23 reportsPriority High
Multiple Chrome and Adobe vulnerabilities disclosed
Several critical vulnerabilities have been disclosed in Google Chrome and Adobe products, posing potential risks to UK organisations if not addressed promptly.
First report Latest
What is going on
- Multiple vulnerabilities were disclosed in Google Chrome, including issues related to memory management, unauthorised access, and UI misrepresentation.
- Adobe Commerce was found to be affected by a vulnerability that could allow arbitrary code execution if exploited.
- The vulnerabilities in Google Chrome could enable remote attackers to execute code inside or outside the sandbox, potentially leading to system compromises.
- Security researchers have identified multiple flaws in different components of Google Chrome, highlighting the need for immediate patching.
- Organisations using affected versions of Google Chrome and Adobe products are advised to apply available patches to mitigate potential risks.
- CISA has confirmed active exploitation of two PHP2Shell flaws, indicating an urgent need for action to prevent remote code execution attacks.
- What to watch: Monitoring for further details on the exploitation of these vulnerabilities and the release of additional patches or mitigations.
Reports in this story
Newest first. Each one is a separate event with its own sources and evidence.
- Priority MediumType Vulnerability
UI misrepresentation in Payments in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page
- Priority LowType Vulnerability
Incorrect reference resolution in Browser in Google Chrome on on Mac prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information…
- Priority LowType Vulnerability
Use after free in Select in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to execute arbitrary code inside the sandbox via a crafted…
- Priority LowType Vulnerability
Uninitialized resource in ANGLE in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to read memory outside the sandbox via a crafted HTML page
- Priority LowType Vulnerability
Missing authorization in Web Authentication (Passkeys & Security Keys) in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to spoof UI elements via a crafted HTML pa…
- Priority LowType Vulnerability
Use after free in WebRTC in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
- Priority LowType Vulnerability
Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted…
- Priority LowType Vulnerability
Input Validation Flaw in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a craf…
- Priority LowType Vulnerability
Uninitialized resource in Video in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to read memory outside the sandbox via a…
- Priority MediumType Vulnerability
Adobe Commerce is affected by an Improper Neutralization of Special Elements Used in a Template Engine vulnerability that could result in arbitrary code execution in the context o…
- Priority LowType Vulnerability
Use after free in Chromoting in Google Chrome on on Windows prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traf…
- Priority LowType Vulnerability
Use after free in V8 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
- Priority LowType Vulnerability
Use after free in Platform in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page
- Priority LowType Vulnerability
Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page
- Priority LowType Vulnerability
Access Control Flaw in Workers in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page
- Priority LowType Vulnerability
Input Validation Flaw in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a cra…
- Priority LowType Vulnerability
UI misrepresentation in Input in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker to spoof UI elements via a crafted HTML page
- Priority LowType Vulnerability
Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic
- Priority LowType Vulnerability
Type confusion in Animation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code inside the sandbox via a crafted HTML page
- Priority LowType Vulnerability
Volt Typhoon Used Silent Train to Hide Zero-Day Attacks
- Priority LowType Incident
AI used in Aur0ra ransomware testing and execution
- Priority LowType Vulnerability
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- Priority LowType Vulnerability
CISA Confirms Active Exploitation of Two PHP2Shell Flaws Enabling Remote Code Execution