Google Chrome (Blink) vulnerabilities

Use after free in Blink in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

A use after free in Blink in Google Chrome prior to version 59.0.3071.104 for Mac, Windows, and Linux, and prior to version 59.0.3071.117 for Android, allows a remote attacker to perform an out of bounds memory read via a crafted HTML page, known as an IndexedDB sandbox escape.

Incorrect handling of DOM changes in Blink in Google Chrome prior to version 58.0.3029.81 for Windows allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A use after free vulnerability in Blink in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and prior to version 57.0.2987.132 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

A flaw in block structure in Blink in Google Chrome prior to version 57.0.2987.133 for Mac, Windows, and Linux, and prior to version 57.0.2987.132 for Android, allows a remote attacker to potentially exploit memory corruption via a crafted HTML page that triggers improper casting.

Blink in Google Chrome before version 52.0.2743.116 does not ensure that a taint property is preserved after a structure-clone operation on an ImageBitmap object derived from a cross-origin image. This allows remote attackers to bypass the Same Origin Policy via crafted JavaScript code.

The ChromeClientImpl::createWindow method in Blink, used in Google Chrome before version 52.0.2743.82, does not prevent window creation by a deferred frame, allowing remote attackers to bypass the Same Origin Policy via a crafted website.

Blink, as used in Google Chrome before version 50.0.2661.94, mishandles assertions in the WTF::BitArray and WTF::double_conversion::Vector classes. This allows remote attackers to cause a denial of service (out-of-bounds write) or possibly have unspecified other impact via a crafted web site.

A use-after-free vulnerability in the StyleResolver::appendCSSStyleSheet function in Blink, used in Google Chrome before version 49.0.2623.75, allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted website.

The RenderCounter::updateCounter function in Blink, used in Google Chrome before version 41.0.2272.76, does not force a relayout operation, leading to uninitialized memory for a data structure. This allows remote attackers to cause application crashes or potentially other unspecified impacts via a crafted CSS token sequence.

The DragImage::create function in Blink, used in Google Chrome before version 41.0.2272.76, does not initialize memory for image drawing. This may allow remote attackers to trigger an unspecified impact by causing a failed image decoding.

A use-after-free vulnerability in the Event::currentTarget function in Blink, used in Google Chrome before version 38.0.2125.101, allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted JavaScript code that accesses the path property of an Event object.

A use-after-free vulnerability in the FrameSelection::updateAppearance function in Blink, used in Google Chrome before version 34.0.1847.137, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper RenderObject handling.