CVE-2023-4078

A use after free vulnerability in Extensions in Google Chrome on Mac prior to version 148.0.7778.168 allows an attacker to execute arbitrary code via a malicious extension if a user installs it.

A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 49.0.2623.108 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code.

Use after free in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed a remote attacker who compromised the renderer process to bypass site isolation via a crafted HTML page.

Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker who convinced a user to install a malicious extension to bypass same origin policy via a crafted Chrome Extension.

A use after free vulnerability in Extensions in Google Chrome prior to version 149.0.7827.155 allowed an attacker to exploit heap corruption via a malicious extension if a user installed it.

Inappropriate implementation in Extensions in Google Chrome prior to version 149.0.7827.115 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

Use after free in Extensions in Google Chrome prior to version 116.0.5845.96 allowed an attacker who convinced a user to install a malicious extension to potentially exploit heap corruption via a crafted HTML page.

Insufficient data validation in Extensions in Google Chrome prior to version 115.0.5790.170 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension.