Google Chrome vulnerabilities

Insufficient data validation in InterestGroups in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A Type Confusion issue in Accessibility in Google Chrome on Windows prior to version 148.0.7778.96 could allow a remote attacker who compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Use after free in Aura in Google Chrome on Windows prior to version 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A use after free vulnerability in DOM in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

In Google Chrome prior to version 148.0.7778.96, a 'use after free' vulnerability in SVG allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Integer overflow in ANGLE in Google Chrome on Mac and Windows prior to version 148.0.7778.96 may allow a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Heap buffer overflow in ANGLE in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Integer overflow in Blink in Google Chrome prior to version 148.0.7778.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

A race condition in GPU in Google Chrome on Windows prior to version 147.0.7727.117 allowed a remote attacker to potentially perform a sandbox escape via a crafted video file.

Use after free in Codecs in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

A use after free vulnerability in Forms in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

In Google Chrome on Windows prior to version 147.0.7727.101, there was a vulnerability related to uninitialized use in accessibility features. A remote attacker who compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.

Use after free in Dawn in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A use after free vulnerability in Viz in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page.

In Google Chrome prior to version 147.0.7727.101, an out of bounds read in the Media module allowed a remote attacker to execute arbitrary code by convincing a user to perform specific UI gestures on a crafted HTML page.

Use after free in Codecs in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

A use after free vulnerability in Video in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Type Confusion in Turbofan in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

A use after free vulnerability in CSS in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use after free in Prerender in Google Chrome prior to version 147.0.7727.101 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

Use after free in Proxy in Google Chrome prior to version 147.0.7727.101 allowed an attacker in a privileged network position to potentially perform a sandbox escape via a crafted HTML page.

Heap buffer overflow in GPU in Google Chrome prior to version 146.0.7680.178 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

Vulnerability in the V8 JavaScript engine in Google Chrome prior to 144.0.7559.59. Inappropriate implementation allows a remote attacker to perform an out-of-bounds memory read via a crafted HTML page.

Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extension. (Chromium security severity: High)

Math overflow in Skia in Google Chrome prior to version 61.0.3163.79 for Mac, Windows, and Linux, and prior to version 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Heap buffer overflow in WebGL in Google Chrome prior to version 61.0.3163.79 for Windows allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

A use after free in Google Chrome prior to version 60.0.3112.78 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

A use after free in credit card autofill in Google Chrome prior to version 59.0.3071.86 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Insufficient validation of untrusted input in Blink's mailto: handling in Google Chrome prior to version 59.0.3071.86 for Linux, Windows, and Mac allows a remote attacker to perform command injection via a crafted HTML page.

A use after free in Chrome Apps in Google Chrome prior to 59.0.3071.86 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page, related to Bluetooth.

Use after free in print preview in Blink in Google Chrome prior to version 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Incorrect handling of picture ID in WebRTC in Google Chrome prior to version 58.0.3029.96 for Mac, Windows, and Linux allowed a remote attacker to trigger a race condition via a crafted HTML page.

Type confusion in Blink in Google Chrome prior to version 58.0.3029.81 for Linux, Windows, and Mac, and 58.0.3029.83 for Android, allowed a remote attacker to potentially obtain code execution via a crafted HTML page.

A use after free vulnerability in PrintPreview in Google Chrome prior to version 58.0.3029.81 for Windows allowed a remote attacker to potentially access out of bounds memory via a crafted HTML page.

A use after free in printing in Google Chrome prior to version 57.0.2987.133 for Linux and Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Chrome Apps in Google Chrome prior to version 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, allowing a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.

Google Chrome prior to 57.0.2987.98 for Windows and Mac had a race condition, which could cause Chrome to display incorrect certificate information for a site.

A use after free in ANGLE in Google Chrome prior to 57.0.2987.98 for Windows allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

Bad casting in bitmap manipulation in Blink in Google Chrome prior to version 55.0.2883.75 for Mac, Windows, and Linux, and 55.0.2883.84 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Blink in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had a flaw that incorrectly allowed reentrance of FrameView::updateLifecyclePhasesInternal(). This allowed a remote attacker to perform an out of bounds memory read via crafted HTML pages.

Blink in Google Chrome prior to version 54.0.2840.59 for Windows, Mac, and Linux; 54.0.2840.85 for Android had insufficient validation in bitmap handling, which allowed a remote attacker to potentially exploit heap corruption via crafted HTML pages.

Google Chrome before version 53.0.2785.113 does not ensure that the recipient of a certain IPC message is a valid RenderFrame or RenderWidget. This allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) or possibly have unspecified other impact.

Multiple unspecified vulnerabilities in Google Chrome before version 53.0.2785.113 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The extensions subsystem in Google Chrome before version 53.0.2785.113 does not properly restrict access to Object.prototype, allowing remote attackers to load unintended resources. This can lead to unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.

Multiple unspecified vulnerabilities in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The EditingStyle::mergeStyle function in Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties. This may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted website leveraging 'type confusion' in the StylePropertySerializer class.

In Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, there is an issue in event processing that may lead to a denial of service (use-after-free) or other unspecified impacts.

The extensions subsystem in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension. This allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a resource that initially has the about:blank URL.

Integer overflow in the kbasep_vinstr_attach_client function in Google Chrome before version 52.0.2743.85 allows remote attackers to cause a denial of service by leveraging unrestricted multiplication.

The Proxy Auto-Config (PAC) feature in Google Chrome before version 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port. This allows remote attackers to discover credentials by operating a server with a PAC script.