Threat database

An information leak vulnerability exists in the BackgroundFetch feature of Google Chrome versions prior to 157.0.8103.38. This flaw allows a remote attacker to obtain cross-origin data by tricking a user into visiting a crafted HTML page. The issue has been fixed in version 157.0.8103.38.

An improper input validation vulnerability in the Prerender component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker who has compromised the renderer process to bypass the web origin policy via a crafted HTML page. This vulnerability has been assigned a medium severity by Chromium security. A fix is available in Chrome version 157.0.8103.38.

Missing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

An improper state validation vulnerability in the FileSystem component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass system access restrictions via a crafted HTML page leveraging social engineering. The issue has been fixed in Chrome version 157.0.8103.38. The vulnerability is rated with medium severity by Chromium security.

Information leak in Network in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

An improper input validation vulnerability in the WebPackaging component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to bypass the web origin policy via crafted network traffic. This issue was assigned a medium severity by Chromium security. The vulnerability has been fixed in Chrome version 157.0.8103.38.

A UI misrepresentation vulnerability in the FileAPI component of Google Chrome prior to version 157.0.8103.38 allows a remote attacker to spoof UI elements via a crafted HTML page, potentially tricking users through social engineering. This issue has been fixed in Chrome version 157.0.8103.38.

A use-after-free vulnerability exists in the Controls component of Google Chrome prior to version 157.0.8103.38. This flaw allows a remote attacker to execute arbitrary code within the sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has been assigned a high severity rating and is fixed in Chrome version 157.0.8103.38.

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebXR in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Type confusion in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability exists in the PowerBookmarks component of Google Chrome prior to version 157.0.8103.38. This flaw allows a remote attacker who has compromised the renderer process and uses social engineering to execute arbitrary code outside the sandbox via a crafted Chrome extension. The vulnerability has been fixed in version 157.0.8103.38.

A use-after-free vulnerability exists in the WebRTC component of Google Chrome prior to version 157.0.8103.38. This flaw allows a remote attacker to execute arbitrary code within the browser sandbox by tricking a user into visiting a crafted HTML page. The vulnerability has been assigned a high severity rating and has been fixed in Chrome version 157.0.8103.38.

Out of bounds read in Media in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Views in Google Chrome on on Windows prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in FileSystem in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in CSS in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

An out of bounds read vulnerability exists in the Skia component of Google Chrome prior to version 157.0.8103.38. This flaw allows a remote attacker to read memory outside the sandbox by delivering a crafted HTML page. The issue has been assigned a high severity rating by Chromium security. A fix is available in Chrome version 157.0.8103.38.

Type confusion in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)