CVE Vulnerability Catalog

Use-after-free vulnerability in the ANGLE component of Google Chrome on Windows prior to version 156.0.8078.47. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

Information leak in CustomTabs in Google Chrome on Android prior to 156.0.8078.47 allowed a local attacker to leak sensitive information via a co-installed app. (Chromium security severity: Medium)

Missing authorization in the iOSWebView component of Google Chrome on iOS prior to version 156.0.8078.47. A remote attacker could spoof UI elements via a crafted HTML page.

Race condition in the Chromoting component of Google Chrome prior to version 156.0.8078.47. A remote attacker could bypass system access restrictions via crafted network traffic.

Use-after-free vulnerability in the Browser component of Google Chrome on Android prior to version 156.0.8078.47. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

UI misrepresentation in WebAppInstalls in Google Chrome on Android prior to 156.0.8078.47. A remote attacker leveraging social engineering could spoof UI elements via a crafted HTML page.

Incorrect reference resolution in the DevTools component of Google Chrome prior to version 156.0.8078.47. A remote attacker leveraging social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Incorrect authorization in Navigation in Google Chrome on iOS prior to 156.0.8078.47 allowed a remote attacker to bypass system access restrictions into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

Information leak in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)

UI misrepresentation in Payments in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

Race condition in Mobile in Google Chrome on iOS prior to 156.0.8078.47. A remote attacker could spoof UI elements via a crafted HTML page.

Type confusion in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Missing authorization in Views in Google Chrome on Mac prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Incorrect reference resolution in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page.

Uninitialized resource in the ANGLE component of Google Chrome on Windows prior to version 156.0.8078.47. A remote attacker could potentially obtain cross-origin data via a crafted HTML page.

Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page.

Missing authorization in Speech in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process and leveraged social engineering could bypass site isolation via a crafted Chrome extension.

Incorrect authorization in Autofill in Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process and leveraged social engineering could spoof UI elements via a crafted HTML page.

Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47. A remote attacker could bypass system access restrictions via a crafted Chrome extension.