Google Chrome vulnerabilities

Multiple unspecified vulnerabilities in Google Chrome before version 40.0.2214.91 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The Fonts implementation in Google Chrome before version 40.0.2214.91 does not initialize memory for a data structure, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

The Fonts implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

A use-after-free vulnerability in the Speech implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab.

Multiple unspecified vulnerabilities in Google Chrome before version 39.0.2171.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before version 39.0.2171.65 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in MPEG-4 or QuickTime .mov data.

Multiple unspecified vulnerabilities in Google Chrome before version 38.0.2125.101 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

In Google Chrome before version 38.0.2125.101 on Windows, there is an issue with improper implementation of read-only restrictions on shared memory, allowing attackers to bypass a sandbox protection mechanism.

Use-after-free vulnerability in the Web Workers implementation in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

The SessionService::GetLastSession function in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage 'type confusion' for callback processing.

Multiple unspecified vulnerabilities in Google Chrome before version 37.0.2062.120 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.

Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, allowing remote attackers to execute arbitrary code via unspecified vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 36.0.1985.143 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The WebMediaPlayerAndroid::load function in Google Chrome before version 36.0.1985.122 on Android does not properly handle redirects, allowing remote attackers to bypass the Same Origin Policy via a crafted website hosting a video stream.

A heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in Google Chrome before version 35.0.1916.153 allows remote attackers to exploit small VideoFrame data structures. This can lead to denial of service or potentially other unspecified impacts.

Buffer overflow in the clipboard implementation in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data.

A use-after-free vulnerability in the ChildThread::Shutdown function in the filesystem API in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.

Multiple unspecified vulnerabilities in Google Chrome before version 35.0.1916.114 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Integer overflow in the AudioInputRendererHost::OnCreateStream function in Google Chrome before version 35.0.1916.114 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large shared-memory allocation.

Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The PointerCompare function in codegen.cc in Seccomp-BPF, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.

A use-after-free vulnerability in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration.

Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in renderer_webcolorchooser_impl.h in Google Chrome before version 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.

The UnescapeURLWithOffsetsImpl function in Google Chrome before version 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.

Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in Google Chrome before version 34.0.1847.116 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory.

A directory traversal vulnerability in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows has unspecified impact and attack vectors.

The ScopedClipboardWriter::WritePickledData function in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows does not verify a certain format value, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via clipboard-related vectors.

The AsyncPixelTransfersCompletedQuery::End function in Google Chrome before version 33.0.1750.152 does not check whether a certain position is within the bounds of a shared-memory segment. This may allow remote attackers to cause a denial of service through GPU command-buffer memory corruption or potentially other unspecified impacts.

Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Use after free in ANGLE in Google Chrome on Android prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Use after free in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Use after free in Views in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebGL in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Aura in Google Chrome before 152.0.7977.65 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in Aura in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Out of bounds write in the ANGLE component of Google Chrome prior to 152.0.7977.65. A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the sandbox.

Out of bounds write in the ANGLE component of Google Chrome prior to 152.0.7977.65. A remote attacker can use a crafted HTML page to potentially execute arbitrary code outside the sandbox.

Incorrect authorization in CustomTabs in Google Chrome on Android prior to 152.0.7977.65 allowed a local attacker to bypass web origin policy via a co-installed app. The issue has a low severity.

A use-after-free vulnerability in Views in Google Chrome on Mac prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The issue has a critical severity.

A use-after-free vulnerability in ANGLE in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. The issue has a high severity.

An off-by-one error in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially read memory inside the sandbox via a crafted Chrome extension. The issue has a low severity.

Out-of-bounds write in ANGLE in Google Chrome on Windows before 152.0.7977.65. A remote attacker can exploit a crafted HTML page to potentially execute arbitrary code outside the sandbox.

Out-of-bounds write in ANGLE in Google Chrome before 152.0.7977.65. A remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page.

Buffer overflow in ANGLE in Google Chrome before 152.0.7977.65. A remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page.

Use-after-free in Sessions in Google Chrome on Android before 152.0.7977.65. A remote attacker leveraging social engineering can execute arbitrary code outside the sandbox via UI interaction.

Use-after-free in Views in Google Chrome on Mac before 152.0.7977.65. A remote attacker can execute arbitrary code outside the sandbox via a crafted HTML page.

In Google Chrome prior to 152.0.7977.65, improper input validation in Dawn allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in the Bluetooth component in Google Chrome on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Medium)