CVE Vulnerability Catalog

Use after free in Streaming in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via crafted network traffic.

Improper input validation in Omnibox in Google Chrome on Android prior to 156.0.8078.47 allowed a local attacker leveraging social engineering to bypass web origin policy via a co-installed app.

Uninitialized resource in Media in Google Chrome on Windows prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially read memory outside the sandbox via a crafted HTML page.

Use of uninitialized variable in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Out of bounds write in ANGLE in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use of uninitialized variable in Media in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially read memory inside the sandbox via a crafted media file.

Type confusion in WebFonts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page.

Information loss in the PDF component of Google Chrome on Android prior to version 156.0.8078.47. A remote attacker could bypass web origin policy via a crafted HTML page.

UI misrepresentation in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page.

Confused deputy in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Incorrect authorization in Extensions in Google Chrome prior to 156.0.8078.47. A remote attacker could bypass system access restrictions via a crafted Chrome extension.

Incorrect authorization in PDFium in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted PDF file.

Incorrect authorization in WebAppInstalls in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. Chromium rated it as Low.

Use after free in Date in Google Chrome prior to 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Use-after-free vulnerability in the Turbolev component of Google Chrome prior to version 156.0.8078.47. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Missing authorization in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

Use-after-free vulnerability in the Views component of Google Chrome prior to version 156.0.8078.47. A remote attacker who had compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Race condition in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page.

Incorrect authorization in the Workers component of Google Chrome prior to version 156.0.8078.47. A remote attacker who had compromised the renderer process could bypass web origin policy via a crafted HTML page.

Missing authorization in PerformanceAPIs in Google Chrome prior to 156.0.8078.47. A remote attacker could obtain cross-origin data via a crafted HTML page.