Google Chrome vulnerabilities

A use-after-free vulnerability in XR in Google Chrome on Windows prior to 148.0.7778.216 allows a remote attacker who has compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A Use-After-Free vulnerability in WebView in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue has a critical severity rating from Chromium.

A use-after-free vulnerability in the Proxy component of Google Chrome prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code via a crafted PAC script.

Insufficient validation of untrusted input in the UI in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A use-after-free vulnerability in the Browser component of Google Chrome on Mac prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code via a crafted HTML page.

A Use-After-Free vulnerability in the Base component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code via a crafted HTML page.

Insufficient validation of untrusted input in WebGL in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A use-after-free vulnerability in the Network component of Google Chrome prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Insufficient validation of untrusted input in the USB module in Google Chrome prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code via a crafted HTML page.

An out-of-bounds read vulnerability in Headless mode in Google Chrome prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

A use-after-free vulnerability in DOM in Google Chrome prior to 148.0.7778.216 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

An integer overflow in WTF in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

A Use-After-Free vulnerability in the WebMIDI component of Google Chrome on Android prior to version 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue was rated as High severity in Chromium.

A use-after-free vulnerability in WebCodecs in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. Chromium security severity is High.

An inappropriate implementation in Input in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page.

An uninitialized use in GPU in Google Chrome on Android prior to 148.0.7778.216 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

A use-after-free vulnerability in the SVG component of Google Chrome prior to version 148.0.7778.216 allows a remote attacker to execute arbitrary code within a sandbox via a crafted HTML page.

A race condition in WebAudio in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

A use-after-free vulnerability in WebAppInstalls in Google Chrome on Mac prior to 148.0.7778.216 allowed a remote attacker who convinced a user to engage in specific UI gestures to execute arbitrary code via a crafted HTML page.

Insufficient validation of untrusted input in Passwords in Google Chrome prior to 148.0.7778.216 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

A Use-After-Free vulnerability in the Views component of Google Chrome prior to version 148.0.7778.216 allowed a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code via a crafted HTML page.

A Use-After-Free vulnerability in the PerformanceManager component of Google Chrome prior to version 148.0.7778.216 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. The issue is rated as High severity.

A Use-After-Free vulnerability in the Passwords component of Google Chrome on Windows prior to version 148.0.7778.216 was discovered. A remote attacker who had compromised the renderer process could potentially perform a sandbox escape via a crafted HTML page.

Use after free in DOM in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Medium)

Google Chrome prior to version 148.0.7778.179 has insufficient validation of untrusted input in the Input component. A remote attacker who compromised the renderer process can leak cross-origin data via a crafted HTML page.

Heap buffer overflow in the Chromecast component of Google Chrome on Android, Linux, and ChromeOS prior to 148.0.7778.179 allows a local attacker to execute arbitrary code inside a sandbox via malicious network traffic. Severity is medium.

In Google Chrome on Mac prior to 148.0.7778.179, an out-of-bounds read in GPU allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium).

Out of bounds read in GPU in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use-after-free vulnerability in the WebRTC component in Google Chrome prior to 148.0.7778.179. A remote attacker can execute arbitrary code via a crafted HTML page.

Google Chrome prior to 148.0.7778.179 has a heap buffer overflow in WebRTC that allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in XR in Google Chrome on Windows prior to 148.0.7778.179 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

Type Confusion in the GFX component in Google Chrome on Linux and ChromeOS prior to 148.0.7778.179 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted video file. (Chromium security severity: High)

Insufficient policy enforcement in ServiceWorker in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to leak cross-origin data via a crafted HTML page. The vulnerability has a Chromium security severity of High.

Insufficient policy enforcement in Service Worker in Google Chrome prior to 148.0.7778.179 allowed a remote attacker to bypass same origin policy via a crafted HTML page. (Chromium security severity: High)

Google Chrome prior to version 148.0.7778.179 contains a use-after-free vulnerability in the QUIC component, allowing a remote attacker to execute arbitrary code inside a sandbox via malicious network traffic.

Out of bounds read in GPU in Google Chrome on Mac prior to 148.0.7778.179 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability in the GPU component of Google Chrome on Windows prior to version 148.0.7778.179 was discovered. A remote attacker can exploit a crafted HTML page to execute arbitrary code within a sandbox.

A critical Use-After-Free vulnerability in the WebRTC component of Google Chrome on Linux prior to version 148.0.7778.179 allows a remote attacker to execute arbitrary code via a crafted HTML page.

Google Chrome on Windows prior to version 148.0.7778.179 has an inappropriate UI implementation allowing a remote attacker to perform UI spoofing via a crafted HTML page.

Use after free in Canvas in Google Chrome on Linux and ChromeOS prior to version 147.0.7727.138 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: Critical)

A use-after-free vulnerability in iOS in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Severity: Critical)

Insufficient validation of untrusted input in the Compositing component in Google Chrome prior to 147.0.7727.138 allows a remote attacker who has compromised the renderer process to bypass site isolation via a crafted HTML page.

A use-after-free vulnerability in ANGLE in Google Chrome prior to 147.0.7727.138 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Severity: High)

A use-after-free vulnerability in the Animation component of Google Chrome prior to 147.0.7727.138 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Google Chrome prior to version 147.0.7727.138 has a use-after-free vulnerability in the GPU component. A remote attacker who compromised the renderer process can potentially exploit heap corruption via a crafted HTML page.

Use after free in Navigation in Google Chrome prior to version 147.0.7727.138 allowed a remote attacker to execute arbitrary code via a crafted HTML page. (Chromium security severity: High)

A use-after-free vulnerability in the Media component of Google Chrome prior to 147.0.7727.138 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

An out-of-bounds read and write vulnerability in Angle in Google Chrome prior to 147.0.7727.138 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Severity: High)

Google Chrome prior to version 147.0.7727.138 has a heap buffer overflow vulnerability in the Skia library. A remote attacker who has compromised the renderer process can potentially escape the browser sandbox via a crafted HTML page.

Google Chrome on Android prior to version 147.0.7727.138 has a use-after-free vulnerability in the Media component. A remote attacker who compromised the renderer process can potentially perform a sandbox escape via a crafted HTML page.