Search: 36.9-2

An information leak vulnerability exists in Google Chrome on iOS versions prior to 153.0.8010.36. This flaw allows a remote attacker to leverage social engineering techniques to cause sensitive information to be leaked via a crafted HTML page. The issue is classified with low severity by Chromium security. No CVSS score or exploit in the wild is currently known.

Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: High)

An improper input validation vulnerability exists in Chromium used by Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to spoof user interface elements by sending crafted network traffic. The vulnerability is classified with low severity by Chromium security. No CVSS score or known exploits in the wild have been reported. No explicit patch information is provided in the source data.

Incorrect authorization in Web Authentication in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted Chrome extension. (Chromium security severity: Low)

A type confusion vulnerability in the V8 JavaScript engine of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker to read memory inside the sandbox by delivering a crafted HTML page. This vulnerability is rated high severity by the Chromium security team. No CVSS score or patch information is currently available.

Incorrect authorization in Isolated in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to spoof UI elements via a crafted HTML page. (Chromium security severity: Medium)

Observable discrepancy in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds read in Chromoting in Google Chrome on on Windows prior to 153.0.8010.36 allowed a local attacker to read memory outside the sandbox via a local program. (Chromium security severity: High)

Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

An information leak vulnerability exists in the Cross-Origin Resource Sharing (CORS) implementation in Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has already compromised the renderer process to obtain cross-origin data by using a crafted HTML page. The vulnerability is rated with medium severity by Chromium security. No specific affected versions or patch information is provided in the input data.

Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

A confused deputy vulnerability exists in the fullscreen feature of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker who has compromised the renderer process to use social engineering to spoof UI elements via a crafted HTML page. The Chromium project has assigned this issue a low security severity rating.

Incorrect authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file. (Chromium security severity: Medium)

Incorrect authorization in Safebrowsing in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

A vulnerability in Google Chrome on iOS versions prior to 153.0.8010.36 allowed cleartext transmission of sensitive data via the HttpsUpgrades feature. This flaw could enable a remote attacker to leak sensitive information through crafted network traffic. The issue has a medium severity rating and a CVSS score of 5.9.

Incorrect authorization in Network in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

A missing authorization vulnerability in the WebUI of Google Chrome versions prior to 153.0.8010.36 allows a remote attacker who has already compromised the renderer process to bypass the web origin policy using a crafted HTML page. This vulnerability is classified with high severity by Chromium security. There is no CVSS score or patch information provided in the available data. No known exploits are reported in the wild.

A use-after-free vulnerability exists in the WebGL component of Google Chrome versions prior to 153.0.8010.36. This flaw allows a remote attacker to execute arbitrary code outside the browser sandbox by convincing a user to visit a crafted HTML page. The vulnerability is rated critical with a high CVSS score of 9.6.

An incomplete cleanup vulnerability in Google Chrome extensions prior to version 153.0.8010.36 allows a remote attacker to bypass system access restrictions via a crafted extension leveraging social engineering. The issue has a medium severity rating and does not impact confidentiality or availability but can impact integrity.

A missing authorization vulnerability in the ServiceWorker component of Google Chrome prior to version 153.0.8010.36 allows a remote attacker who has compromised the renderer process to bypass system access restrictions via a crafted HTML page. The vulnerability has a medium severity rating with a CVSS score of 6.5. Google has released an update to fix this issue in Chrome version 153.0.8010.36.