CVE Vulnerability Catalog

adm-zip versions 0.5.14 through 0.6.0 fail to apply zlib decompression output limits when ZIP entries declare zero uncompressed size. Attackers can craft malicious ZIP archives with highly compressible entries declaring zero size to exhaust memory and cause denial of service.

Race condition in Extensions in Google Chrome on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox via UI interaction.

Use after free in V8 in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Race condition in Core in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Type confusion in CacheStorage in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Use-after-free in the PDF component of Google Chrome prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

Use-after-free in the DOM component of Google Chrome prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

Incorrect authorization in the WebUI component of Google Chrome prior to 153.0.8010.47. A remote attacker who had compromised the renderer process could potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Incorrect authorization in the Core component of Google Chrome on Windows prior to 153.0.8010.47. A local attacker can execute arbitrary code outside the sandbox via a local program.

Improper state validation in Skia in Google Chrome prior to 153.0.8010.47. A remote attacker who had compromised the renderer process could read memory outside the sandbox via a crafted HTML page.

Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47. A remote attacker who had compromised the renderer process and leveraged social engineering could bypass web origin policy via a crafted HTML page.

Type confusion in the Compositing component of Google Chrome prior to 153.0.8010.47. A remote attacker can execute arbitrary code inside the sandbox via a crafted HTML page.

Incorrect reference resolution in Extensions in Google Chrome on Mac prior to 153.0.8010.47 allowed a local attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a local program.

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in Input in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Use after free in Internals in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Code injection in XML in Google Chrome prior to 153.0.8010.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page.

Type confusion in ServiceWorker in Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.

Race condition in Extensions in Chrome on Mac prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Out of bounds write in ServiceWorker in Chrome prior to 153.0.8010.47 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page.