CVE-2014-3169
HighSummary
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging script execution that occurs before notification of node removal.
Risk Assessment
Organizations may be exposed to attacks that lead to denial of service or other unforeseen effects, potentially impacting the availability of web applications.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and to monitor systems for unauthorized activities.
Other vulnerabilities in Blink DOM implementation in Google Chrome
See all- CVE-2015-1293High
The DOM implementation in Blink, used in Google Chrome before version 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
- CVE-2015-1253High
In the DOM implementation in Blink, used in Google Chrome before version 43.0.2357.65, there is a vulnerability that allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element.
- CVE-2014-7930High
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.
- CVE-2014-1731High
The DOM implementation in Blink, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, has an issue with improper renderer state checking upon a focus event. This can lead to denial of service or other unspecified impacts via vectors leveraging 'type confusion' for SELECT elements.
Original NVD description (English source)
Use-after-free vulnerability in core/dom/ContainerNode.cpp in the DOM implementation in Blink, as used in Google Chrome before 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging script execution that occurs before notification of node removal.