Insufficient policy enforcement in DevTools in Google Chrome prior to 148.0.7778.96 allowed an attacker who convinced a user to install a malicious extension to leak cross-origin data via a crafted Chrome Extension. (Chromium security severity: Low)

Insufficient policy enforcement in WebUI in Google Chrome on Linux, Mac, Windows, ChromeOS prior to 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

Policy bypass in IFrameSandbox in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Low)

Policy bypass in ServiceWorkers in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)

Policy bypass in Audio in Google Chrome prior to 147.0.7727.55 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass sandbox download restrictions via a crafted HTML page. (Chromium security severity: Low)

Policy bypass in Downloads in Google Chrome prior to 147.0.7727.55 allowed a remote attacker to bypass of multi-download protections via a crafted HTML page. (Chromium security severity: Low)

BitLocker Security Feature Bypass Vulnerability

Insufficient policy enforcement in WebUSB in Google Chrome prior to 146.0.7680.178 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: High)

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows Package Library Manager Information Disclosure Vulnerability

BitLocker Security Feature Bypass Vulnerability

Windows Mark of the Web Security Feature Bypass Vulnerability

Windows SmartScreen Security Feature Bypass Vulnerability

Azure CycleCloud Elevation of Privilege Vulnerability

Windows LockDown Policy (WLDP) Security Feature Bypass Vulnerability

Microsoft Publisher Security Feature Bypass Vulnerability

Microsoft Bing Search Spoofing Vulnerability

Visual Studio Remote Code Execution Vulnerability

SmartScreen Prompt Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

A problem with a protection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices allows a local user to execute privileged cytool commands that disable or uninstall the agent.

Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability

An authenticated attacker can exploit an Server-Side Request Forgery (SSRF) vulnerability in Microsoft Azure Health Bot to elevate privileges over a network.

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Microsoft Office Remote Code Execution Vulnerability

BitLocker Security Feature Bypass Vulnerability

Microsoft Edge (Chromium-based) Information Disclosure Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Internet Shortcut Files Security Feature Bypass Vulnerability

Windows NTLM Spoofing Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Microsoft Excel Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Secure Boot Security Feature Bypass Vulnerability

Protection mechanism failure in Windows Mark of the Web (MOTW) allows an unauthorized attacker to bypass a security feature locally.