CVE-2015-1209
HighSummary
A use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
Risk Assessment
An attacker may exploit this vulnerability to disrupt application functionality, leading to denial of service. There is also a risk that it could lead to other unspecified impacts.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate this vulnerability. Regular software updates are crucial for maintaining system security.
Other vulnerabilities in Google Chrome (Blink DOM implementation)
See all- CVE-2015-1223High
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, used in Google Chrome before version 41.0.2272.76, may allow remote attackers to cause a denial of service or possibly have unspecified other impact via change events triggered by invalid input or input to read-only fields.
- CVE-2015-1218High
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, used in Google Chrome before version 41.0.2272.76, may allow remote attackers to cause a denial of service or potentially other unspecified impacts via moving a SCRIPT element to different documents.
- CVE-2014-7934High
Use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to unexpected absence of document data structures.
Original NVD description (English source)
Use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in core/editing/VisibleSelection.cpp in the DOM implementation in Blink, as used in Google Chrome before 40.0.2214.111 on Windows, OS X, and Linux and before 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that triggers improper handling of a shadow-root anchor.