CVE Vulnerability Catalog

An origin validation error in Autofill in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Incorrect authorization in the FileSystem component of Google Chrome prior to 156.0.8078.79. A remote attacker leveraging social engineering could execute arbitrary code outside the sandbox via a crafted HTML page.

A use-after-free vulnerability in MediaStream in Google Chrome before version 156.0.8078.79 allows a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. Chromium rates it as critical.

Incorrect authorization in FileSystem in Google Chrome before version 156.0.8078.79 allows a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page.

An uninitialized resource in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page.

An incorrect reference resolution in CacheStorage in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to obtain sensitive information via a crafted HTML page.

An incorrect authorization in Blink in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Use-after-free vulnerability in the Editing component of Google Chrome prior to 156.0.8078.79. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

Use-after-free vulnerability in the DOM component of Google Chrome prior to 156.0.8078.79. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

Incorrect reference resolution in the Quota component of Google Chrome prior to 156.0.8078.79. A remote attacker who has compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Incorrect reference resolution in the Quota component of Google Chrome prior to 156.0.8078.79. A remote attacker who has compromised the renderer process could execute arbitrary code outside the sandbox via crafted network traffic.

Use-after-free vulnerability in the Dawn component of Google Chrome prior to 156.0.8078.79. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

An out of bounds write in V8 in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Buffer overflow in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in Frames in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

A flaw was found in the required action provider mechanism of Keycloak. When an authorization request includes the kc_action query parameter set to a mandatory action already assigned to the user (such as profile verification or terms and conditions), Keycloak may skip these mandatory challenges and issue an authorization code.

A flaw was found in the UMA resource registration endpoint of the keycloak-services component. When remote resource management is enabled, an authenticated user with specific permissions can update resources they do not own by providing a target resource ID in a request.

This issue was addressed with improved handling of symlinks. It is fixed in Xcode 27.2 and may allow an app to read arbitrary files.

An authorization issue was addressed with improved state management. It is fixed in Xcode 27.2 and may allow an app to access sensitive user data.