Threat database

UI misrepresentation in Shopping in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in the Paint component of Google Chrome versions prior to 157.0.8103.38. A remote attacker can exploit this flaw by crafting a malicious HTML page to obtain sensitive information. The issue has been fixed in version 157.0.8103.38.

A UI misrepresentation vulnerability in Google Chrome prior to version 157.0.8103.38 allows remote attackers to spoof UI elements via crafted HTML pages, potentially misleading users through social engineering. This issue has been fixed in version 157.0.8103.38.

A use-after-free vulnerability exists in the Scheduling component of Google Chrome prior to version 157.0.8103.38. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The issue has been fixed in version 157.0.8103.38. The vulnerability is rated with a high severity score of 8.8.

An uninitialized resource vulnerability in the Media component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to read memory inside the sandbox via a crafted HTML page. This issue has been fixed in Chrome version 157.0.8103.38. The vulnerability is rated with medium severity by Chromium security.

A UI misrepresentation vulnerability in Google Chrome on iOS versions prior to 157.0.8103.38 allows a remote attacker to spoof UI elements in the Passwords interface via a crafted HTML page, potentially tricking users through social engineering. This issue has been fixed in version 157.0.8103.38.

An observable discrepancy vulnerability in the Media component of Google Chrome prior to version 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. This issue was assigned a medium severity by Chromium security. A fix is available in Chrome version 157.0.8103.38.

An incorrect authorization vulnerability in the Views component of Google Chrome on Mac prior to version 157.0.8103.38 allows a remote attacker to bypass system access restrictions via a crafted HTML page leveraging social engineering. The issue has been fixed in version 157.0.8103.38.

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A use-after-free vulnerability exists in the TabStrip component of Google Chrome versions prior to 157.0.8103.38. This flaw could allow a remote attacker to execute arbitrary code outside the sandbox via a specially crafted Chrome extension. The issue has been fixed in version 157.0.8103.38.

Use after free in WTF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Race condition in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Autofill in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in the SiteIsolation feature of Google Chrome prior to version 157.0.8103.38 allows a remote attacker who has compromised the renderer process to access sensitive information via a crafted PDF file. This issue has been fixed in version 157.0.8103.38.

An incorrect authorization vulnerability in the core of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass the web origin policy via a crafted HTML page. This issue has been fixed in version 157.0.8103.38. The vulnerability is rated with medium severity by Chromium security.

A UI misrepresentation vulnerability in the Bluetooth component of Google Chrome prior to version 157.0.8103.38 allowed remote attackers to spoof UI elements via crafted HTML pages. This issue was addressed in Chrome version 157.0.8103.38. The vulnerability is rated with medium severity by the Chromium security team.

Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Incomplete cleanup in V8 in Google Chrome prior to 157.0.8103.38 allowed a local attacker to read memory via a local program. (Chromium security severity: Medium)

UI misrepresentation in PermissionElement in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in the V8 engine of Google Chrome versions prior to 157.0.8103.38. This flaw allows a remote attacker to obtain cross-origin data by tricking a user into visiting a crafted HTML page. The vulnerability has been assigned a medium severity by Chromium security. A fix is available in Chrome version 157.0.8103.38.