Google Chrome vulnerabilities

Google Chrome before version 53.0.2785.113 does not ensure that the recipient of a certain IPC message is a valid RenderFrame or RenderWidget. This allows remote attackers to cause a denial of service (invalid pointer dereference and application crash) or possibly have unspecified other impact.

Multiple unspecified vulnerabilities in Google Chrome before version 53.0.2785.113 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The extensions subsystem in Google Chrome before version 53.0.2785.113 does not properly restrict access to Object.prototype, allowing remote attackers to load unintended resources. This can lead to unintended JavaScript function calls and bypass the Same Origin Policy via an indirect interception attack.

Multiple unspecified vulnerabilities in Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The EditingStyle::mergeStyle function in Blink, used in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux, mishandles custom properties. This may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted website leveraging 'type confusion' in the StylePropertySerializer class.

In Google Chrome before version 53.0.2785.89 on Windows and OS X and before version 53.0.2785.92 on Linux, there is an issue in event processing that may lead to a denial of service (use-after-free) or other unspecified impacts.

The extensions subsystem in Google Chrome before version 53.0.2785.89 on Windows and OS X and before 53.0.2785.92 on Linux relies on an IFRAME source URL to identify an associated extension. This allows remote attackers to conduct extension-bindings injection attacks by leveraging script access to a resource that initially has the about:blank URL.

Integer overflow in the kbasep_vinstr_attach_client function in Google Chrome before version 52.0.2743.85 allows remote attackers to cause a denial of service by leveraging unrestricted multiplication.

The Proxy Auto-Config (PAC) feature in Google Chrome before version 52.0.2743.82 does not ensure that URL information is restricted to a scheme, host, and port. This allows remote attackers to discover credentials by operating a server with a PAC script.

The Service Workers subsystem in Google Chrome before version 52.0.2743.82 does not properly implement the Secure Contexts specification, allowing remote attackers to bypass the Same Origin Policy via an https IFRAME element inside an http IFRAME element.

Multiple unspecified vulnerabilities in Google Chrome before version 52.0.2743.82 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 51.0.2704.103 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 51.0.2704.79 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The Autofill implementation in Google Chrome before version 51.0.2704.79 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion. This allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted web site.

In Google Chrome before version 51.0.2704.79, there is a vulnerability in runtime_custom_bindings.cc that does not consider side effects during the creation of an array of extension views. This can lead to denial of service (use-after-free) or other unspecified impacts related to extensions.

The extensions subsystem in Google Chrome before version 51.0.2704.79 does not properly restrict bindings access, allowing remote attackers to bypass the Same Origin Policy via unspecified vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 51.0.2704.63 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The Autofill implementation in Google Chrome before version 51.0.2704.63 mishandles the interaction between field updates and JavaScript code that triggers a frame deletion. This allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted website.

The binding.js file in the extension bindings in Google Chrome before version 51.0.2704.63 has a prototype usage issue, allowing remote attackers to bypass the Same Origin Policy.

The extensions subsystem in Google Chrome before version 51.0.2704.63 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

The ModuleSystem::RequireForJsInner function in Google Chrome before version 51.0.2704.63 mishandles properties, allowing remote attackers to conduct bindings-interception attacks and bypass the Same Origin Policy.

Google Chrome before version 50.0.2661.102 on Android mishandles / (slash) and \ (backslash) characters, allowing attackers to conduct directory traversal attacks via a file: URL.

The download implementation in Google Chrome before version 50.0.2661.75 on Android allows remote attackers to bypass intended pathname restrictions via unspecified vectors.

Google Chrome before 50.0.2661.75 does not properly consider that frame removal may occur during callback execution, which allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via a crafted extension.

The PageCaptureSaveAsMHTMLFunction::ReturnFailure function in Google Chrome before version 49.0.2623.108 allows attackers to cause a denial of service or possibly have unspecified other impact by triggering an error in creating an MHTML document.

Use-after-free vulnerability in the RenderWidgetHostImpl::Destroy function in the Navigation implementation in Google Chrome before version 49.0.2623.108 may allow remote attackers to cause a denial of service or possibly have unspecified other impact.

A use-after-free vulnerability in Google Chrome before version 49.0.2623.75 allows remote attackers to cause a denial of service or possibly have unspecified other impact by triggering an image download after a certain data structure is deleted.

The DOM implementation in Google Chrome before version 48.0.2564.109 does not properly restrict frame-attach operations from occurring during or after frame-detach operations. This allows remote attackers to bypass the Same Origin Policy via a crafted website.

The Extensions subsystem in Google Chrome before version 48.0.2564.109 does not prevent the use of the Object.defineProperty method to override intended extension behavior, allowing remote attackers to bypass the Same Origin Policy via crafted JavaScript code.

Multiple unspecified vulnerabilities in Google Chrome before version 48.0.2564.82 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Integer overflow in the WebCursor::Deserialize function in Google Chrome before version 47.0.2526.106 may allow remote attackers to cause a denial of service or potentially have unspecified other impact via a crafted RGBA pixel array.

Multiple unspecified vulnerabilities in Google Chrome before version 47.0.2526.80 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The VideoFramePool::PoolImpl::CreateFrame function in Google Chrome before version 47.0.2526.73 does not initialize memory for a video-frame data structure, which might allow remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact.

CVE-2015-8479 is a use-after-free vulnerability in the AudioOutputDevice::OnDeviceAuthorized function in Google Chrome before version 47.0.2526.73. It allows attackers to trigger a denial of service by accessing an unauthorized audio output device, potentially leading to heap memory corruption.

Multiple unspecified vulnerabilities in Google Chrome before version 47.0.2526.73 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

A use-after-free vulnerability in the ContainerNode::notifyNodeInsertedInternal function in the DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to DOMCharacterDataModified events for certain detached-subtree insertions.

A use-after-free vulnerability in the GetLoadTimes function in the Extensions implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted JavaScript code that modifies a pointer used for reporting loadTimes data.

The DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors, which is a different vulnerability than CVE-2015-6768.

The provisional-load commit implementation in WebKit/Source/bindings/core/v8/WindowProxy.cpp in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy by leveraging a delay in window proxy clearing.

The DOM implementation in Google Chrome before version 47.0.2526.73 allows remote attackers to bypass the Same Origin Policy via unspecified vectors.

A use-after-free vulnerability in the AppCache implementation in Google Chrome before version 47.0.2526.73 allows remote attackers with renderer access to cause a denial of service or possibly have unspecified other impact by leveraging incorrect AppCacheUpdateJob behavior associated with duplicate cache selection.

A use-after-free vulnerability in Google Chrome before version 47.0.2526.73 allows remote attackers to execute arbitrary code or cause a denial of service by mishandling AppCache update jobs.

Multiple unspecified vulnerabilities in Google Chrome before version 46.0.2490.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

A use-after-free vulnerability in the ServiceWorker implementation in Google Chrome before version 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a callback.

Multiple unspecified vulnerabilities in Google Chrome before version 45.0.2454.85 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 44.0.2403.89 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in the accessibility implementation in Google Chrome before version 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.

Multiple unspecified vulnerabilities in Google Chrome before version 43.0.2357.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

In Google Chrome before version 43.0.2357.65, there is an issue with wrap handling in common/partial_circular_buffer.cc, allowing remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data.

Multiple unspecified vulnerabilities in Google Chrome before version 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.