CVE-2017-5038

chromium-browser: use after free in guestview

Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.

CVSS 3.1 · 6.3 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5039

chromium-browser: use after free in pdfium

A use after free in PDFium in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted PDF file.

CVSS 3.1 · 7.8 High EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5040

chromium-browser: information disclosure in v8

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android was missing a neutering check, which allowed a remote attacker to read values in memory via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 27.4% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5042

chromium-browser: incorrect handling of cookies in cast

Cast in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android sent cookies to sites discovered via SSDP, which allowed an attacker on the local network segment to initiate connections to arbitrary URLs and observe any plaintext cookies sent.

CVSS 3.1 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5043

chromium-browser: use after free in guestview

Chrome Apps in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac had a use after free bug in GuestView, which allowed a remote attacker to perform an out of bounds memory read via a crafted Chrome extension.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5044

chromium-browser: heap overflow in skia

Heap buffer overflow in filter processing in Skia in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 6.3 Medium EPSS 2.6% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5045

chromium-browser: information disclosure in xss auditor

XSS Auditor in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android allowed detection of a blocked iframe load, which allowed a remote attacker to brute force JavaScript variables via a crafted HTML page.

CVSS 3.1 · 6.1 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5046

chromium-browser: information disclosure in blink

V8 in Google Chrome prior to 57.0.2987.98 for Mac, Windows, and Linux and 57.0.2987.108 for Android had insufficient policy enforcement, which allowed a remote attacker to spoof the location object via a crafted HTML page, related to Blink information disclosure.

CVSS 3.1 · 4.3 Medium EPSS 1.6% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5097

chromium-browser: out-of-bounds read in skia

Insufficient validation of untrusted input in Skia in Google Chrome prior to 60.0.3112.78 for Linux allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Debian Google Linux and 1 more

Products

Debian Linux Chrome Linux Kernel and 1 more

CVE-2017-5081

chromium-browser: extension verification bypass

Lack of verification of an extension's locale folder in Google Chrome prior to 59.0.3071.86 for Mac, Windows, and Linux, and 59.0.3071.92 for Android, allowed an attacker with local write access to modify extensions by modifying extension files.

CVSS 3.1 · 3.3 Low EPSS < 1% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5091

chromium-browser: use after free in indexeddb

A use after free in IndexedDB in Google Chrome prior to 60.0.3112.78 for Linux, Android, Windows, and Mac allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5093

chromium-browser: ui spoofing in blink

Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5094

chromium-browser: type confusion in extensions

Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5095

chromium-browser: out-of-bounds write in pdfium

Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5098

chromium-browser: use after free in v8

A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 15.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5099

chromium-browser: out-of-bounds write in ppapi

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Debian Google Linux and 1 more

Products

Debian Linux Chrome Linux Kernel and 1 more

CVE-2017-5101

chromium-browser: url spoofing in omnibox

Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5102

chromium-browser: uninitialized use in skia

Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5103

chromium-browser: uninitialized use in skia

Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5105

chromium-browser: url spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more