CVE Vulnerability Catalog

Double free in PDFium in Google Chrome on Windows before 153.0.8010.36. A remote attacker could exploit a crafted PDF file to potentially execute arbitrary code inside the sandbox.

Confused deputy in DataTransfer in Google Chrome before 153.0.8010.36. A remote attacker who compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Buffer overflow in WebRTC in Google Chrome before 153.0.8010.36. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Use-after-free in Receiver in Google Chrome before 153.0.8010.36. An adjacent attacker could execute arbitrary code outside the sandbox via crafted network traffic.

Injection in the DevTools component in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Incorrect authorization in the SiteIsolation component in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass site isolation via a crafted file. (Severity: Medium)

Missing authorization in the Views component in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Severity: High)

Race condition in Chromoting in Google Chrome on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Severity: High)

Improper input validation in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Use after free in Input in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Missing authorization vulnerability in the Extensions component in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could potentially execute arbitrary code outside the sandbox via crafted network traffic.

Use after free vulnerability in the V8 component in Google Chrome prior to 153.0.8010.36. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.

Use after free vulnerability in the DevTools component in Google Chrome prior to 153.0.8010.36. A local attacker could execute arbitrary code outside the sandbox via a local program.

Uncontrolled search path element in CredentialProvider in Google Chrome on Windows prior to 153.0.8010.36. A local attacker could execute arbitrary code outside the sandbox via a local program. (Severity: Medium)

Use after free in Core in Google Chrome on Windows prior to 153.0.8010.36. A remote attacker who compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Use after free in Views in Google Chrome prior to 153.0.8010.36. A local attacker could execute arbitrary code outside the sandbox via a local program.

Improper input validation in FileAPI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Incorrect authorization in Updater in Google Chrome on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Severity: Low)

Privilege elevation in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Severity: Medium)