Google Chrome vulnerabilities

The Service Workers subsystem in Google Chrome before version 52.0.2743.82 does not properly implement the Secure Contexts specification, allowing remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.

Multiple unspecified vulnerabilities in Google Chrome before version 52.0.2743.82 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 51.0.2704.103 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 51.0.2704.79 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The Autofill implementation in Google Chrome before version 51.0.2704.79 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion. This allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.

In Google Chrome before version 51.0.2704.79, there is a vulnerability in runtime_custom_bindings.cc that does not consider side effects during the creation of an array of extension views. This can lead to denial of service (use-after-free) or other unspecified impacts related to extensions.

The extensions subsystem in Google Chrome before version 51.0.2704.79 does not properly restrict bindings access, allowing remote attackers to bypass the Same Origin Policy via unspecified vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 51.0.2704.63 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The Autofill implementation in Google Chrome before version 51.0.2704.63 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion. This allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted website.

The binding.js file in the extension bindings in Google Chrome before version 51.0.2704.63 has a prototype usage issue, allowing remote attackers to bypass the Same Origin Policy.

The extensions subsystem in Google Chrome before version 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

The ModuleSystem::RequireForJsInner function in Google Chrome before version 51.0.2704.63 mishandles properties, allowing remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy.

Google Chrome before version 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, allowing attackers to conduct directory traversal attacks via a file: URL.

The download implementation in Google Chrome before version 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.

Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.

The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in Google Chrome before version 49.0.2623.108 allows attackers to cause a denial of service or possibly have unspecified other impact by triggering an error in creating an MHTML document.

Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in the Navigation implementation in Google Chrome before version 49.0.2623.108 may allow remote attackers to cause a denial of service or possibly have unspecified other impact.

A use-after-free vulnerability in Google Chrome before version 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an image download after a certain data structure is deleted.

The DOM implementation in Google Chrome before version 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations. This allows remote attackers to bypass the Same Origin Policy via a crafted website.

The Extensions subsystem in Google Chrome before version 48.0.2564.109 does not prevent the use of the Object.defineProperty method to override intended extension behavior, allowing remote attackers to bypass the Same Origin Policy via crafted JavaScript code.

Multiple unspecified vulnerabilities in Google Chrome before version 48.0.2564.82 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Integer overflow in the WebCursor::Deserialize function in Google Chrome before version 47.0.2526.106 may allow remote attackers to cause a denial of service or potentially have unspecified other impact via a crafted RGBA pixel array.

Multiple unspecified vulnerabilities in Google Chrome before version 47.0.2526.80 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The VideoFramePool::PoolImpl::CreateFrame function in Google Chrome before version 47.0.2526.73 does not initialize memory for a video-frame data structure, which might allow remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact.

CVE-2015-8479 is a use-after-free vulnerability in the AudioOutputDevice::OnDeviceAuthorized function in Google Chrome before version 47.0.2526.73. It allows attackers to trigger a denial of service by accessing an unauthorized audio output device, potentially leading to heap memory corruption.

Multiple unspecified vulnerabilities in Google Chrome before version 47.0.2526.73 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

A use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in the DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOMCharacterDataModified events for certain detached-subtree insertions.

A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that modifies a pointer used for reporting loadTimes data.

The DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, which is a different vulnerability than CVE-2015-6768.

The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing.

The DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

A use-after-free vulnerability in the AppCache implementation in Google Chrome before version 47.0.2526.73 allows remote attackers with renderer access to cause a denial of service or possibly have unspecified other impact by leveraging incorrect AppCacheUpdateJob behavior associated with duplicate cache selection.

A use-after-free vulnerability in Google Chrome before version 47.0.2526.73 allows remote attackers to execute arbitrary code or cause a denial of service by mishandling AppCache update jobs.

Multiple unspecified vulnerabilities in Google Chrome before version 46.0.2490.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

A use-after-free vulnerability in the ServiceWorker implementation in Google Chrome before version 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a callback.

Multiple unspecified vulnerabilities in Google Chrome before version 45.0.2454.85 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 44.0.2403.89 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in the accessibility implementation in Google Chrome before version 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.

Multiple unspecified vulnerabilities in Google Chrome before version 43.0.2357.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

In Google Chrome before version 43.0.2357.65, there is an issue with wrap handling in common/partial_circular_buffer.cc, allowing remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data.

Multiple unspecified vulnerabilities in Google Chrome before version 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The NaClSandbox::InitializeLayerTwoSandbox function in Google Chrome before version 42.0.2311.90 lacks RLIMIT_AS and RLIMIT_DATA limits for Native Client processes, which may make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impacts by leveraging the ability to run a crafted program in the NaCl sandbox.

Multiple unspecified vulnerabilities in Google Chrome before version 42.0.2311.90 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in Google Chrome before version 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.

Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.

Array index error in the MidiManagerUsb::DispatchSendMidiData function in Google Chrome before version 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation.

Multiple unspecified vulnerabilities in Google Chrome before version 41.0.2272.76 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in Google Chrome before version 41.0.2272.76 may allow remote attackers to cause a denial of service or potentially have unspecified other impact via calls to DeleteAndStartOver.

Multiple unspecified vulnerabilities in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The OriginCanAccessServiceWorkers function in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android does not properly restrict the URI scheme during ServiceWorker registration, allowing remote attackers to gain privileges via a filesystem: URI.