Lbherrera

A UI misrepresentation issue exists in the FileAPI. A remote attacker can use social engineering and a specially crafted HTML page to spoof UI elements.

An inappropriate implementation in the Autofill feature allows a remote attacker who has already compromised the renderer process to leak cross-origin data. This is achieved by using a specially crafted HTML page.

Insufficient policy enforcement in the IFrame Sandbox allows a remote attacker to bypass navigation restrictions by using a crafted HTML page.

Insufficient policy enforcement in Isolated Web Apps allows a remote attacker to bypass the content security policy (CSP), which is a security layer used to detect and mitigate certain types of attacks, such as cross-site scripting, by restricting the resources that a browser is allowed to load. This bypass can be achieved through the use of a crafted HTML page.

An issue in the Background Fetch API in Google Chrome allowed a remote attacker to leak cross-origin data through a specially crafted HTML page. The security severity is rated as High.

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A policy bypass issue existed in the Downloads component of Google Chrome. This allowed a remote attacker to circumvent multi-download protections through a specially crafted HTML page. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

A race condition in WebAppInstalls allows a remote attacker to spoof UI elements by using a crafted HTML page. A race condition occurs when the timing or sequence of events is unplanned, leading to unexpected behavior.

A flaw exists in Google Chrome due to insufficient policy enforcement in Frames. This allows a remote attacker to perform UI spoofing using a specially crafted HTML page. The Chromium security severity is rated as Medium.

The issue was addressed with improved checks. Processing web content may disclose sensitive information.

The issue is related to an inappropriate implementation in WebApp Installs, allowing a remote attacker to potentially spoof the contents of the Omnibox (URL bar) via a crafted HTML page. This could lead to the attacker gaining access to confidential information.

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 147.0.7727.55 Description A policy bypass issue existed in Google Chrome's audio component, prior to version 147.0.7727.55. A remote attacker could bypass sandbox download restrictions by convincing a user to perform specific UI gestures on a crafted HTML page. The Chromium security severity is rated as Low. Recommendations Update Google Chrome to version 147.0.7727.55 or later.

The issue is related to insufficient validation of untrusted input in the Downloads component, allowing an attacker to bypass Downloads restrictions. This can be achieved by convincing a user to install a malicious extension via a crafted HTML page. The attacker can exploit this issue to impact data integrity.

The issue is related to an inappropriate implementation in Blink, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This is due to a lack of proper source data validation, enabling an attacker to disclose protected information using a specially designed HTML page.

The issue is related to insufficient data validation in the loader, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This could potentially lead to the disclosure of protected information.

The issue is related to an inappropriate implementation in the cache component of Google Chrome, which can be exploited by a remote attacker to leak cross-origin data. This can be achieved via a crafted HTML page. The vulnerability is also associated with errors in the implementation of security checks for standard elements, potentially allowing a remote attacker to execute arbitrary code.

The issue concerns insufficient policy enforcement in the contacts picker component of Google Chrome on Android. This allows a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page, potentially bypassing security restrictions and gaining unauthorized access to protected information.

The issue is related to insufficient validation of untrusted input in Extensions, allowing an attacker to access local files via a crafted Chrome Extension if a user is convinced to install a malicious extension. This can lead to unauthorized access to local files. The estimated number of potentially affected devices worldwide is not specified.

The issue is related to insufficient data validation in navigation, allowing a remote attacker who has compromised the renderer process to bypass navigation restrictions. This can be achieved via a crafted HTML page.

The issue is related to insufficient policy enforcement in extensions, allowing an attacker to leak cross-origin data via a crafted Chrome Extension. This can be achieved by convincing a user to install a malicious extension. The vulnerability enables an attacker to bypass permission restrictions for extensions and impact the system.

The issue is related to insufficient policy enforcement in performance APIs, allowing a remote attacker to leak cross-origin data via a crafted HTML page. This can enable an unauthorized access to information.