CVE-2015-1228
HighSummary
The RenderCounter::updateCounter function in Blink, used in Google Chrome before version 41.0.2272.76, does not force a relayout operation, leading to uninitialized memory for a data structure. This allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted CSS token sequence.
Risk Assessment
This vulnerability may lead to application crashes, affecting service availability. There is also a risk that attackers could exploit this flaw to carry out other unspecified attacks.
Recommendation
It is recommended to update Google Chrome to version 41.0.2272.76 or later to mitigate this vulnerability. Additionally, monitoring and analyzing application logs may help detect attempts to exploit this flaw.
Other vulnerabilities in Google Chrome (Blink)
See all- CVE-2026-7974High
Use after free in Blink in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.
- CVE-2017-5087High
A use after free in Blink in Google Chrome prior to version 59.0.3071.104 for Mac, Windows, and Linux, and prior to version 59.0.3071.117 for Android, allows a remote attacker to perform an out of bounds memory read via a crafted HTML page, known as an IndexedDB sandbox escape.
- CVE-2017-5064High
Incorrect handling of DOM changes in Blink in Google Chrome prior to version 58.0.3029.81 for Windows allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- CVE-2017-5056High
A use after free vulnerability in Blink in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and prior to version 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.
- CVE-2017-5052High
A flaw in block structure in Blink in Google Chrome prior to version 57.0.2987.133 for Mac, Windows, and Linux, and prior to version 57.0.2987.132 for Android, allows a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting.
- CVE-2016-5145High
Blink in Google Chrome before version 52.0.2743.116 does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image. This allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.
- CVE-2016-1710High
The ChromeClientImpl::createWindow method in Blink, used in Google Chrome before version 52.0.2743.82, does not prevent window creation by a deferred frame, allowing remote attackers to bypass the Same Origin Policy via a crafted website.
- CVE-2016-1660High
Blink, as used in Google Chrome before version 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes. This allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site.
- CVE-2016-1634High
A use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in Blink, used in Google Chrome before version 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted website.
- CVE-2015-1227High
The DragImage::create function in Blink, used in Google Chrome before version 41.0.2272.76, does not initialize memory for image drawing. This may allow remote attackers to trigger an unspecified impact by causing a failed image decoding.
Original NVD description (English source)
The RenderCounter::updateCounter function in core/rendering/RenderCounter.cpp in Blink, as used in Google Chrome before 41.0.2272.76, does not force a relayout operation and consequently does not initialize memory for a data structure, which allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via a crafted Cascading Style Sheets (CSS) token sequence.