Misconfiguration and Insecure Design

Every one of the 373 is a mark on the map. Named now: 1 to 26, most at risk first.

1. In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of privilege with no additional…CVE-2026-58704Google · CVSS 8.8 · 0.6% likelycovered by CyberSIXT

   CWE-6938 articles

2. Inappropriate implementation in DevTools in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to potentially perform a sandbox escape via a crafted Chrome Extension.CVE-2021-21132Google · 25% likely

   CWE-1021

3. Inappropriate implementation in iframe sandbox in Google Chrome prior to 88.0.4324.96 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.CVE-2021-21139Google · 5.1% likely

   CWE-1021

4. Google Chrome before 42.0.2311.90 does not properly consider the interaction of page navigation with the handling of touch events and gesture events, which allows remote attackers…CVE-2015-1241Google · 2.2% likely

   CWE-1021

5. Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, failed to prevent alerts from being displayed by swapped out frames, which allowed a remote attacker to show alerts…CVE-2017-5026Google · 1.4% likely

   CWE-1021

6. Insufficient protection of permission UI in WebAPKs in Google Chrome on Android prior to 72.0.3626.81 allowed an attacker who convinced the user to install a malicious application…CVE-2019-5767Google · 1.3% likely

   CWE-1021

7. Blink in Google Chrome prior to 56.0.2924.76 for Linux, Windows and Mac, and 56.0.2924.87 for Android, failed to prevent certain UI elements from being displayed by non-visible pa…CVE-2017-5016Google · 1.3% likely

   CWE-1021

8. Incorrect security UI in Web Browser UI in Google Chrome prior to 94.0.4606.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.CVE-2021-37971Google · 1.3% likely

   CWE-1021

9. In multiple settings screens, there are possible tapjacking attacks due to an insecure default value. This could lead to local escalation of privilege and permissions with no addi…CVE-2020-0416Google · 1.3% likely

   CWE-1188

10. Insufficient policy enforcement in Content Security Policy in Google Chrome prior to 105.0.5195.52 allowed a remote attacker to bypass content security policy via a crafted HTML p…CVE-2022-3056Google · CVSS 6.5 · 1.1% likely

    CWE-693

11. Incorrect security UI in media in Google Chrome prior to 84.0.4147.125 allowed a remote attacker to potentially obtain sensitive information via a crafted HTML page.CVE-2020-6547Google · 1.1% likely

    CWE-1021

12. Incorrect security UI in Autofill in Google Chrome prior to 97.0.4692.71 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.CVE-2022-0110Google · 1.1% likely

    CWE-1021

13. Insufficient policy enforcement in WebUI in Google Chrome prior to 87.0.4280.141 allowed an attacker who convinced a user to install a malicious extension to potentially perform a…CVE-2021-21111Google · 1.1% likely

    CWE-1021

14. Inappropriate implementation in Site Isolation in Google Chrome prior to 105.0.5195.52 allowed a remote attacker who had compromised the renderer process to bypass site isolation…CVE-2022-3044Google · CVSS 6.5 · 1.1% likely

    CWE-693

15. It is possible for a malicious application to construct a TYPE_TOAST window manually and make that window clickable. This could lead to a local escalation of privilege with no add…CVE-2020-0014Google · 0.9% likely

    CWE-1021

16. The Framework UI permission-dialog implementation in Android 6.x before 2016-06-01 allows attackers to conduct tapjacking attacks and access arbitrary private-storage files by cre…CVE-2016-2496Google · 0.9% likely

    CWE-1021

17. Inappropriate implementation in Web Cursor in Google Chrome prior to 100.0.4896.60 allowed a remote attacker who had compromised the renderer process to obscure the contents of th…CVE-2022-1138Google · 0.9% likely

    CWE-1021

18. Eliding from the wrong side in an infobar in DevTools in Google Chrome prior to 68.0.3440.75 allowed an attacker who convinced a user to install a malicious extension to Hide Chro…CVE-2018-6178Google · 0.9% likely

    CWE-1021

19. Inappropriate implementation in WebUSB in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof security UI via a crafted HTML page.CVE-2020-16033Google · 0.8% likely

    CWE-1021

20. Inappropriate implementation in Site Isolation in Google Chrome prior to 122.0.6261.57 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromi…CVE-2024-1671Google · CVSS 6.5 · 0.8% likely

    CWE-693

21. In onCreate of SetupLayoutActivity.java, there is a possible way to setup a work profile bypassing user consent due to a tapjacking/overlay attack. This could lead to local escala…CVE-2021-39692Google · 0.7% likely

    CWE-1021

22. In PackageInstaller, there is a possible tapjacking attack due to an insecure default value. This could lead to local escalation of privilege and permissions with no additional ex…CVE-2021-0302Google · 0.7% likely

    CWE-1021

23. Insufficient data validation in UI in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.CVE-2020-16031Google · 0.7% likely

    CWE-1021

24. Insufficient data validation in sharing in Google Chrome prior to 87.0.4280.66 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.CVE-2020-16032Google · 0.7% likely

    CWE-1021

25. In onCreate() of ChooseTypeAndAccountActivity.java, there is a possible way to learn the existence of an account, without permissions, due to a tapjacking/overlay attack. This cou…CVE-2021-0391Google · 0.7% likely

    CWE-1021

26. Inappropriate implementation in Full Screen Mode in Google Chrome on Android prior to 98.0.4758.80 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a c…CVE-2022-0455Google · 0.7% likely

    CWE-1021

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.