Priority LOW 24
Inappropriate implementation in Navigations in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to bypass content security policy via a crafted HTML page.
CVSS 3.1MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0039 · Published 2024-10-15 · Fixed in 130.0.6723.58
Priority MEDIUM 41
Insufficient data validation in DevTools in Google Chrome on Windows prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML pa…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00488 · Published 2024-10-15 · Fixed in 130.0.6723.58
Priority LOW 20
Inappropriate implementation in Payments in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted Chrome Extension.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00305 · Published 2024-10-15 · Fixed in 130.0.6723.58
Priority LOW 20
Insufficient data validation in Downloads in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00318 · Published 2024-10-15 · Fixed in 130.0.6723.58
Priority LOW 20
Inappropriate implementation in Permissions in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00339 · Published 2024-10-15 · Fixed in 130.0.6723.58
Priority MEDIUM 40
Use after free in ParcelTracking in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML p…
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00465 · Published 2024-10-15 · Fixed in 130.0.6723.58 CWE-416
Priority MEDIUM 40
Use after free in Dawn in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00469 · Published 2024-10-15 · Fixed in 130.0.6723.58 CWE-416
Priority MEDIUM 40
Use after free in DevTools in Google Chrome prior to 130.0.6723.58 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted Chrome Extension.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00402 · Published 2024-10-15 · Fixed in 130.0.6723.58 CWE-416
Priority LOW 20
Inappropriate implementation in PictureInPicture in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to perform UI spoofing via a crafted HTML page.
CVSS 3.1MEDIUM 4.3· Network · No auth · User interaction · EPSS 0.00339 · Published 2024-10-15 · Fixed in 130.0.6723.58
Priority MEDIUM 40
Use after free in UI in Google Chrome on iOS prior to 130.0.6723.58 allowed a remote attacker who convinced a user to engage in specific UI gestures to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00465 · Published 2024-10-15 · Fixed in 130.0.6723.58 CWE-416
Priority LOW 36
Inappropriate implementation in WebAuthentication in Google Chrome on Android prior to 130.0.6723.58 allowed a local attacker to perform privilege escalation via a crafted HTML page.
CVSS 3.1HIGH 7.8· Local · No auth · User interaction · EPSS 0.00365 · Published 2024-10-15 · Fixed in 130.0.6723.58
Priority MEDIUM 42
Use after free in WebAuthentication in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.00966 · Published 2024-10-15 · Fixed in 130.0.6723.58 CWE-416
Priority MEDIUM 48
Use after free in AI in Google Chrome prior to 130.0.6723.58 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
CVSS 3.1HIGH 8.8· Network · No auth · User interaction · EPSS 0.0529 · Published 2024-10-15 · Fixed in 130.0.6723.58 CWE-416