CVE-2025-38280

In node-opcua (an OPC UA implementation for TypeScript and Node.js), versions 2.42.0 through 2.180.0 do not honor namespace-level access control configured via setDefaultRolePermissions for nodes without explicit per-node permissions. SessionContext.getApplicableRolePermissions reads a missing or null value instead of the configured namespace field, and the null result is treated permissively. As a result, an anonymous network client can write variables or call bound methods when an operator relied on restrictive namespace defaults.

Dell Wyse Management Suite versions prior to 2609.0.0.155 contain a cross-site scripting vulnerability (improper neutralization of input during web page generation). A low-privileged attacker with remote access could exploit it to inject script.

Buffer overflow in ANGLE in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.

Buffer overflow in Dawn in Google Chrome on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use-after-free vulnerability in the WebGL component of Google Chrome on Android prior to 157.0.8103.38. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use-after-free vulnerability in the Navigation component of Google Chrome on Android prior to 157.0.8103.38. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Privilege elevation in Contacts in Google Chrome on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Memory corruption in ANGLE in Google Chrome on Android prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in Passwords in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page.