CVE Vulnerability Advisory Database

[Affected Scope] Google Chrome versions prior to 153.0.8010.36 and Chromium-based browsers

[Impact] Remote attackers can execute arbitrary code within the browser sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to version 153.0.8010.36 or later

[Affected Scope] TrueConf Server versions 5.3.0 to 5.3.9, 5.4.0 to 5.4.9, 5.5.0 to 5.5.5, and earlier

[Impact] An unauthenticated remote attacker can bypass sandbox isolation and execute arbitrary code on the host system by sending a crafted script via TCP port 4307.

[Mitigation] Immediately upgrade TrueConf Server to the latest patched version and restrict network access to TCP port 4307 using firewalls.

[Affected Scope] Android Operating System and Chrome browser environments

[Impact] Local attackers can escape the Chrome sandbox and escalate privileges to system_server without any user interaction or additional execution privileges

[Mitigation] Immediately apply the Android Security Bulletin - September 2025 patch or later to all affected devices

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 138.0.7204.157

[Impact] A remote attacker can bypass the browser sandbox boundaries and potentially execute arbitrary code on the host system via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable channel version (138.0.7204.157 or higher)

[Affected Scope] Google Chrome on Windows prior to version 134.0.6998.177

[Impact] A remote attacker can exploit incorrect handle validation in the Mojo IPC framework via a malicious file to escape the browser sandbox and execute arbitrary code with elevated privileges

[Mitigation] Immediately update Google Chrome to the latest stable channel (134.0.6998.177 or higher) and enforce auto-updates via Group Policy (GPO)

[Affected Scope] Devices running iOS 15/16/17/18, iPadOS, macOS Sequoia, visionOS, watchOS, and Safari browser

[Impact] Processing maliciously crafted web content may allow an attacker to break out of the Web Content sandbox and execute arbitrary code, with active exploitation reported in targeted attacks

[Mitigation] Immediately apply the official security updates released by Apple, including iOS 18.3.2 and macOS 15.3.2

[Affected Scope] Virtual machines and environments running on VMware ESXi hypervisors where attackers hold privileges within the VMX process

[Impact] Escape of the hypervisor sandbox and potential host takeover via arbitrary kernel write from the guest OS

[Mitigation] Immediately apply the official security patches provided by Broadcom and restrict administrative access to the VMX process

[Affected Scope] VMware ESXi and Workstation products

[Impact] A malicious actor with local administrative privileges on a guest VM can execute arbitrary code within the host's VMX process, leading to a virtual machine escape

[Mitigation] Apply the latest security patches provided by Broadcom and restrict administrative access within guest virtual machines

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 125.0.6422.60

[Impact] A remote attacker can execute arbitrary code within the browser sandbox by enticing a user to visit a specially crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (125.0.6422.60 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 124.0.6367.201

[Impact] A remote attacker who has compromised the renderer process can exploit this vulnerability via a crafted HTML page to escape the browser sandbox and execute arbitrary code

[Mitigation] Immediately update Google Chrome to the latest stable version (124.0.6367.201 or higher) and enforce auto-update policies across the enterprise

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 119.0.6045.199

[Impact] A remote attacker who has compromised the renderer process can exploit this vulnerability via a malicious file to escape the browser sandbox and execute arbitrary code

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable channel (119.0.6045.199 or higher)

[Affected Scope] iOS/iPadOS 15 and 16, macOS Ventura, watchOS, tvOS, and Safari versions prior to 16.5

[Impact] A remote attacker can bypass the Web Content sandbox and potentially execute arbitrary code on the host system due to a bounds check validation flaw, which is actively exploited in the wild

[Mitigation] Immediately apply the official security updates provided by Apple (iOS 16.5, macOS 13.4, Safari 16.5, etc.)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 112.0.5615.137

[Impact] A remote attacker who has compromised the renderer process can potentially perform a sandbox escape and execute arbitrary code via a crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (112.0.5615.137 or higher)

[Affected Scope] Firefox < 97.0.2, Firefox ESR < 91.6.1, Firefox for Android < 97.3.0, Thunderbird < 91.6.2, and Focus < 97.3.0

[Impact] Attackers can trigger a Use-After-Free (UAF) condition via crafted web content, leading to arbitrary code execution and a complete sandbox escape on the host OS

[Mitigation] Immediately update all affected Mozilla products to their respective patched versions (Firefox 97.0.2+, Firefox ESR 91.6.1+, Thunderbird 91.6.2+, etc.)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 107.0.5304.121

[Impact] A remote attacker who has compromised the renderer process can bypass the browser sandbox and potentially execute arbitrary code via a crafted HTML page

[Mitigation] Immediately update Google Chrome and Chromium-based browsers to the latest stable version (107.0.5304.121 or higher)

[Affected Scope] Google Chrome and Chromium-based browsers prior to version 105.0.5195.102

[Impact] A remote attacker who has compromised the renderer process can bypass the browser sandbox and potentially execute arbitrary code on the host system via crafted Mojo IPC messages

[Mitigation] Immediately update Google Chrome and all Chromium-based browsers to version 105.0.5195.102 or later

[Affected Scope] Google Chrome prior to version 94.0.4606.61 on desktop platforms

[Impact] A remote attacker who has compromised the renderer process can potentially bypass the Chrome sandbox and execute arbitrary code on the host system via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (94.0.4606.61 or higher) and enforce automatic updates across enterprise endpoints

[Affected Scope] Google Chrome prior to version 93.0.4577.82

[Impact] A remote attacker who has compromised the renderer process can potentially execute arbitrary code and escape the browser sandbox via a crafted HTML page

[Mitigation] Immediately update Google Chrome to the latest stable version (93.0.4577.82 or higher)

[Affected Scope] Apple iOS before 14.8, iOS before 12.5.5, macOS Big Sur before 11.6, macOS Catalina (prior to Security Update 2021-005), and watchOS before 7.6.2

[Impact] A sandboxed process or local attacker can bypass sandbox restrictions, escalate privileges, and gain unauthorized access to sensitive system resources

[Mitigation] Immediately apply the official security updates provided by Apple (iOS 14.8, macOS 11.6, etc.)

[Affected Scope] Apple iOS before 14.4, iPadOS before 14.4, macOS Big Sur before 11.2, and macOS Catalina/Mojave prior to Security Update 2021-001.

[Impact] A remote attacker can execute arbitrary code on the target device via malicious web content, bypassing sandbox restrictions. This vulnerability has been actively exploited in the wild.

[Mitigation] Immediately apply the official software updates provided by Apple to upgrade to iOS/iPadOS 14.4, macOS Big Sur 11.2, or later.