Google Chrome vulnerabilities

The NaClSandbox::InitializeLayerTwoSandbox function in Google Chrome before version 42.0.2311.90 lacks RLIMIT_AS and RLIMIT_DATA limits for Native Client processes, which may make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impacts by leveraging the ability to run a crafted program in the NaCl sandbox.

Multiple unspecified vulnerabilities in Google Chrome before version 42.0.2311.90 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in Google Chrome before version 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.

Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.

Array index error in the MidiManagerUsb::DispatchSendMidiData function in Google Chrome before version 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation.

Multiple unspecified vulnerabilities in Google Chrome before version 41.0.2272.76 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in Google Chrome before version 41.0.2272.76 may allow remote attackers to cause a denial of service or potentially have unspecified other impact via calls to DeleteAndStartOver.

Multiple unspecified vulnerabilities in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The OriginCanAccessServiceWorkers function in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android does not properly restrict the URI scheme during ServiceWorker registration, allowing remote attackers to gain privileges via a filesystem: URI.

Multiple unspecified vulnerabilities in Google Chrome before version 40.0.2214.91 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The Fonts implementation in Google Chrome before version 40.0.2214.91 does not initialize memory for a data structure, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

The Fonts implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

A use-after-free vulnerability in the Speech implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab.

Multiple unspecified vulnerabilities in Google Chrome before version 39.0.2171.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before version 39.0.2171.65 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in MPEG-4 or QuickTime .mov data.

Multiple unspecified vulnerabilities in Google Chrome before version 38.0.2125.101 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

In Google Chrome before version 38.0.2125.101 on Windows, there is an issue with improper implementation of read-only restrictions on shared memory, allowing attackers to bypass a sandbox protection mechanism.

Use-after-free vulnerability in the Web Workers implementation in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

The SessionService::GetLastSession function in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage 'type confusion' for callback processing.

Multiple unspecified vulnerabilities in Google Chrome before version 37.0.2062.120 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.

Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, allowing remote attackers to execute arbitrary code via unspecified vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 36.0.1985.143 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The WebMediaPlayerAndroid::load function in Google Chrome before version 36.0.1985.122 on Android does not properly handle redirects, allowing remote attackers to bypass the Same Origin Policy via a crafted website hosting a video stream.

A heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in Google Chrome before version 35.0.1916.153 allows remote attackers to exploit small VideoFrame data structures. This can lead to denial of service or potentially other unspecified impacts.

Buffer overflow in the clipboard implementation in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data.

A use-after-free vulnerability in the ChildThread::Shutdown function in the filesystem API in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.

Multiple unspecified vulnerabilities in Google Chrome before version 35.0.1916.114 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Integer overflow in the AudioInputRendererHost::OnCreateStream function in Google Chrome before version 35.0.1916.114 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large shared-memory allocation.

Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The PointerCompare function in codegen.cc in Seccomp-BPF, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.

A use-after-free vulnerability in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration.

Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in renderer_webcolorchooser_impl.h in Google Chrome before version 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.

The UnescapeURLWithOffsetsImpl function in Google Chrome before version 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.

Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in Google Chrome before version 34.0.1847.116 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory.

A directory traversal vulnerability in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows has unspecified impact and attack vectors.

The ScopedClipboardWriter::WritePickledData function in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows does not verify a certain format value, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via clipboard-related vectors.

The AsyncPixelTransfersCompletedQuery::End function in Google Chrome before version 33.0.1750.152 does not check whether a certain position is within the bounds of a shared-memory segment. This may allow remote attackers to cause a denial of service through GPU command-buffer memory corruption or potentially other unspecified impacts.

Use after free in ANGLE in Google Chrome on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Improper input validation in Mobile in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in the UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Missing authorization in Chrome for iOS in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Chrome Tabs in Google Chrome on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)