CVE Vulnerability Catalog

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

Memory corruption in V8 in Google Chrome prior to 153.0.8010.36. A remote attacker could potentially execute arbitrary code inside the sandbox via a crafted Chrome extension.

Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36. A remote attacker who had compromised the renderer process and leveraged social engineering could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Incorrect authorization in WebView in Google Chrome on Android prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Use after free in Printing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Insufficient policy enforcement in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)

Incorrect authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Severity: Medium)

Race condition in Updater in Google Chrome on Windows prior to 153.0.8010.36 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Severity: High)

Use after free in Platform in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Race condition in Updater in Google Chrome on Windows prior to 153.0.8010.36 allowed a local attacker to execute arbitrary code outside the sandbox via a local program. (Severity: Medium)

Incorrect authorization in Permissions in Google Chrome prior to 153.0.8010.36. A remote attacker leveraging social engineering could obtain sensitive information via a crafted Chrome extension.

Memory corruption in the Codecs component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Out of bounds read in the Media component of Google Chrome prior to 153.0.8010.36 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Severity: High)

Race condition in FileAPI in Google Chrome prior to 153.0.8010.36. A remote attacker who compromised the renderer process could bypass site isolation via a crafted HTML page.

Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36. A remote attacker could obtain sensitive information via a crafted Chrome extension.

Buffer overflow in WebRTC in Google Chrome prior to 153.0.8010.36. A remote attacker could potentially execute arbitrary code inside the sandbox via a crafted HTML page.

The cjose C library implementing JOSE has a vulnerability in the JWE decryption path for AES Key Wrap algorithms (A128KW, A192KW, A256KW) due to lack of validation of the attacker-supplied encrypted_key length before unwrapping into a fixed-size heap buffer. A remote unauthenticated attacker can trigger an out-of-bounds heap write, leading at least to a crash (DoS) and potentially to further memory corruption. The entry points cjose_jwe_import() and cjose_jwe_decrypt() are pre-authentication and process fully attacker-controlled input.

In Google go-attestation up to version 0.6.1, there is an uncontrolled recursion vulnerability in the Windows SIPA event log parser, allowing an attacker to cause a denial of service (DoS) by submitting a crafted event log with deeply nested elamAggregation headers. This leads to stack overflow and immediate crash of the application.

Maravel prior to version 10.74.0 contains a high-severity Token Replay Vulnerability arising from a structural lifecycle mismatch between stateless token validation engines and high-performance relational caching layers. In environments with low cache memory or active Atomic Lazy Eviction model, token blacklist entries (jti) are truncated from 14 days to a maximum of 2 hours, and any tag flush instantly invalidates the entire index, silently resurrecting stolen or logged-out tokens.