CVE-2015-3335
HighSummary
The NaClSandbox::InitializeLayerTwoSandbox function in Google Chrome before version 42.0.2311.90 lacks RLIMIT_AS and RLIMIT_DATA limits for Native Client processes, which may make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impacts by leveraging the ability to run a crafted program in the NaCl sandbox.
Risk Assessment
The lack of appropriate limits may allow remote attackers to carry out attacks that could lead to unauthorized access or system destabilization.
Recommendation
It is recommended to update Google Chrome to the latest version to mitigate the risks associated with this vulnerability.
Other vulnerabilities in Google Chrome
See all- CVE-2026-110172Unknown
A use-after-free exists in Media in Google Chrome prior to 155.0.8059.79. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-110171Unknown
A use-after-free exists in Media in Google Chrome prior to 155.0.8059.79. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page.
- CVE-2026-110170Unknown
A use-after-free exists in Bindings in Google Chrome prior to 155.0.8059.79. A remote attacker could read memory inside the sandbox via a crafted HTML page.
- CVE-2026-110169Unknown
Use-after-free in V8 in Google Chrome prior to 155.0.8059.79. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. Severity: High.
- CVE-2026-110168Unknown
Use-after-free in V8 in Google Chrome prior to 155.0.8059.79. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. Severity: High.
- CVE-2026-110167Unknown
Use-after-free in Media in Google Chrome prior to 155.0.8059.79. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. Severity: High.
- CVE-2026-110166Unknown
Buffer overflow in Animation in Google Chrome prior to 155.0.8059.79. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. Severity: High.
- CVE-2026-110165Unknown
Use-after-free in Core in Google Chrome on Android prior to 155.0.8059.79. A remote attacker could potentially execute arbitrary code outside the sandbox via a crafted HTML page. Severity: Critical.
- CVE-2026-110164Unknown
Use-after-free in DOM in Google Chrome prior to 155.0.8059.79. A remote attacker could potentially execute arbitrary code inside the sandbox via a crafted HTML page. Severity: High.
- CVE-2026-110163Unknown
Use-after-free in DOM in Google Chrome prior to 155.0.8059.79. A remote attacker could execute arbitrary code inside the sandbox via a crafted HTML page. Severity: High.
Original NVD description (English source)
The NaClSandbox::InitializeLayerTwoSandbox function in components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for Native Client (aka NaCl) processes, which might make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impact by leveraging the ability to run a crafted program in the NaCl sandbox.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS