CVE-2017-5093

chromium-browser: ui spoofing in blink

Inappropriate implementation in modal dialog handling in Blink in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to prevent a full screen warning from being displayed via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5094

chromium-browser: type confusion in extensions

Type confusion in extensions JavaScript bindings in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5095

chromium-browser: out-of-bounds write in pdfium

Stack overflow in PDFium in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit stack corruption via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.6% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5098

chromium-browser: use after free in v8

A use after free in V8 in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 15.5% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5099

chromium-browser: out-of-bounds write in ppapi

Insufficient validation of untrusted input in PPAPI Plugins in Google Chrome prior to 60.0.3112.78 for Mac allowed a remote attacker to potentially gain privilege elevation via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Debian Google Linux and 1 more

Products

Debian Linux Chrome Linux Kernel and 1 more

CVE-2017-5101

chromium-browser: url spoofing in omnibox

Inappropriate implementation in Omnibox in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5102

chromium-browser: uninitialized use in skia

Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5103

chromium-browser: uninitialized use in skia

Use of an uninitialized value in Skia in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.9% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5105

chromium-browser: url spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5106

chromium-browser: url spoofing in omnibox

Insufficient Policy Enforcement in Omnibox in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to perform domain spoofing via IDN homographs in a crafted domain name.

CVSS 3.1 · 6.5 Medium EPSS 1.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5107

chromium-browser: user information leak via svg

A timing attack in SVG rendering in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to extract pixel values from a cross-origin page being iframe'd via a crafted HTML page.

CVSS 3.1 · 5.3 Medium EPSS 1.7% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Chrome Linux Kernel and 5 more

CVE-2017-5108

chromium-browser: type confusion in pdfium

Type confusion in PDFium in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to potentially maliciously modify objects via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Apple Google Linux and 2 more

Products

Macos Android Chrome and 6 more

CVE-2017-5109

chromium-browser: ui spoofing in browser

Inappropriate implementation of unload handler handling in permission prompts in Google Chrome prior to 60.0.3112.78 for Linux, Windows, and Mac allowed a remote attacker to display UI on a non attacker controlled tab via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.2% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5110

chromium-browser: ui spoofing in payments dialog

Inappropriate implementation of the web payments API on blob: and data: schemes in Web Payments in Google Chrome prior to 60.0.3112.78 for Mac, Windows, Linux, and Android allowed a remote attacker to spoof the contents of the Omnibox via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.4% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5111

chromium-browser: use after free in pdfium

A use after free in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac allowed a remote attacker to potentially exploit memory corruption via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Chrome and 6 more

CVE-2017-5113

chromium-browser: heap buffer overflow in skia

Math overflow in Skia in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5114

chromium-browser: memory lifecycle issue in pdfium

Inappropriate use of partition alloc in PDFium in Google Chrome prior to 61.0.3163.79 for Linux, Windows, and Mac, and 61.0.3163.81 for Android, allowed a remote attacker to potentially exploit memory corruption via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.3% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5116

chromium-browser: type confusion in v8

Type confusion in V8 in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 12.7% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more

CVE-2017-5117

chromium-browser: use of uninitialized value in skia

Use of an uninitialized value in Skia in Google Chrome prior to 61.0.3163.79 for Linux and Windows allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.7% KEV · Not listed

Vendors

Debian Google Linux and 2 more

Products

Debian Linux Chrome Linux Kernel and 2 more

CVE-2017-5118

chromium-browser: bypass of content security policy in blink

Blink in Google Chrome prior to 61.0.3163.79 for Mac, Windows, and Linux, and 61.0.3163.81 for Android, failed to correctly propagate CSP restrictions to javascript scheme pages, which allowed a remote attacker to bypass content security policy via a crafted HTML page.

CVSS 3.1 · 4.3 Medium EPSS 1.1% KEV · Not listed

Vendors

Apple Debian Google and 3 more

Products

Macos Debian Linux Android and 7 more