CVE-2019-5798

chromium-browser: Out of bounds read in Skia

Lack of correct bounds checking in Skia in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 3.2% KEV · Not listed

Vendors

Canonical Debian Google and 3 more

Products

Ubuntu Linux Debian Linux Chrome and 5 more

CVE-2019-5796

chromium-browser: Race condition in Extensions

Data race in extensions guest view in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 7.5 High EPSS 4.6% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Sle Leap and 1 more

CVE-2019-5795

chromium-browser: Integer overflow in PDFium

Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Leap and 1 more

CVE-2019-5794

chromium-browser: Security UI spoofing

Incorrect handling of cancelled requests in Navigation in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Sle Leap and 1 more

CVE-2019-5793

chromium-browser: Excessive permissions for private API in Extensions

Insufficient policy enforcement in extensions in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to initiate the extensions installation user interface via a crafted HTML page.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Leap and 1 more

CVE-2019-5792

chromium-browser: Integer overflow in PDFium

Integer overflow in PDFium in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially perform out of bounds memory access via a crafted PDF file.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Leap and 1 more

CVE-2019-5791

chromium-browser: Type confusion in V8

Inappropriate optimization in V8 in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.5% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Leap and 1 more

CVE-2019-5790

chromium-browser: Heap buffer overflow in V8

An integer overflow leading to an incorrect capacity of a buffer in JavaScript in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 2.3% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Leap and 1 more

CVE-2019-5789

chromium-browser: Use after free in WebMIDI

An integer overflow that leads to a use-after-free in WebMIDI in Google Chrome on Windows prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 9.3% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Leap and 1 more

CVE-2019-5788

chromium-browser: Use after free in FileAPI

An integer overflow that leads to a use-after-free in Blink Storage in Google Chrome on Linux prior to 73.0.3683.75 allowed a remote attacker who had compromised the renderer process to execute arbitrary code via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 9.1% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Leap and 1 more

CVE-2019-5787

chromium-browser: Use after free in Canvas

Use-after-garbage-collection in Blink in Google Chrome prior to 73.0.3683.75 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.1 · 8.8 High EPSS 1.9% KEV · Not listed

Vendors

Google Opensuse Redhat

Products

Chrome Backports Leap and 1 more

CVE-2019-5785

mozilla: Integer overflow in Skia

Incorrect convexity calculations in Skia in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.1% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Enterprise Linux

CVE-2019-5784

chromium-browser: Inappropriate implementation in V8

Incorrect handling of deferred code in V8 in Google Chrome prior to 72.0.3626.96 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

CVSS 3.0 · 6.5 Medium EPSS 1.6% KEV · Not listed

Vendors

Google Redhat

Products

Chrome Rhel Extras

CVE-2019-5782

chromium-browser: Inappropriate implementation in V8

Incorrect optimization assumptions in V8 in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page.

CVSS 3.0 · 8.8 High EPSS 13.4% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 4 more

CVE-2019-5781

chromium-browser: Insufficient policy enforcement in Omnibox

Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 4 more

CVE-2019-5780

chromium-browser: Insufficient policy enforcement

Insufficient restrictions on what can be done with Apple Events in Google Chrome on macOS prior to 72.0.3626.81 allowed a local attacker to execute JavaScript via Apple Events.

CVSS 3.0 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Apple Debian Fedoraproject and 2 more

Products

Macos Debian Linux Fedora and 5 more

CVE-2019-5779

chromium-browser: Insufficient policy enforcement in ServiceWorker

Insufficient policy validation in ServiceWorker in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.

CVSS 3.0 · 4.3 Medium EPSS 2.6% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 4 more

CVE-2019-5778

chromium-browser: Insufficient policy enforcement in Extensions

A missing case for handling special schemes in permission request checks in Extensions in Google Chrome prior to 72.0.3626.81 allowed an attacker who convinced a user to install a malicious extension to bypass extension permission checks for privileged pages via a crafted Chrome Extension.

CVSS 3.0 · 6.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 4 more

CVE-2019-5777

chromium-browser: Insufficient policy enforcement in Omnibox

Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 4 more

CVE-2019-5776

chromium-browser: Insufficient policy enforcement in Omnibox

Incorrect handling of a confusable character in Omnibox in Google Chrome prior to 72.0.3626.81 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted domain name.

CVSS 3.0 · 6.5 Medium EPSS 1.5% KEV · Not listed

Vendors

Debian Fedoraproject Google and 1 more

Products

Debian Linux Fedora Chrome and 4 more