Google Chrome vulnerabilities

Multiple unspecified vulnerabilities in Google Chrome before version 39.0.2171.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before version 39.0.2171.65 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in MPEG-4 or QuickTime .mov data.

Multiple unspecified vulnerabilities in Google Chrome before version 38.0.2125.101 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

In Google Chrome before version 38.0.2125.101 on Windows, there is an issue with improper implementation of read-only restrictions on shared memory, allowing attackers to bypass a sandbox protection mechanism.

Use-after-free vulnerability in the Web Workers implementation in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

The SessionService::GetLastSession function in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage 'type confusion' for callback processing.

Multiple unspecified vulnerabilities in Google Chrome before version 37.0.2062.120 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.

Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, allowing remote attackers to execute arbitrary code via unspecified vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 36.0.1985.143 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The WebMediaPlayerAndroid::load function in Google Chrome before version 36.0.1985.122 on Android does not properly handle redirects, allowing remote attackers to bypass the Same Origin Policy via a crafted website hosting a video stream.

A heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in Google Chrome before version 35.0.1916.153 allows remote attackers to exploit small VideoFrame data structures. This can lead to denial of service or potentially other unspecified impacts.

Buffer overflow in the clipboard implementation in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data.

A use-after-free vulnerability in the ChildThread::Shutdown function in the filesystem API in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.

Multiple unspecified vulnerabilities in Google Chrome before version 35.0.1916.114 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Integer overflow in the AudioInputRendererHost::OnCreateStream function in Google Chrome before version 35.0.1916.114 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large shared-memory allocation.

Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The PointerCompare function in codegen.cc in Seccomp-BPF, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.

A use-after-free vulnerability in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration.

Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in renderer_webcolorchooser_impl.h in Google Chrome before version 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.

The UnescapeURLWithOffsetsImpl function in Google Chrome before version 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.

Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in Google Chrome before version 34.0.1847.116 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory.

A directory traversal vulnerability in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows has unspecified impact and attack vectors.

The ScopedClipboardWriter::WritePickledData function in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows does not verify a certain format value, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via clipboard-related vectors.

The AsyncPixelTransfersCompletedQuery::End function in Google Chrome before version 33.0.1750.152 does not check whether a certain position is within the bounds of a shared-memory segment. This may allow remote attackers to cause a denial of service through GPU command-buffer memory corruption or potentially other unspecified impacts.

Use after free in ANGLE in Google Chrome on Android prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Integer overflow in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Low)

Improper input validation in Mobile in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Out of bounds write in Media in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Chromecast in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Incomplete cleanup in Dawn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Incorrect authorization in the UI in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Use after free in Navigation in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

Incorrect authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Missing authorization in Chrome for iOS in Google Chrome on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Chrome Tabs in Google Chrome on Mac prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incomplete cleanup in Chromoting in Google Chrome on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic.

Use after free in Tint in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect authorization in Search in Google Chrome on Android prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)

Integer overflow in WebGL in Google Chrome on Android prior to 155.0.8059.39 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Information leak in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Severity: Low)

Use after free in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code outside the sandbox via a crafted Chrome extension. (Chromium security severity: Low)

Use after free in Core in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use-after-free vulnerability in TabStrip in Google Chrome prior to 155.0.8059.39. A remote attacker leveraging social engineering could execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: High)

Use-after-free vulnerability in Browser in Google Chrome prior to 155.0.8059.39. A remote attacker could execute arbitrary code outside the sandbox via a crafted HTML page. (Severity: Critical)

Incorrect authorization in Chromoting in Google Chrome on Mac prior to 155.0.8059.39 allowed a remote attacker to bypass system access restrictions via crafted network traffic.

Incorrect Authorization in SiteIsolation in Google Chrome prior to 155.0.8059.39. A remote attacker could execute arbitrary code via a crafted HTML page. (Severity: High)

Use after free in FedCM in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: High)

Out of bounds write in WebGL in Google Chrome prior to 154.0.8037.97 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page.