CVE Vulnerability Catalog

Race condition in Core in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in Search in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted HTML page.

Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension.

UI misrepresentation in Browser in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page.

Improper signature verification in Loader in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Incorrect authorization in the Network component in Google Chrome prior to 156.0.8078.47. A remote attacker who had compromised the renderer process could bypass web origin policy via a crafted HTML page.

Missing authorization in the Editing component of Google Chrome prior to 156.0.8078.47. A remote attacker could bypass system access restrictions via a crafted HTML page.

UI misrepresentation in Model in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page.

Use-after-free vulnerability in the Browser component of Google Chrome on Android prior to version 156.0.8078.47. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page.

UI misrepresentation in WebAppInstalls in Google Chrome on Android prior to 156.0.8078.47. A remote attacker leveraging social engineering could spoof UI elements via a crafted HTML page.

Incorrect reference resolution in the DevTools component of Google Chrome prior to version 156.0.8078.47. A remote attacker leveraging social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Missing authorization in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Privilege elevation in the Google Lens component of Google Chrome prior to version 156.0.8078.47. A remote attacker who had compromised the renderer process could obtain sensitive information via a crafted HTML page.

Missing authorization in Extensions in Google Chrome on Android prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page.

Missing authorization in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially obtain sensitive information via a crafted HTML page.

Race condition in DataTransfer in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted HTML page.

Use after free in the WebAppInstalls component of Google Chrome on Android prior to 156.0.8078.47. A remote attacker leveraging social engineering could execute arbitrary code outside the sandbox via a co-installed app.

Use of released resource in Navigation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page.

Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Incorrect authorization in FullScreen in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page.