Google Chrome vulnerabilities

Improper input validation in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page.

An uninitialized resource in GPU in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to read memory inside the sandbox via a crafted HTML page.

Incorrect authorization in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Use of released resource in ContextMenu in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page.

Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted HTML page.

Improper certificate validation in Network in Google Chrome on Windows prior to 156.0.8078.47 allowed a remote attacker to leak sensitive information via crafted network traffic.

Confused deputy in the Extensions component of Google Chrome prior to version 156.0.8078.47. A remote attacker leveraging social engineering could bypass web origin policy via a crafted Chrome extension.

An out of bounds read in ANGLE in Google Chrome on Mac prior to 156.0.8078.47 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page.

A race condition exists in the Transactions Platform component of Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process and leveraged social engineering could spoof UI elements via a crafted HTML page.

Incorrect authorization exists in the SignIn component of Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process could bypass system access restrictions via a crafted HTML page.

Incorrect authorization exists in the Extensions component of Google Chrome prior to 156.0.8078.47. A remote attacker leveraging social engineering could bypass web origin policy via a crafted Chrome extension.

Race condition in the Extensions component of Google Chrome prior to version 156.0.8078.47. A remote attacker leveraging social engineering could bypass system access restrictions via a crafted HTML page.

Improper input validation exists in the Compositing component of Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process could bypass site isolation via a crafted HTML page.

Missing authorization exists in the ShadowDOM component of Google Chrome prior to 156.0.8078.47. A remote attacker could bypass web origin policy via a crafted HTML page.

Incorrect authorization exists in the API component of Google Chrome prior to 156.0.8078.47. A remote attacker leveraging social engineering could bypass system access restrictions via a crafted Chrome extension.

Information loss exists in the Script component of Google Chrome prior to 156.0.8078.47. A remote attacker could bypass web origin policy via a crafted HTML page.

Missing authorization in Media in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page.

Type confusion exists in the Skia library of Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process could obtain cross-origin data via a crafted HTML page.

Incorrect authorization exists in the Extensions component of Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process could bypass system access restrictions into a privileged page via a crafted HTML page.

Use after free exists in the Frames component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

Race condition in WebProtect in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted PDF file.

Incorrect reference resolution in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page.

Incorrect authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use of an uninitialized variable in Audio in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file.

Confused deputy in Omnibox in Google Chrome on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to obtain sensitive information via a co-installed app.

Type confusion in CacheStorage in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Missing authorization in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page.

UI misrepresentation in Text in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof the address bar via a crafted HTML page.

Use after free in Focus in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Inappropriate implementation in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.

Use after free in DisplayLocking in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Missing authorization in Passwords in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page.

Information leak in PerformanceAPIs in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page.

UI misrepresentation in the Interstitials component of Google Chrome prior to version 156.0.8078.47. A remote attacker leveraging social engineering could spoof UI elements via a crafted HTML page.

UI misrepresentation in Mobile in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.

Use after free in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page.

Google Chrome prior to 156.0.8078.47 contains a use-after-free in the Input component. A remote attacker who has compromised the renderer process can execute arbitrary code outside the sandbox via a crafted HTML page.

Information leak in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive information via a crafted HTML page.

Missing authorization in Actor in Google Chrome on Android prior to 156.0.8078.47 allowed a local attacker to spoof UI elements via a co-installed app.

Integer overflow in ANGLE in Google Chrome on Windows prior to 156.0.8078.47. A remote attacker could read memory outside the sandbox via a crafted HTML page.

Use after free in the Compositing component of Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

UI misrepresentation in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted Chrome extension.

UI misrepresentation in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof the address bar via a crafted HTML page.

Incorrect authorization in Core in Google Chrome on Mac prior to 156.0.8078.47. A remote attacker who had compromised the renderer process and leveraged social engineering could bypass web origin policy via a crafted HTML page.

Race condition in Toolbar in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page.

Origin validation error in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page.

Incorrect authorization in Media in Google Chrome on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page.

Incomplete cleanup in the Browser component of Google Chrome prior to 156.0.8078.47. A remote attacker could bypass web origin policy via a crafted HTML page.

Use of insufficiently random values in Notifications in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker to spoof UI elements via a crafted HTML page.

Use after free in GetUserMedia in Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page.