Priority LOW 24
UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page.
CVSS 3.1MEDIUM 5.4· Network · No auth · User interaction · EPSS 0.0025 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-451
Priority LOW 29
Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page.
CVSS 3.1MEDIUM 6.5· Network · No auth · User interaction · EPSS 0.00312 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-200
Priority LOW 15
Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted PDF file.
CVSS 3.1LOW 3.1· Network · No auth · User interaction · EPSS 0.00216 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-862
Priority LOW 27
Out of bounds read in DataTransfer in Google Chrome prior to 153.0.8010.52 allowed a local attacker leveraging social engineering to read memory outside the sandbox via a local program.
CVSS 3.1MEDIUM 6.3· Local · No auth · User interaction · EPSS 0.00112 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-125
Priority LOW 20
Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00254 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-200
Priority LOW 17
Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00245 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-918
Priority LOW 15
Race condition in FileSystem in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to bypass system access restrictions via a crafted…
CVSS 3.1LOW 3.1· Network · No auth · User interaction · EPSS 0.002 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-367
Priority MEDIUM 40
Type confusion in V8 in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00436 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-843
Priority LOW 20
Incorrect authorization in ORB in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to bypass site isolation via a crafted HTML page.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00252 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-863
Priority MEDIUM 40
Buffer overflow in PDFium in Google Chrome on on Windows prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted PDF file.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00386 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-122
Priority MEDIUM 43
Use after free in Extensions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted Chrome extension.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00331 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-416
Priority LOW 20
Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00254 · Published 2026-09-17 · Partial fix · 153.0.8010.52 CWE-754
Priority MEDIUM 40
Use after free in PDFium in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00373 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-416
Priority LOW 36
Incorrect reference resolution in Tracing in Google Chrome on on Windows prior to 153.0.8010.52 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program.
CVSS 3.1HIGH 8.1· Local · No auth · No interaction · EPSS 0.00101 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-706
Priority MEDIUM 43
Buffer overflow in WebGL in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.0043 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-121
Priority MEDIUM 43
Use after free in Dawn in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00422 · Published 2026-09-17 · Fixed in 153.0.8010.52 CWE-416