CVE-2015-1218
HighSummary
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, used in Google Chrome before version 41.0.2272.76, may allow remote attackers to cause a denial of service or potentially other unspecified impacts via moving a SCRIPT element to different documents.
Risk Assessment
Attackers may exploit these vulnerabilities to disrupt web application functionality, potentially leading to service unavailability for users.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate these vulnerabilities and to monitor web applications for unusual behavior.
Other vulnerabilities in Google Chrome (Blink DOM implementation)
See all- CVE-2015-1223High
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, used in Google Chrome before version 41.0.2272.76, may allow remote attackers to cause a denial of service or possibly have unspecified other impact via change events triggered by invalid input or input to read-only fields.
- CVE-2015-1209High
A use-after-free vulnerability in the VisibleSelection::nonBoundaryShadowTreeRootNode function in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android, allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.
- CVE-2014-7934High
Use-after-free vulnerability in the DOM implementation in Blink, used in Google Chrome before version 40.0.2214.91, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to unexpected absence of document data structures.
Original NVD description (English source)
Multiple use-after-free vulnerabilities in the DOM implementation in Blink, as used in Google Chrome before 41.0.2272.76, allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger movement of a SCRIPT element to different documents, related to (1) the HTMLScriptElement::didMoveToNewDocument function in core/html/HTMLScriptElement.cpp and (2) the SVGScriptElement::didMoveToNewDocument function in core/svg/SVGScriptElement.cpp.