CVE-2021-22565Medium· 6.5▾ SunlitInsufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 9.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.4%
Users or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID.
v1.1.2+
There are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can only be expired by providing their 64-bit UUID, and verification codes are already valid for a very short period of time (thus the UUID rotates frequently).
Contact [email protected]
github.com/google/exposure-notifications-verification-server < 1.1.2Upgrade to a patched release:
github.com/google/exposure-notifications-verification-server 1.1.2Connected by shared product, vendor, weakness, or advisory.
CVE-2021-22538High· 8.8Privilege escalation in rbac
CVE-2026-93387Medium· 4.3Improper state validation in Skia in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain cross-origin data via a crafted HTML page
CVE-2026-93386Medium· 5.4UI misrepresentation in WebAppInstalls in Google Chrome prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to spoof UI elements via a crafted HTML page
CVE-2026-93385Medium· 6.5Information leak in Paint in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to obtain sensitive information via a crafted HTML page
CVE-2026-93384Low· 3.7Server-side request forgery in Omnibox in Google Chrome on on Android prior to 153.0.8010.52 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic
CVE-2026-93383Medium· 4.3Information leak in Permissions in Google Chrome prior to 153.0.8010.52 allowed a remote attacker to leak cross-origin data via a crafted HTML page