CVE-2014-7930
HighSummary
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.
Risk Assessment
Organizations may be exposed to attacks that lead to denial of service, potentially affecting the availability of web applications and the security of user data.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability and reduce the risk of attacks.
Other vulnerabilities in Blink (DOM implementation in Google Chrome)
See all- CVE-2015-1293High
The DOM implementation in Blink, used in Google Chrome before version 45.0.2454.85, allows remote attackers to bypass the Same Origin Policy via unspecified vectors.
- CVE-2015-1253High
In the DOM implementation in Blink, used in Google Chrome before version 43.0.2357.65, there is a vulnerability that allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code that appends a child to a SCRIPT element.
- CVE-2014-3169High
A use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 37.0.2062.94, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging script execution that occurs before notification of node removal.
- CVE-2014-1731High
The DOM implementation in Blink, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux, has an issue with improper renderer state checking upon a focus event. This can lead to denial of service or other unspecified impacts via vectors leveraging 'type confusion' for SELECT elements.
Original NVD description (English source)
Use-after-free vulnerability in core/events/TreeScopeEventContext.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper maintenance of TreeScope data.