Google Chrome vulnerabilities

A use-after-free vulnerability in Google Chrome before version 47.0.2526.73 allows remote attackers to execute arbitrary code or cause a denial of service by mishandling AppCache update jobs.

Multiple unspecified vulnerabilities in Google Chrome before version 46.0.2490.71 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

A use-after-free vulnerability in the ServiceWorker implementation in Google Chrome before version 46.0.2490.71 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging object destruction in a callback.

Multiple unspecified vulnerabilities in Google Chrome before version 45.0.2454.85 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 44.0.2403.89 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in the accessibility implementation in Google Chrome before version 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging lack of certain validity checks for accessibility-tree data structures.

Multiple unspecified vulnerabilities in Google Chrome before version 43.0.2357.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

In Google Chrome before version 43.0.2357.65, there is an issue with wrap handling in common/partial_circular_buffer.cc, allowing remote attackers to bypass a sandbox protection mechanism or cause a denial of service (out-of-bounds write) via vectors that trigger a write operation with a large amount of data.

Multiple unspecified vulnerabilities in Google Chrome before version 42.0.2311.135 allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The NaClSandbox::InitializeLayerTwoSandbox function in Google Chrome before version 42.0.2311.90 lacks RLIMIT_AS and RLIMIT_DATA limits for Native Client processes, which may make it easier for remote attackers to conduct row-hammer attacks or have unspecified other impacts by leveraging the ability to run a crafted program in the NaCl sandbox.

Multiple unspecified vulnerabilities in Google Chrome before version 42.0.2311.90 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in the RenderFrameImpl::OnMessageReceived function in Google Chrome before version 42.0.2311.90 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger renderer IPC messages during a detach operation.

Google Chrome before 41.0.2272.118 does not properly handle the interaction of IPC, the Gamepad API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.

Array index error in the MidiManagerUsb::DispatchSendMidiData function in Google Chrome before version 41.0.2272.76 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging renderer access to provide an invalid port index that triggers an out-of-bounds write operation.

Multiple unspecified vulnerabilities in Google Chrome before version 41.0.2272.76 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple use-after-free vulnerabilities in the ServiceWorkerScriptCacheMap implementation in Google Chrome before version 41.0.2272.76 may allow remote attackers to cause a denial of service or potentially have unspecified other impact via calls to DeleteAndStartOver.

Multiple unspecified vulnerabilities in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The OriginCanAccessServiceWorkers function in Google Chrome before version 40.0.2214.111 on Windows, OS X, and Linux and before version 40.0.2214.109 on Android does not properly restrict the URI scheme during ServiceWorker registration, allowing remote attackers to gain privileges via a filesystem: URI.

Multiple unspecified vulnerabilities in Google Chrome before version 40.0.2214.91 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The Fonts implementation in Google Chrome before version 40.0.2214.91 does not initialize memory for a data structure, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

The Fonts implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via unknown vectors.

A use-after-free vulnerability in the Speech implementation in Google Chrome before version 40.0.2214.91 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors involving utterances from a closed tab.

Multiple unspecified vulnerabilities in Google Chrome before version 39.0.2171.65 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Multiple integer overflows in the CheckMov function in media/base/container_names.cc in Google Chrome before version 39.0.2171.65 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via a large atom in MPEG-4 or QuickTime .mov data.

Multiple unspecified vulnerabilities in Google Chrome before version 38.0.2125.101 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

In Google Chrome before version 38.0.2125.101 on Windows, there is an issue with improper implementation of read-only restrictions on shared memory, allowing attackers to bypass a sandbox protection mechanism.

Use-after-free vulnerability in the Web Workers implementation in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

The SessionService::GetLastSession function in Google Chrome before version 38.0.2125.101 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via vectors that leverage 'type confusion' for callback processing.

Multiple unspecified vulnerabilities in Google Chrome before version 37.0.2062.120 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, which allows remote attackers to execute arbitrary code via unspecified vectors.

Google Chrome before 37.0.2062.94 does not properly handle the interaction of extensions, IPC, the sync API, and Google V8, allowing remote attackers to execute arbitrary code via unspecified vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 36.0.1985.143 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The WebMediaPlayerAndroid::load function in Google Chrome before version 36.0.1985.122 on Android does not properly handle redirects, allowing remote attackers to bypass the Same Origin Policy via a crafted website hosting a video stream.

A heap-based buffer overflow in the FFmpegVideoDecoder::GetVideoBuffer function in Google Chrome before version 35.0.1916.153 allows remote attackers to exploit small VideoFrame data structures. This can lead to denial of service or potentially other unspecified impacts.

Buffer overflow in the clipboard implementation in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger unexpected bitmap data.

A use-after-free vulnerability in the ChildThread::Shutdown function in the filesystem API in Google Chrome before version 35.0.1916.153 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to a Blink shutdown.

Multiple unspecified vulnerabilities in Google Chrome before version 35.0.1916.114 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Integer overflow in the AudioInputRendererHost::OnCreateStream function in Google Chrome before version 35.0.1916.114 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger a large shared-memory allocation.

Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The PointerCompare function in codegen.cc in Seccomp-BPF, used in Google Chrome before version 34.0.1847.131 on Windows and OS X and before version 34.0.1847.132 on Linux, does not properly merge blocks, which might allow remote attackers to bypass intended sandbox restrictions by leveraging renderer access.

A use-after-free vulnerability in Google Chrome before version 34.0.1847.131 on Windows and OS X and before 34.0.1847.132 on Linux allows remote attackers to cause a denial of service or possibly have unspecified other impact via an INPUT element that triggers the presence of a Speech Recognition Bubble window for an incorrect duration.

Multiple unspecified vulnerabilities in Google Chrome before version 34.0.1847.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in renderer_webcolorchooser_impl.h in Google Chrome before version 34.0.1847.116 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors related to forms.

The UnescapeURLWithOffsetsImpl function in Google Chrome before version 34.0.1847.116 does not properly handle bidirectional Internationalized Resource Identifiers (IRIs), which makes it easier for remote attackers to spoof URLs via crafted use of right-to-left (RTL) Unicode text.

Integer overflow in the SoftwareFrameManager::SwapToNewFrame function in Google Chrome before version 34.0.1847.116 may allow remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted mapping of a large amount of renderer memory.

A directory traversal vulnerability in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows has unspecified impact and attack vectors.

The ScopedClipboardWriter::WritePickledData function in Google Chrome before version 33.0.1750.152 on OS X and Linux and before version 33.0.1750.154 on Windows does not verify a certain format value, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via clipboard-related vectors.

The AsyncPixelTransfersCompletedQuery::End function in Google Chrome before version 33.0.1750.152 does not check whether a certain position is within the bounds of a shared-memory segment. This may allow remote attackers to cause a denial of service through GPU command-buffer memory corruption or potentially other unspecified impacts.

Memory corruption in GarbageCollection in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.

Improper input validation in Skia in Google Chrome prior to 156.0.8078.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page.