CVE Vulnerability Catalog

Inappropriate implementation in Views in Google Chrome on Linux prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Use-after-free in Ozone in Google Chrome on Linux prior to 149.0.7827.103 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Media in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free vulnerability in the Codecs component of Google Chrome on Windows prior to 149.0.7827.103. A remote attacker who compromised the renderer process could potentially escape the sandbox via a crafted HTML page.

Google Chrome on Mac prior to 149.0.7827.103 has a race condition in the network component that could allow a remote attacker to escape the sandbox after compromising the network process.

Insufficient validation of untrusted input in Dawn in Google Chrome on Linux and ChromeOS prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Use after free in Guest View in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free vulnerability in InterestGroups component of Google Chrome prior to 149.0.7827.103. A remote attacker can execute arbitrary code inside a sandbox via a crafted HTML page.

Heap buffer overflow in GPU component of Google Chrome on Android prior to 149.0.7827.103. A remote attacker who compromised the renderer process can escape the sandbox via a crafted HTML page.

Use after free in PDF in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted PDF file.

Out of bounds read in WebRTC in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the GPU process to potentially exploit heap corruption via a crafted HTML page.

Use after free in Payments in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Use after free in Skia in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Type Confusion vulnerability in Bindings in Google Chrome prior to 149.0.7827.103 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

Use-after-free vulnerability in Views component of Google Chrome on Windows prior to 149.0.7827.103. A remote attacker who compromised the renderer process can escape the sandbox via a crafted HTML page.

Insufficient validation of untrusted input in New Tab Page in Google Chrome prior to 149.0.7827.103 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Use after free in Payments in Google Chrome on Mac prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

Use-after-free vulnerability in the ServiceWorker component in Google Chrome prior to 149.0.7827.103. An attacker who convinced a user to install a malicious extension could potentially perform a sandbox escape via a crafted Chrome Extension.

Integer overflow in Media component of Google Chrome on Mac prior to 149.0.7827.103. A remote attacker who compromised the renderer process can escape the sandbox via a crafted HTML page.

Use-after-free vulnerability in Extensions component of Google Chrome prior to 149.0.7827.103. A remote attacker who compromised the renderer process can escape the sandbox via a crafted HTML page.