Description
Insufficient validation of untrusted input in ANGLE and GPU in Google Chrome prior to 138.0.7204.157 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected products
- Apple / iPadOS18.6
- Apple / iphone_os18.6
- Apple / macOS15.6
- Apple / Safari18.6
- Apple / visionOS2.6
- Apple / watchOS11.6
- Debian / debian_linux11.0 – 11.0
- Google / Chrome138.0.7204.157 – 138.0.7204.157
- Google / Chrome138.0.7204.157
- WebKitGTK / WebKitGTK2.48.0
- wpewebkit / wpe_webkit2.48.0
Updated 44m ago · 8 sources