google Chrome on macOS allows a remote attacker to potentially execute arbitrary code inside the sandbox. The attacker must lure a user to a crafted HTML page, so user interaction is required. Chromium rates the severity as Medium, and the CVSS base score is 8.8.

Google · Chrome

Google Chrome: Memory corruption in SiteIsolation

Google Chrome before 156.0.8078.47 contains a memory corruption flaw in SiteIsolation, Chromium's mechanism for isolating websites in separate processes. A remote attacker can use a crafted HTML page to potentially execute arbitrary code inside the browser sandbox. The victim must open the page (user interaction), and the CVE text does not describe a full sandbox escape.

Google · Chrome

Google Chrome: Memory corruption in Paint allows code execution in sandbox

A memory corruption flaw in the Paint component of Google Chrome prior to 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs a crafted HTML page that the user must open, so user interaction is required. Google rates the Chromium security severity as Critical, and the NVD CVSS 3.1 base score is 8.8.

Google · Chrome

Google Chrome: Memory corruption in Accessibility

Memory corruption in the Accessibility component of Google Chrome before 156.0.8078.47 may allow a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attacker needs a user to open a crafted HTML page, but no privileges are required. The stated impact is code execution inside the sandbox, not a sandbox escape, and a complete attack chain is not confirmed.

Google · Chrome

Google Chrome: Use after free in Extensions allows code execution in sandbox

A use-after-free flaw in the Extensions component of Google Chrome before 156.0.8078.47 allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs to lure a user to a crafted HTML page; no account is required. The CVSS base score is 8.8 (NVD), while the Chromium severity is rated Medium.

Google · Chrome

Google Chrome

Research and translation in progress – available shortly.

Google Chrome for Android: Memory corruption in Passwords

A memory corruption flaw in the Passwords component of Google Chrome for Android before 156.0.8078.47 allows a remote attacker to potentially execute arbitrary code inside the browser sandbox. The attack requires that a user opens a crafted HTML page. The CVSS score of 8.8 and the NVD status could not be verified, and the referenced Chromium issue describes a different bug (a re-authentication bypass), so the exact nature of the flaw is not confirmed.

Google · Chrome

Google Chrome: Use-after-free in API allows code execution in sandbox

A use-after-free flaw in the API component of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attack requires a user to visit a crafted HTML page. Per the description, the impact is limited to the sandbox; a full compromise would likely also require a sandbox escape. The vendor rates the Chromium security severity as Medium.

Google · Chrome

Google Chrome: Use after free in ReadingMode

A use-after-free flaw in the ReadingMode feature of Google Chrome allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs to lure a user into opening a crafted HTML page. Chromium rates the bug Low, and the CNA text describes impact limited to the sandbox, so full system compromise would likely require a second vulnerability.

Google · Chrome

Google Chrome: Memory corruption in ANGLE allows code execution in sandbox

A memory corruption flaw in ANGLE, the graphics translation layer of Google Chrome, allows a remote attacker to execute arbitrary code inside the browser sandbox. The attacker needs the victim to open a crafted HTML page, and no authentication is required. Full system compromise would also require a separate sandbox escape flaw. Chromium-based browsers such as Microsoft Edge use the same code and are also affected.

Google · Chrome

Google Chrome: Memory corruption in Extensions

Google Chrome for desktop before 156.0.8078.47 contains a memory corruption flaw in its Extensions component (CWE-119). A remote attacker who lures a user to a crafted HTML page could potentially execute arbitrary code inside the browser sandbox. The impact is limited to the sandbox, so a full system compromise would require an additional sandbox escape. Exploitation needs no login but requires the victim to visit the malicious page.

Google · Chrome

Google Chrome: Use after free in Accessibility allows code execution

Google Chrome prior to 156.0.8078.47 contains a use-after-free memory corruption flaw (CWE-416) in its Accessibility component. A remote attacker can use a crafted HTML page to execute arbitrary code inside the Chrome renderer sandbox. The attack requires that a user opens the malicious page; no authentication is needed.

Google · Chrome