Threat database

An observable discrepancy vulnerability in the Paint component of Google Chrome prior to version 157.0.8103.38 could allow a remote attacker to obtain sensitive information via a crafted HTML page. This issue has been fixed in version 157.0.8103.38. The vulnerability is rated with medium severity by Chromium security.

An information leak vulnerability exists in the Core component of Google Chrome prior to version 157.0.8103.38. This flaw allows a remote attacker to obtain cross-origin data by using a crafted HTML page. The vulnerability has been assigned a medium severity by Chromium security. A fix is available in Chrome version 157.0.8103.38.

A missing authorization vulnerability in the WebView component of Google Chrome on Android versions prior to 157.0.8103.38 allows a remote attacker who has compromised the renderer process to access sensitive information via a crafted HTML page. This issue has been fixed in version 157.0.8103.38.

A confused deputy vulnerability in the DevTools component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass the web origin policy by tricking a user into visiting a crafted HTML page. This issue was assigned a medium severity by Chromium security and has been fixed in version 157.0.8103.38.

Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

An information leak vulnerability exists in the Select component of Google Chrome versions prior to 157.0.8103.38. This flaw allows a remote attacker to obtain sensitive information by crafting a malicious HTML page. The issue has been fixed in version 157.0.8103.38.

Uninitialized resource in GPU in Google Chrome on on Android prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Missing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

An improper input validation vulnerability in Google Chrome prior to version 157.0.8103.38 allows a remote attacker who has compromised the renderer process to execute arbitrary code outside the sandbox via crafted network traffic. The issue has been fixed in version 157.0.8103.38.

Information leak in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

A vulnerability in Google Chrome's WebCodecs component prior to version 157.0.8103.38 allows a remote attacker to bypass the web origin policy by using a crafted HTML page. This issue is classified with medium severity by Chromium security.

An incorrect authorization vulnerability in Google Chrome Core prior to version 157.0.8103.38 allows a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. The issue has been fixed in version 157.0.8103.38.

Missing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in Core in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

A missing authorization vulnerability in the DevTools component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass system access restrictions by leveraging social engineering and crafted network traffic. This issue has been fixed in version 157.0.8103.38.

Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension. (Chromium security severity: Medium)

Uninitialized resource in Skia in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in Extensions in Google Chrome prior to 157.0.8103.38 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

An incorrect authorization vulnerability in the DevTools component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass system access restrictions via a crafted HTML page. This issue has been fixed in version 157.0.8103.38.