CVE Vulnerability Catalog

An inappropriate implementation in SafeBrowsing in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass Safe Browsing via a malicious file.

Policy bypass in Content Security Policy in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page.

Insufficient policy enforcement in WebAuthentication in Google Chrome on Android prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page.

Inappropriate implementation in PDF in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass content security policy via a crafted HTML page.

Insufficient validation of untrusted input in Cast in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass same origin policy via a crafted HTML page.

A vulnerability in the File System Access component in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. The issue is rated as low severity.

Google Chrome prior to version 149.0.7827.53 has a vulnerability in Browser due to inappropriate implementation. A remote attacker can bypass navigation restrictions via a crafted HTML page. (Severity: Low)

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in Permissions in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to leak cross-origin data via a crafted HTML page.

Insufficient policy enforcement in Content Settings in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass discretionary access control via a crafted HTML page.

Google Chrome prior to version 149.0.7827.53 has a Use-after-free vulnerability in the Network component. A remote attacker who compromised the renderer process can obtain potentially sensitive information from process memory via a crafted HTML page. (Severity: Low)

A vulnerability in the IndexedDB component in Google Chrome prior to 149.0.7827.53 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. The issue is rated as low severity.

Inappropriate implementation in Payments in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

Inappropriate implementation in Downloads in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

Inappropriate implementation in DevTools in Google Chrome prior to 149.0.7827.53 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension.

A command injection vulnerability was found in D-Link DWR-M920 router versions 1.1.50 and 1.1.70 in the sub_41C8E8 function of the /boafrm/formSmsManage file. Manipulating the action_value argument allows remote code execution. The exploit is publicly available.

In SourceCodester Ship Ferry Ticket Reservation System 1.0, a vulnerability exists in /admin/ – manipulation of the page argument leads to improper authorization. The attack can be performed remotely, and exploit is publicly available.

A vulnerability in Microsoft Graph allows an authorized attacker to disclose sensitive information to an unauthorized actor over a network.

An injection vulnerability in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.